express.ba Open in urlscan Pro
172.67.190.21 Public Scan

Software

cafe /

Resource Hash

c7eefb21d0fdeb3802d2e21b1a3c176ae45513a16a94ae30bc5ccf2b3f43d408

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29441
x-xss-protection: 0
server: cafe
etag: 986 / 19706 / m202312060101 / config-hash: 17400476758908410755
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:09 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 282 KB
70 KB 140ms
41ms Script
application/javascript 18.160.53.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.53.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-53-102.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 99c6eb6c3f17d69837d604201ac0453a5677eef91484aee37e72dff818ddadbc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 17:54:12 GMT
content-encoding: gzip
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront), 1.1 5443600a954c786f2e851cd6ea9e7e98.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 22:20:11 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, IAD55-P2
age: 3178
x-amz-server-side-encryption: AES256
etag: W/"bab82e5d8801f394c1ef53a45dc29542"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: GuJCQWT2_S7DkXsMgp8PaokOs0v3el0J0FjBVBylCXmR_Tpelaes9w==

GET
H2 200 express.ba.js Show response
pahtpw.tech/c/ 3 KB
2 KB 82ms
28ms Script
application/javascript 172.67.173.253
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pahtpw.tech/c/express.ba.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.173.253 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5594b55a0a59c26e371986a6848f47aeebd2744d1cd7bc1c3c52505534a3766

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: H84QG0C9FBD8DAHX
age: 6875
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: WBssLjLg+Gz2UIMBI/uke+LDLHuRxudQ6eQlyxjO4lU22dwYH7MuLDIMfROuLKHY2VcnGh/CUkw=
last-modified: Wed, 13 Dec 2023 11:35:15 GMT
server: cloudflare
etag: W/"35f4e8b0d5af9bc3618c34c011fa4e02"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p6KKl8uStexX8Goe%2FOgosa9YcPUaJ646G2ET7DJCBiJn%2FrIQKsoS7V4FmYLEmyq4pyEu7be6oFm3%2BrThZK2fslGRU42CxPPFKKau5W%2FY8HWarFgPJgWvM4B1nLmNEg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8360da7a2e007116-YYZ

GET
H3

200

logo-express.png
express.ba/wp-content/uploads/2021/02/
Redirect Chain

https://expresstabloid.ba/wp-content/uploads/2021/02/logo-express.png
https://express.ba/wp-content/uploads/2021/02/logo-express.png

10 KB
10 KB

342ms
342ms

Image
image/png

172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2021/02/logo-express.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: a07cccd0e5e669d41f47f3fffceef78fb1628bb0a2bd6dd961868ba8e0dc900a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 08 Feb 2021 12:55:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "602134b7-2720"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VTCry7LZ5uOxnuG41UJrtaehSMl%2BWAY3HIbrGq03aZVMbEkTXd0B19nGgxLENOSTAl2nH4J2vB2p9V1v%2Fr2JonHdpP4WtGnB05BBQ1eTRgPG3tCxCUPtNDTIBRb0"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a8a2b3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 10016

Redirect headers

date: Fri, 15 Dec 2023 18:47:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KBgJDNOODY%2FNZMCQ5PEEaizFrmy%2BWG8rLHhlqCrYPFvwYBZuyUBTxXhesfiXycWfmOThTyIw8LHa9b%2B65H7mNXneJ9s7rajnCsHNTFQu8U%2BbEqniBBB3AuPfAlJs4OAvoFke"}],"group":"cf-nel","max_age":604800}
location: https://express.ba/wp-content/uploads/2021/02/logo-express.png
cache-control: max-age=3600
cf-ray: 8360da7a39dd36d2-YYZ
expires: Fri, 15 Dec 2023 19:47:09 GMT

GET
H3

200

logo.png
express.ba/wp-content/uploads/2021/01/
Redirect Chain

https://expresstabloid.ba/wp-content/uploads/2021/01/logo.png
https://express.ba/wp-content/uploads/2021/01/logo.png

4 KB
5 KB

31ms
31ms

Image
image/png

172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2021/01/logo.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 7ba344d0c0925ac347ae01d521060c0b9af04078c6aa45fcb5447fc0b309c465

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6830
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 4353
last-modified: Fri, 29 Jan 2021 14:08:11 GMT
server: cloudflare
etag: "601416cb-1101"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ydnQZQJkO96NrnyrDM%2Fa7i7bbdxZlGxKK77qGijMH86jROgk1txTiTw36JYyVYTMdAiWgf%2B17KN6781uV2Tr%2F8xRJVW3xcrnC62OMjowAV7JmRxtjb2lUE2OH6AN"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a8a283702-YYZ

Redirect headers

date: Fri, 15 Dec 2023 18:47:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PV8Igh%2BPIJ6kDbSiOioBHksOhoUS4bx2Pt5%2Fs0vS1nUbzGyZRn0wrQpIL3IVo0bkYcBQXNRiOhX7uDaY4UU%2FQ5o7uyhMvpkzZJdXVKy0karUmsk9JLX%2Fq3BYkqB83YSG8Zrl"}],"group":"cf-nel","max_age":604800}
location: https://express.ba/wp-content/uploads/2021/01/logo.png
cache-control: max-age=3600
cf-ray: 8360da7a49e136d2-YYZ
expires: Fri, 15 Dec 2023 19:47:09 GMT

GET
H2 200 REW-1-350x250.png
express.ba/wp-content/uploads/2023/12/ 184 KB
185 KB 31ms
29ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/REW-1-350x250.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: f28408e26884f3d9bbbb62d6fa18907bfcdf3c93e72f06e69215738799f82da4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 622
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 188821
last-modified: Fri, 15 Dec 2023 17:30:58 GMT
server: cloudflare
etag: "657c8d52-2e195"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sN5Hd%2B2mOpNT5P2oQYKWgunh1%2FaS4T41Q1pSqLvhTFOGgFoqLT05EXdygnkMjmpxrUhOMOrgaDYd6B1CZSUmaiAYwyQQheCEC5ooFXqQHbReCzrqOd%2FTzDPQ9%2B7q"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da79e98dab3b-YYZ

GET
H2 200 Snapinsta.app_314721099_2612720648871029_9006878668139165649_n_1080-350x250.jpg
express.ba/wp-content/uploads/2023/12/ 44 KB
45 KB 64ms
64ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_314721099_2612720648871029_9006878668139165649_n_1080-350x250.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 8e6e813b1e6ed0bc4c61de67dcae25da9f72460abf2a094a07d1d5d0a1efb7c0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 622
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 45312
last-modified: Fri, 15 Dec 2023 13:53:28 GMT
server: cloudflare
etag: "657c5a58-b100"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BCAqxFQepsLJCi4dSYIT4xCx8C1ZknZDoG2iLAG8FeCCUZIm38G3MIf%2BFGNZB4zN2CuPr4VMkm573YvUgNlH9FJeosett2UkhBIYxZCH1yld7kEFPgeuCw7Bltf%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da79e990ab3b-YYZ

GET
H2 200 24540_devojka-poklon_fxl-350x250.webp
express.ba/wp-content/uploads/2023/12/ 20 KB
20 KB 67ms
67ms Image
image/webp 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/24540_devojka-poklon_fxl-350x250.webp
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 44bb6848a738ed610dca438ce92352aadfd128ecf8c8e30f4e1a3a157fe50af5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4398
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 20240
last-modified: Fri, 15 Dec 2023 13:10:19 GMT
server: cloudflare
etag: "657c503b-4f10"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YhewccAxHQfFwK5hHq5onOw5cvT7NPmdllNpif6Jd0PKREpqQoHe6AKgGSzcL2voH%2Bgonc0op8dR3SdJ56hbHxCQx79vfdwCAaoRt6Cg2xi6bXNT0IaYFblHRzwT"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da79e991ab3b-YYZ

GET
H2 200 jeg-empty.png
express.ba/wp-content/themes/jnews/assets/img/ 70 B
441 B 27ms
27ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/themes/jnews/assets/img/jeg-empty.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 67ebf650147a9122e94ff1b25a78a82e903b92b877821c1479de69f00f59d429

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 70
last-modified: Mon, 18 Sep 2023 09:21:04 GMT
server: cloudflare
etag: "65081680-46"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MO%2Fjtg9sFSfBmOewF%2FfmiCXC8JmvF%2Fg%2FFvHAsXIDgUYcSceIOtw2zCPw%2FVRJcD64V4gXrMQa3Z6Zcsc6UoPRGoA6OA6xtSVQuSvuRbSawnuM8CsUDIcKMMqu84gp"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da79e993ab3b-YYZ

GET
H2 200 post-267804.css
express.ba/wp-content/uploads/elementor/css/ 1 KB
659 B 60ms
59ms Stylesheet
text/css 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-content/uploads/elementor/css/post-267804.css?ver=1702459890
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: a90cb2d50d40f43f219292e4026fc9577eb95620df60c07e6d2a3f9169fc3783

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46
cf-polished: origSize=1135
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 13 Dec 2023 09:31:30 GMT
server: cloudflare
etag: W/"657979f2-46f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=auh%2Bw3lpKFLDbsTjW%2FwEbIz%2BnWtf2N5HJdcMgOWZKT2YklZx%2Bm4yKU8aERwuCheP0BZJpof5jEnjsKQ4a28Fn017eQtkzullAy4vz34ciiex89czrMhugksvy0cC"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8360da79e997ab3b-YYZ

GET
H2 200 global.css
express.ba/wp-content/uploads/elementor/css/ 9 KB
1 KB 59ms
58ms Stylesheet
text/css 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-content/uploads/elementor/css/global.css?ver=1702459892
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 231fbc104c9ffce42ecd400a3847a76a2a2ca309525caa137b7080c8634fe8ea

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46
cf-polished: origSize=9475
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 13 Dec 2023 09:31:32 GMT
server: cloudflare
etag: W/"657979f4-2503"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LlvGq32l6rFLvWh7KtTQayUDgXdRrtR8BG1RDH5clTM9PqkNOT7t%2Fy%2B%2FntTh6Kn%2F7xjrRbwO%2BOvzIJv%2F7tZoVgXfKoaVMegRKMPMVhFGb8GKtvi34CaHt2digQzr"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8360da79e998ab3b-YYZ

GET
H2 200 css
fonts.googleapis.com/ 44 KB
2 KB 127ms
47ms Stylesheet
text/css 142.251.167.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=3a136a3f0c6b6ae1770a3c032e039526

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f95.1e100.net

Software

ESF /

Resource Hash

f82a66d3e478235d29587378aab1eaccdf3513f5ba34f8196dfdcb2f0b75436d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 15 Dec 2023 17:43:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 Dec 2023 18:47:09 GMT

GET
H2 200 78d35917.css
express.ba/wp-content/uploads/minit/ 1 MB
175 KB 160ms
159ms Stylesheet
text/css 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-content/uploads/minit/78d35917.css
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 8e289d18016dbc9e8f2eefb50141af4855beee3be7bb5e08dd8fcc8a05f876cb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=1360310
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 08 Dec 2023 13:24:50 GMT
server: cloudflare
etag: W/"65731922-14c1b6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2B2GM2EpXVMRUrV9%2By5SFjIi3MbUia%2BqeZdad7LhltaI1EIkb78SvB%2BfnO4%2BsxqeThLYPpsv3oZ1c%2Fu84j%2BQjs5XSG1DbGF4q9QNEc6zYuAngxNYk4FsDRam34hR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8360da79f999ab3b-YYZ

GET
H2 200 12948711.js Show response
express.ba/wp-content/uploads/minit/ 438 KB
132 KB 361ms
361ms Script
application/javascript 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-content/uploads/minit/12948711.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: e221bd7759c6d712453f5ca792a7049f47dd1f87e2837c8c2b7e2732b6741a57

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=448461
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 15 Dec 2023 13:01:45 GMT
server: cloudflare
etag: W/"657c4e39-6d7cd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mw8TFHyp%2BZLnBGZiEH1i3LVniuaqgWApAfLJKkYWgThmiKZKzOZ6pzm8eX%2BjIzj4yupQjcS6xy1lOhCmJ3dbyZismknCWpfVusL4BmL2ExsQnc76LlfaFwASp7Kd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8360da79f99bab3b-YYZ

GET
H2 200 wsyy.png
express.ba/wp-content/uploads/2023/12/ 559 KB
560 KB 544ms
542ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/wsyy.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 031f4b4579817f6a9c86d634343785e50a1de3f8bf36c180dd32082ac90cf633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: MISS
last-modified: Fri, 15 Dec 2023 17:49:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c919c-8bb6f"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RQEZPvtBMMDiJvKJHi69Mk1Auoo%2BfR4npd3AmwhkxoNDQkm2%2FiQntF69XJk5AAI0MWVxHHabbbRSh2Oe0JWcVzT35fbhsObjsRvAuJ%2FNRd0k098MgyWr44%2BYepT1"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da79f99eab3b-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 572271

GET
H2 200 ztrtz.png
express.ba/wp-content/uploads/2023/12/ 504 KB
505 KB 541ms
539ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/ztrtz.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 72fbbac0a680171eab64471bcbf75de4cda0a850622e4b2df961a7b28c4f68db

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: MISS
last-modified: Fri, 15 Dec 2023 17:09:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c8854-7dea0"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ews70yRVZs%2B7nh3ClqoMM5bvQbsuaaCvQXSBHw0dejtxhtjd6SBUE4zZi3fG0i9oUgI4RH%2BCjEqjPS9vhoHN6Qu9og8ZsuP0lU40c0ID7H2vsSBJ7vnfdygWP%2BRA"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da79f9a1ab3b-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 515744

GET
H2 200 danijela-dimitrovska-ognjen-amidzic-mina-naumovic-1000x555-1-350x250.jpeg
express.ba/wp-content/uploads/2023/12/ 18 KB
18 KB 59ms
58ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/danijela-dimitrovska-ognjen-amidzic-mina-naumovic-1000x555-1-350x250.jpeg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 331a94698d4eb5980609cbe2f2773eef72206bfe66177b875f6be3dd7063facc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5454
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 18027
last-modified: Fri, 15 Dec 2023 14:11:19 GMT
server: cloudflare
etag: "657c5e87-466b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O0ofO9b1gpnrVE0DxsGvRXPDJ9HPxlgJyGP5E6%2FxdJiDJ4LKj0K6dARcOYV7ZWK%2F0ptl8n6VDJ7T%2FukXYJf76KdNvIAxJazLTPginOmsrMiWpts5vYe2sMFjDUoN"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a09afab3b-YYZ

GET
H2 200 Snapinsta.app_338591304_965914524743402_2649898684643528532_n_1080-350x250.jpg
express.ba/wp-content/uploads/2023/12/ 36 KB
36 KB 60ms
59ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_338591304_965914524743402_2649898684643528532_n_1080-350x250.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: f480db7cdb9c39f00bbaa1c35dfd7cd79384c8ecb032eb94fa9eb952a5024037

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1734
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 36439
last-modified: Fri, 15 Dec 2023 12:22:35 GMT
server: cloudflare
etag: "657c450b-8e57"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0XALB1ULKDKdnMOoFz48spb7vqufIlOuCbGLQtaJIaIDZzHQjSTcuDQMx8Z8nWCVrNetgbGLejTwr2xX0i6HjKPY1TXGrKEyx0qLqd%2FTJQEjcldTdjWb8cSXc%2Bug"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a09b1ab3b-YYZ

GET
H2 200 preloader.gif
express.ba/wp-content/themes/jnews/assets/dist/image/ 4 KB
5 KB 62ms
61ms Image
image/gif 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/themes/jnews/assets/dist/image/preloader.gif
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: e2e60e9eae839d6b2e857c708f6d02ae6069141594b941a1590cd5c5435d42f4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2421
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 4399
last-modified: Mon, 18 Sep 2023 09:21:04 GMT
server: cloudflare
etag: "65081680-112f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LUTn4CF9rzFFEr%2FbF%2B3mKf7m6Bz1x4a6Bx5kn%2B%2Feh76eotYm1QoURi5qNnzwhca2CCH%2BZsXSglR%2Fv5iKadW3GXib0x8OG9bzCsmQzjZIRHYr1yvoWx8nGaLF%2Fc1f"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a09b2ab3b-YYZ

GET
H3 200 5426-350x250.jpeg
express.ba/wp-content/uploads/2023/12/ 15 KB
16 KB 39ms
38ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/5426-350x250.jpeg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 97d9195f79bd74a98a0b1f27cb287e7680ef3004b97559ba94a61887d34024dc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3322
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 15538
last-modified: Fri, 15 Dec 2023 11:31:48 GMT
server: cloudflare
etag: "657c3924-3cb2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sSChUu8hoD4IU5GqQH1FTosR646FkdwFD6Id%2BkZ%2FMVUtbIzKDoQLYGja9GzGcsAP3lMTrobFA5%2F0cSC59MIqzDUfCfZ%2F1M2wqUfbe59XMr2aBvAMafg5Nug%2Ff70I"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a29123702-YYZ

GET
H3 200 Snapinsta.app_279214505_1642699389422158_3139450587955156935_n_1080-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 28 KB
28 KB 342ms
337ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_279214505_1642699389422158_3139450587955156935_n_1080-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: f7531643d031366dd6591df479b7c961c81b09fa26fc6ba8945c2c3193484ccc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 11:19:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c362b-6fee"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GVqvwutj%2FdOE8jc7v8On9kqdQQP01%2BDIPLkyknGpOPS1Z36pMOzs3w3MoOfn%2FB5OM9%2B5CuERkVKHsnrQMSaCixWn8om8KummjF0%2FT2pjYygXEbb0KVzj0cl0sblL"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39213702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 28654

GET
H3 200 Snapinsta.app_377695618_280410448137562_2688439482473351110_n_1080-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 26 KB
26 KB 56ms
51ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_377695618_280410448137562_2688439482473351110_n_1080-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: ad34534160dd5ecbbaa22fa1bf0a79e0cabcecc55f36abf98315310ea2d73b4d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 26513
last-modified: Fri, 15 Dec 2023 08:54:59 GMT
server: cloudflare
etag: "657c1463-6791"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M0JXDtp3c30X2mw388dH%2FoNkXr8L2zsFAP4sQhDeyaUF7dURhURmgXmTj%2B7mRXsE2Jhm3MUEcnzPcyw07tj32hRVK2ZabpeNGXtn6T%2Bv%2FEhjer%2FDLh5wSKqw4owr"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39273702-YYZ

GET
H3 200 852972_screenshot-1_f-350x250.webp
express.ba/wp-content/uploads/2023/12/ 7 KB
8 KB 39ms
34ms Image
image/webp 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/852972_screenshot-1_f-350x250.webp
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 7b950e761536bf87c3a70eb932334fb36c0e75d84434b8555e541470bd4c7290

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 7256
last-modified: Fri, 15 Dec 2023 12:10:07 GMT
server: cloudflare
etag: "657c421f-1c58"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OU7JIiu34CZq5IPN32cIqWKY94O4sAUXdUVjEWSl3K%2BpwktEWwWxvoHPZBmRA4y4ReNQfzLuNeA0%2FfhpFDOzJ0LUCQvVyuBKoTT2o7kSFtgGd%2F8grFjbY4OYjjwe"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a392b3702-YYZ

GET
H3 200 Screenshot_3-2-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 1 KB
2 KB 72ms
67ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Screenshot_3-2-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: f5f882e26cdfba5a76eba1e1f5213939aca716c1d4a8ef3329a051a2a20aeb5f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6847
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 1532
last-modified: Thu, 14 Dec 2023 14:11:14 GMT
server: cloudflare
etag: "657b0d02-5fc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JyzQODXvXFQT%2BAicEPT9q%2FylM7hy5O%2Finrj7eSY5uEuwNy9Mf6jL7mCsVkgJxyo%2BBz%2BDiA1y2v%2BSRBvLCx4BDkK9q5Wh7kn8eW7v5DBeCbiQO9n3xGqnReqv%2BELM"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a392f3702-YYZ

GET
H3 200 411123769_1492522581315117_6938590474184196933_n-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 2 KB
3 KB 73ms
68ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/411123769_1492522581315117_6938590474184196933_n-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 63dc8e60c9cc897c94d34b31057c0692ffc0a6a5fc46ec86e571c50dc1b4bdef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 2374
last-modified: Thu, 14 Dec 2023 10:41:49 GMT
server: cloudflare
etag: "657adbed-946"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wHmRAY7IxrnLb2szNIS3CMMvOgjIHRzUkUvWXtEFyORy%2FFbOAk0tZTZsbiL2CPdC6FhDLac3N3nttasuWaFQ2G9Nw%2FAac0vUjXDJhPgAKuLaY2nGV1ILAHgPln2H"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39323702-YYZ

GET
H3 200 403621494_203817992786451_5112263967871378195_n-350x250.jpg
express.ba/wp-content/uploads/2023/12/ 17 KB
18 KB 74ms
69ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/403621494_203817992786451_5112263967871378195_n-350x250.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 370745f7878c0c0668dc40c71f2c3a351c60399c076a91cca57c41c87194a854

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5500
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 17915
last-modified: Fri, 15 Dec 2023 14:45:45 GMT
server: cloudflare
etag: "657c6699-45fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fe%2F3fphDHH4wOpKG3J7uBHKXD%2FRLE2dkVZj4v869jMVai9KNUX9RZVYRJ8bfjsj61X%2BLG9O60PoqdpGJ7edovlYh5e33fEHGXoE0pzesALRIaAL7t5pl2N7h%2FY6U"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39373702-YYZ

GET
H3 200 Snapinsta.app_394372958_18391867393026814_5941518957645166591_n_1080-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 2 KB
3 KB 352ms
347ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_394372958_18391867393026814_5941518957645166591_n_1080-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: b459ffaf06455c8e27710eff6d772d877511b466d2832ea54f89218af8dd323e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 12:30:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c46f7-95a"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UWG%2FiJbwC%2Bc41x1W6UfIiVaA8WuaI7HrZEuSe61Y5eHgQB0AE%2B1XhxyfVNy6J%2FIDpX7vkuPQnLyXBfnYvKtr3S37OnIC9ppSrkl44bJVcm%2BZlPV9MZOcppZIsuDs"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a393a3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 2394

GET
H3 200 Snapinsta.app_395966746_18397276309028088_4030940742956780796_n_1080-e1702479813640-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 3 KB
4 KB 74ms
70ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_395966746_18397276309028088_4030940742956780796_n_1080-e1702479813640-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 83287ab0845444abe2ad1e339a9b995c6dc140044715b3645191206a740860b6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2713
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 3490
last-modified: Wed, 13 Dec 2023 15:03:33 GMT
server: cloudflare
etag: "6579c7c5-da2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bi2e8FKiVLt9Nhm6X%2BAtyTtkM6cfPvQldQKEQ5CoFTnYjT5yxBHQs6msLKvYbysort1vvL3SyLwCMK98NqtYVGp3ccfkabAwmR7tWqMSwyqryJbrOKbMlrOkdSFW"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a393f3702-YYZ

GET
H3 200 Snapinsta.app_318651240_847017176504752_7550286202276206460_n_1080-350x250.jpg
express.ba/wp-content/uploads/2023/12/ 39 KB
39 KB 74ms
70ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_318651240_847017176504752_7550286202276206460_n_1080-350x250.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 422183c3b3df26056c4033d1827781424d7c9093f00a8903caf577508854448b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3749
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 39826
last-modified: Fri, 15 Dec 2023 14:01:31 GMT
server: cloudflare
etag: "657c5c3b-9b92"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YBdsrvCrWdhyr%2FftkW4N4YxvtNwGN6JcSjHlt81%2BhyzHxKu1BastmpjpWKjiMRdCedho5odMKSSke3q9g%2F1yx1kkUlfdWmxcp47o6%2BDmm%2Fw%2FOsRxt2phLx2Qv9GA"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39423702-YYZ

GET
H3 200 Snapinsta.app_355408807_3194284127544196_6758784819206524370_n_1080-e1702640315253-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 3 KB
4 KB 88ms
84ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_355408807_3194284127544196_6758784819206524370_n_1080-e1702640315253-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: ea95cbe1b53efdbaac1e9f2040b6b529b72facfa4cb372f636944065b3a8697d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 35
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 3394
last-modified: Fri, 15 Dec 2023 11:38:35 GMT
server: cloudflare
etag: "657c3abb-d42"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g5%2Fzmr3z%2Bf2YWQQoEAxta2v%2BJB0qGKIL2IOqSbuPm7orvY28Ko5oH0%2BFWVXNnzFhlW22LEOnFp5jJxgNwnizcUXspMoTD31szcmud%2B0IKQoAk5Fd7dHam0IWQMmD"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39463702-YYZ

GET
H3 200 543543_filip-djukic-goga-aleksic-farma_ls-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 2 KB
3 KB 354ms
350ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/543543_filip-djukic-goga-aleksic-farma_ls-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 7a7fd064ee62a7b486913ac84f2eca15a3b398b75c5e9ecdbe339f8608e6638f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 09:02:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c1627-9fb"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bxm%2Bh7nue6vxF%2FdkYhZ8hOimBun%2BdwscEXGtugMscXJ%2BD5MO6zuRFc3MEjVGIML%2FqluYranK59RGg4GqEGJcGdB7L3VNkRqRKlHY96jv2frjswUYoFU5s0qlZu4R"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a394a3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 2555

GET
H3 200 esma2-350x250.jpg
express.ba/wp-content/uploads/2023/12/ 12 KB
13 KB 373ms
369ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/esma2-350x250.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 113bd6429b5f7fcc11e60425799bed278009cab4c32dc032e6ab0af64e0e573b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 11 Dec 2023 10:52:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6576e9f1-30b0"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Lfp7uy4yVMkbjZbQ2tu0Ko8uiDiQoFsYmiIYO%2BGMWpXEkHSlbBa%2BnvRRcnu20a%2BH%2B%2BPiBUO%2FC98%2FT5MwoRnpjAy8%2FM%2FzhJrnV9WFEcbatrY2awedSzeqOIK3MR5"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a394f3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 12464

GET
H3 200 ruz-120x86.webp
express.ba/wp-content/uploads/2023/12/ 2 KB
3 KB 89ms
85ms Image
image/webp 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/ruz-120x86.webp
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 4eb6cc2f1a17ec3141746c469c04cebb81d9359ee463a800b0d69d86b5264f09

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 35
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 2122
last-modified: Mon, 11 Dec 2023 10:41:48 GMT
server: cloudflare
etag: "6576e76c-84a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EdMX0aeblIDrCMMmqt3cRH5DnuliT7Zb1sXZxdubHvQGXgs7USnYP9fUk%2FyTrmrmjVAo6GHDcEq6Uxq1JlZXEfuoiII41D7rzEN0SXqS3FHqfamqY4dz%2FxsvKUq8"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39543702-YYZ

GET
H3 200 esma-e1702286043748-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 3 KB
3 KB 352ms
348ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/esma-e1702286043748-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: de5a7b8f1227d4fc379830f2c4e2e0ecbe991d77db2fb128f41cc9c2bbc4a7e2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 11 Dec 2023 09:14:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6576d2dc-c20"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c%2FViAdk8aMG9TvM8cHCq4PO64hiWuRmrpDnbQa5Cz8EorOlm%2FmlRXPk2msCqjJrWqnHrxgDfqAIaL%2FgiWd4RmoJH8E4hX3cGKxTCKmH%2FVrS9FksJ75%2FrHlRNTNPC"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39573702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 3104

GET
H3 200 posao-e1702638711319-350x250.png
express.ba/wp-content/uploads/2023/12/ 136 KB
137 KB 373ms
369ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/posao-e1702638711319-350x250.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 05189df19c01ea8c423215053f64f4d55074a182588a2a7b38b3a33d951fb96c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 11:11:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c3477-2209f"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YVp9tWroMd01TgntKEjdfYS%2FkxPojib0IjZRCxJUOny0Cw6PzVjQMaG0jBcyJ%2BEta5e8T%2BPOB0JgDhCHgTgJF%2BpaLwFdV31YtZvr4iMbh%2FDoPh9XXNxS0EsVYouC"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a395f3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 139423

GET
H3 200 %D1%81%D0%BF%D0%B0%D1%81%D0%B0%D0%B2%D0%B0%D1%9A%D0%B5-%D1%81%D1%86-%D1%82%D0%B2-660x440-1-120x86.webp
express.ba/wp-content/uploads/2023/12/ 2 KB
3 KB 357ms
354ms Image
image/webp 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/%D1%81%D0%BF%D0%B0%D1%81%D0%B0%D0%B2%D0%B0%D1%9A%D0%B5-%D1%81%D1%86-%D1%82%D0%B2-660x440-1-120x86.webp
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 3fed88e224c5ddd4f767b6d1a54fb35a3c1978254059c2052741cc935fc95503

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 14 Dec 2023 15:08:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657b1a88-904"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H5gYdcYza29f87fq1ufl5jRFrnF59%2FqruvuDlCUuAMUeAeFb0kHaOMGT7o3XyG%2F9lnSj6YECNkpx86jJ0Of7hxExcS9FnOJGF99XtpOEKMzHTndwIL7OgWjz3WMM"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39643702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 2308

GET
H3 200 515508_lesli-horton-voditeljka-youtube-global-news_f-320x213-1-120x86.webp
express.ba/wp-content/uploads/2023/12/ 4 KB
4 KB 363ms
360ms Image
image/webp 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/515508_lesli-horton-voditeljka-youtube-global-news_f-320x213-1-120x86.webp
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: a3de97fd47220e8f9b16e75c4c07746bf3d800daf2c05d9f74da663945c0c7f0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 14 Dec 2023 11:01:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657ae073-e06"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wmexYJyD6xjerdqeTW0R7141ru1MThHIm4wFqqQM3sHgKewoaiXVTh6aoXawZ67T%2BhpH%2B4uS2FtBwaS8qO5ZHpR04MUUeDZbOPw6QXFWNu9QD2GAO8m8goPXD%2Fy"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39673702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 3590

GET
H3 200 kaziprst-350x250.png
express.ba/wp-content/uploads/2023/12/ 87 KB
87 KB 365ms
362ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/kaziprst-350x250.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 6fe0a7856f791ca9d24ab82c330e2760d83f47e5feb411fa8b3525ac238b5a3a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 09:36:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c1e26-15b4b"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DcDMcimopI7xOSV5RiNGhSAzV2aCmeRWtkzBs2%2FGO0fmMWz0n%2FEJR%2B6GZDzjHVQxyT4%2FrWtDjgbMbWxkgtT9Y3KO4B5nfqcgU7BTJ4jcrgNJKUmP7azg0dMFndxH"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a396c3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 88907

GET
H3 200 403406181_737382864515448_8996378102603853771_n-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 4 KB
5 KB 367ms
364ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/403406181_737382864515448_8996378102603853771_n-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 5a270f1e6fb324d1b942156db5b93f510acee2e6043431e37fe489df37f27b5b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 09:24:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c1b5c-1192"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AHxeDuZjoDSyb5eFz1djlChOUZsgwPbjyJQn3Ztc%2FYUT28s5HGJzGzb0qaDlajmcKRLI3Rz%2FIxRBttej74tlxCjmqmUYtT0p1GgsiX10bkGdPTm0yJ0sSfQ0j6OD"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39703702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 4498

GET
H3 200 colicc-120x86.png
express.ba/wp-content/uploads/2022/06/ 18 KB
18 KB 354ms
351ms Image
image/png 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2022/06/colicc-120x86.png
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 9378e45d4b1ddceb4b83d94004ff1853535e21be0a91cdeeadfc17aa811a32f0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 24 Jun 2022 15:43:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "62b5db86-47e8"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1RTgDQM0GZ9xast88zTtuyxK9CwyWlY39glSi21EcYRUYtYN%2FKtiv%2FOn3My6Y%2BsM9hegKJmN64OGrZFsGipdqi6YcG3XOQc%2BIsPTv1Cvc9gbK7cnZxqv3BWTqmIa"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39733702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 18408

GET
H3 200 Snapinsta.app_310844419_401790675490249_8373029259236468486_n_1080-350x250.jpg
express.ba/wp-content/uploads/2023/12/ 49 KB
49 KB 385ms
381ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_310844419_401790675490249_8373029259236468486_n_1080-350x250.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: ac970b93ded68bb1a75361cfdb07321c0d387712372e60b7336f33275d5e6bef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Fri, 15 Dec 2023 09:12:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657c1891-c220"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h1Y8I4h5Es7jUMsl9gI%2BURryiYacxmjlOj%2Fi%2BnMGdeZQ0kbgxwAeYU58w%2BUM6QDFRabng32qrGPOXu9smSQpEvku1p%2FuMDg1Y3UcPKQxtBcNqn9cQZp0KvPn5Jha"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39763702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 49696

GET
H3 200 Snapinsta.app_404299730_18411336325053583_4208853790076930336_n_1080-120x86.jpg
express.ba/wp-content/uploads/2023/12/ 25 KB
25 KB 367ms
364ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/12/Snapinsta.app_404299730_18411336325053583_4208853790076930336_n_1080-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 51f7bba66a130066c86825fcc6c7153c74f89327b5774c357095a06648ab5985

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 14 Dec 2023 09:16:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "657ac7d8-636c"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BrVxxGUjW1wHT0bgPvkbHdYj9LNBZwdFeWomfICYsyftiIBc2JlOnGZSO3BUuBWFBC040kxyCI1E24QDYy3WFVpNn%2BGXut%2FqARBwusxjNTbcgVV3pr6Q4BvjHfXv"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a39783702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 25452

GET
H3 200 Zeljko-Samardzic-9-120x86.jpg
express.ba/wp-content/uploads/2023/08/ 37 KB
38 KB 347ms
344ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/08/Zeljko-Samardzic-9-120x86.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 59fecd6af16227345d3257708a5a295e4f1dd7b1a6554c4ff0fb4791e307cd29

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 15 Aug 2023 15:06:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64db945e-95bb"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sIUHBXx%2FIFghEIcx0r%2BtqV4WRYchJ%2FziPU6gIVU%2Fc1LZHwaEwnH8hzZtJUJZmXc9OsM73EaiPzbj35DBsG%2BwDpBbnxb3qCyfg20mPpcTivHbPLTzF2GwOERcUNux"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7a397c3702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 38331

GET
H3 200 wp-emoji-release.min.js Show response
express.ba/wp-includes/js/ 18 KB
5 KB 87ms
84ms Script
application/javascript 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-includes/js/wp-emoji-release.min.js?ver=3a136a3f0c6b6ae1770a3c032e039526
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 26 Apr 2023 16:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5982
etag: W/"64494d79-4904"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tx1NojrlYOI7oKGH3dygGfa63u9rcj6%2FBFV1oWjX2leH9uqTnwA%2BuQi6KX6MdUEUHMvxyQA8WkR273X3bJ20WK5QoldwvQyrerO2bj6%2BmTazG4fh7hxiaA6Ig1IX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8360da7a397f3702-YYZ
alt-svc: h3=":443"; ma=86400

GET
H3

200

main.js Show response
express.ba/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame 2DB1
Redirect Chain

https://express.ba/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://express.ba/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

7 KB
4 KB

23ms
22ms

Script
application/javascript

172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://express.ba/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Server

172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea7c886457386d43afa7cebdfbc9d769335d6822a23bbc8a5349ea5f8fee9bc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K9fKI7s5FUQSnP95hkBgBPbCwXcDPgjZHuaNMFn58dw6N6sZfa7oZmcF7IUN74Jj0ahYrUnXj1FsOO7qG1j0s3FzF%2BH03kVNm%2FujGIQ%2FTxF%2F2DSMeO4Nuyg2yLoC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 8360da7aca853702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Fri, 15 Dec 2023 18:47:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wVFjEkAea1pX5s3uYHhrmhYCu7PmLEpR%2B6Dfs%2F3dL92VDLXW7zeKCEjShhcVIrrHNkPiKM1d8T2rxZmmQv%2BsReinjg67ppUKV3nxilqJadeln5RiRDuXc%2FML%2FEfR"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 8360da7a59ab3702-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 204 collect
analytics.google.com/g/ 0
250 B 99ms
40ms Ping
text/plain 216.239.36.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-NH50T43DVN&gtm=45je3bt0v9105423624&_p=1702666028988&_gaz=1&gcd=11l1l1l1l1&dma=0&gdid=dZGIzZG&cid=891998810.1702666029&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1702666029&sct=1&seg=0&dl=https%3A%2F%2Fexpress.ba%2F&dt=Express%20Tabloid%20-%20Od%20nas%20ne%20mo%C5%BEete%20pobje%C4%87i&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.forceSSL=true&tfd=1119
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NH50T43DVN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
164 B 49ms
42ms Ping
text/plain 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-NH50T43DVN&cid=891998810.1702666029&gtm=45je3bt0v9105423624&aip=1&dma=0&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NH50T43DVN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 125ms
49ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-NH50T43DVN&cid=891998810.1702666029&gtm=45je3bt0v9105423624&aip=1&dma=0&gcd=11l1l1l1l1&z=793583858

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 projectagora.min.js Show response
palibzh.tech/libs/ 356 KB
100 KB 91ms
41ms Script
application/javascript 104.21.94.165
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://palibzh.tech/libs/projectagora.min.js
Requested by: Host: pahtpw.tech
URL: https://pahtpw.tech/c/express.ba.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.94.165 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55b6fa2acea5366b3237f440945968ac771830cc3d0b9f50f799fa58d2f05c92

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 7P6AR10BBGC9CY9Z
age: 5124
x-amz-server-side-encryption: AES256
x-amz-meta-version: 3.17.0
alt-svc: h3=":443"; ma=86400
content-length: 101266
x-amz-id-2: vzy4k3igpRI1Gu3vUiUys+JXBfGE3OpruFaWZXgLC54DPAHt0spQ3GSNEBOsj4xkE/6M8RwiaGTZ+/y66h2jWw==
last-modified: Wed, 08 Nov 2023 13:53:22 GMT
server: cloudflare
etag: "a4981a80d1e342eb72aa54f36a57724e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Skgi94LlkmMVje4RpmRfaUiBpNMEEFnFsTaA%2BK9Mol8X9AgJUCkkhxHOLahjeJLn4kgd%2FLfRiGffNzNqGW8%2BFXAqxENiE%2BsUhQqTg%2Bara9Ia85Sdae3c0fKzjXUbeYc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7b09cf36eb-YYZ

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ 431 KB
135 KB 35ms
34ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

108cdb682e1d256ba58174d96775ec12fe2e9515ffa2ca7edfff49343a4d97ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 14:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16873
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 14 Dec 2024 14:05:56 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 109ms
36ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=3a136a3f0c6b6ae1770a3c032e039526

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 11:32:12 GMT
x-content-type-options: nosniff
age: 26097
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 11:32:12 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 127ms
56ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 06:40:14 GMT
x-content-type-options: nosniff
age: 43615
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 06:40:14 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 146ms
78ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc66f942651a9fe1a598770d3d896529dcd7a03d02f40655451513093103e61b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 05:02:47 GMT
x-content-type-options: nosniff
age: 49462
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11824
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 05:02:47 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 134ms
69ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 13:01:22 GMT
x-content-type-options: nosniff
age: 20747
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 13:01:22 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 115ms
52ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f1c829b0c90fd664a03bb714a74f7d35d9e38ee1687104abc8ad5bd9c8ccb6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 12:21:50 GMT
x-content-type-options: nosniff
age: 23119
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 12:21:50 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 132ms
74ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 08:13:21 GMT
x-content-type-options: nosniff
age: 38028
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 08:13:21 GMT

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 118ms
63ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-18-160-23-201.iad12.r.cloudfront.net

Software

sffe /

Resource Hash

db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 13:19:23 GMT
x-content-type-options: nosniff
age: 19666
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17368
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 13:19:23 GMT

GET
H2 200 6d179b32-34dc-48b6-baa3-2befddbddafd Show response
config.aps.amazon-adsystem.com/configs/ 564 B
841 B 114ms
37ms Script
application/javascript 18.160.10.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/6d179b32-34dc-48b6-baa3-2befddbddafd
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-17.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 6cc1c27d2478355a6ace2616d66343a63b1d911d21bf71310756ab41fa1d6d47

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:43:12 GMT
via: 1.1 68a3b1d5c75429221abc685a453afb60.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: IAD12-P3
age: 237
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 564
x-amz-cf-id: -ER-5Q-mArJVW0JFSpAKzNHYuRvZHyGDa1Ue5kpH0UCFUgueQUSZIg==

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
305 B 40ms
40ms XHR
text/plain 18.160.53.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fexpress.ba&pubid=6d179b32-34dc-48b6-baa3-2befddbddafd
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.53.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-53-102.iad55.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:21:41 GMT
via: 1.1 5443600a954c786f2e851cd6ea9e7e98.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD55-P2
age: 1528
x-cache: Hit from cloudfront
access-control-allow-origin: https://express.ba
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: BjgBJkiCGmb9X1K01l2SLlhuO-b6rQlEPr-z2j-qeWwURN1Lnsi5vg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 4 KB
4 KB 500ms
392ms XHR
text/javascript 18.160.23.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fexpress.ba%2F&pid=nel2XESWUkdMa&cb=0&ws=1600x1200&v=23.1211.1645&t=2000&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-6575610-11%22%2C%22s%22%3A%5B%22320x50%22%2C%22320x100%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_320x50%2F%2F320x100-Leaderboard%2F%2FBillboard_M%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-5%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_MREC-Article-ATF_M%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-6%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_MREC-Article-BTF_M%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-7%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_MREC-L-ART-BTF_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-8%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_MREC-R-ART-BTF_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-9%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22300x1050%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_MREC-Sidebar_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-14%22%2C%22s%22%3A%5B%22970x90%22%2C%22970x250%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_728x90%2F%2F970x90%2F%2F970X250-Leaderboard%2F%2FBillboard_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-11%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_728x90%2F%2F970x90_Leaderboard-Fixed_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1576443920348-0%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_728x90%2F%2F970x90_Leaderboard-Fixed_2_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1576443969711-0%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_728x90%2F%2F970x90_Leaderboard-Fixed_3_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-3981719-7%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21864506698%2FAzra_300x250_MREC_D%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6575610-12%22%2C%22s%22%3A%5B%22300x100%22%2C%22320x100%22%2C%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_320x50_Leaderboard-Fixed_M%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1576443837533-0%22%2C%22s%22%3A%5B%22300x100%22%2C%22320x100%22%2C%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_Leaderboard-Fixed_2_M%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1576443879751-0%22%2C%22s%22%3A%5B%22300x100%22%2C%22320x100%22%2C%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21864506698%2FExpress_300x250_Leaderboard-Fixed_3_M%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&pubid=6d179b32-34dc-48b6-baa3-2befddbddafd&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.23.201 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

784ce0e1338b3cdd1f42909dbad8104443eb8999ff38524748e2691d83b8bedf

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 5ea972e689f9b02c2fa2ba9f72e70ede.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD12-P4
x-amz-rid: PEJVXRD7BX0F46YJC7AC
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://express.ba
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 4111
x-amz-cf-id: 39_oqX73pwXfUoO6yzYlbUGsEhpMEOYqL6eJ21Fd3BbJhZDogiTxXA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 106ms
36ms XHR
application/javascript 18.160.53.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.53.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-53-102.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:16:52 GMT
x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 9c13d38452f2017c92d65c8904408686.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P2
age: 66618
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: rjlwnsue14uO6VtuqNrSyX5FrMIDiJHcNTmhProTWdsUi-Fxg_D17g==

GET
H3 200 fontawesome-webfont.woff2
express.ba/wp-content/themes/jnews/assets/dist/font/ 75 KB
76 KB 30ms
29ms Font
font/woff2 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-content/themes/jnews/assets/dist/font/fontawesome-webfont.woff2
Requested by: Host: express.ba
URL: https://express.ba/wp-content/uploads/minit/78d35917.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://express.ba/wp-content/uploads/minit/78d35917.css
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4554
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 77160
last-modified: Mon, 18 Sep 2023 09:21:04 GMT
server: cloudflare
etag: "65081680-12d68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6jWmPrd1JoqbaX37G14DXO%2FvqkR9yaIvC22WRA5LYlnEwhsbgxFccHhQgbLSpu3l2tPYQbsoi8tzTwoM2cGa2hBMoJmxBS9dTfJYMq%2B9Bgh580B354yH9glW62KL"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7bbcc43702-YYZ

GET
H3 200 jegicon.woff
express.ba/wp-content/themes/jnews/assets/dist/font/ 7 KB
7 KB 36ms
36ms Font
font/woff 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/wp-content/themes/jnews/assets/dist/font/jegicon.woff
Requested by: Host: express.ba
URL: https://express.ba/wp-content/uploads/minit/78d35917.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: e2d3127da85763e024971c6192f78becbdf85db231b3d088c9f8b3777d444ede

Request headers

Referer: https://express.ba/wp-content/uploads/minit/78d35917.css
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4554
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400
content-length: 7144
last-modified: Mon, 18 Sep 2023 09:21:04 GMT
server: cloudflare
etag: "65081680-1be8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ouhxFbRzvz1AuuH1ckhOak%2BkGx5yCKlarB5YKPdswFMK0tfMrtoNT8uYw%2Fvt4CrDthSdzzjuRP4hqyudjmOjXOe6CsY8fyusRsqLFwCpXSq%2BexmagK3wydirLClo"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7bccea3702-YYZ

POST
H3 200 8360da778dd5ab3b Show response
express.ba/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 2DB1 0
533 B 49ms
49ms XHR
text/plain 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://express.ba/cdn-cgi/challenge-platform/h/g/jsd/r/8360da778dd5ab3b
Requested by: Host: express.ba
URL: https://express.ba/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=udJmzID67Gh9kH3TDP53XKP3gw0RYIh79IlKqOguVC0EtgpgEuLakITZj6LnLRbtYrm0ke%2Fig0isnYU03SE0kfLeKjpROu6mztvs51wcA8pQ3O3GcRa%2F%2Bvt%2FMIua"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 8360da7c9ec53702-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 21864506698 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 145ms
69ms Script
application/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/21864506698?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

430294464f88ca07f40ee2b47fa9e8ef5dd97bca9f1f959ad48d17aa178aacb7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-079MQeuyNURfRECLuUyqbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-security-policy: script-src 'report-sample' 'nonce-079MQeuyNURfRECLuUyqbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 nova.jpg
express.ba/wp-content/uploads/2023/05/ 406 KB
406 KB 350ms
349ms Image
image/jpeg 172.67.190.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://express.ba/wp-content/uploads/2023/05/nova.jpg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.21 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: f7c3fa3a890744f783d9dbaf538964b079fb10f2c2a593a4592d2b46918da84d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 03 May 2023 14:17:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64526ce0-656d1"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A%2FdLJUlcnqgXjRh5N6Mbbg5EpZpuNyc1odr%2BWVpLxp5mu93HJlwNnbKvz%2BJCABREuqYNlHjJ4Cz8ZSKVFGRGQP%2B%2B3y5MxyVhLpIfT5bG67LIMkgg9oJRYtuPb%2BU5"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8360da7db9463702-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 415441

GET
H2 200 AGSKWxW2Jr4WzpnBbN1q3ppbC8bVPYumNUWms7tEX5oGhmxe1SZixoPIDn-NTq99YX2l8S9q7m4KDfFfywfjUwTInv69OaaCGr5XFIaTOqNUkJ_CFxLHB1xd-9vc1HkKzl5IZf5-J0hiYQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 72ms
70ms Script
application/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW2Jr4WzpnBbN1q3ppbC8bVPYumNUWms7tEX5oGhmxe1SZixoPIDn-NTq99YX2l8S9q7m4KDfFfywfjUwTInv69OaaCGr5XFIaTOqNUkJ_CFxLHB1xd-9vc1HkKzl5IZf5-J0hiYQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAyNjY2MDI5LDgyMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9leHByZXNzLmJhLyIsbnVsbCxbWzgsInd1UnJjZllsWWh3Il0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.wuRrcfYlYhw.es5.O/am=wA/d=1/rs=AJlcJMyq4j3elD76bCvqI3Q9g6iUxioeVA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-99-84-208-112.iad79.r.cloudfront.net

Software

ESF /

Resource Hash

0840c40acfabe53b5d69e0dd15c88014fdff286f5f42513b850af3618895317b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-u7KS6f7iKD75L8M_8c4YhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-u7KS6f7iKD75L8M_8c4YhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 148ms
40ms Script
application/javascript 99.84.208.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.208.112 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:04:43 GMT
via: 1.1 5d9ef69d47a63c80a41bbcf6902f6312.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: IAD79-C1
age: 2547
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: roqBEOUohQBNOcdvu2xpchO4GIaoA-NmqeGH78XcBIOuvaHhZPWCRA==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
897 B 56ms
16ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 15 Dec 2023 18:47:09 GMT
x-content-type-options: nosniff
content-encoding: br
age: 37205
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-yyz4526-YYZ
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
34 KB 82ms
41ms Script
text/javascript 104.22.53.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.53.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65d03eb82a79a732d7c0180593c4f5dc98a8fac5c20c3a5446c4f14bf93d280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: MK2FZ51VAW7KJXBG
age: 364
etag: W/"5fcefeebf5ddc7b2ddf2435967e63de9"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8360da7ee8c5a250-YYZ
x-amz-id-2: EqLqP9IKQZZfRImBnN/OXl9Qd9dgP/EWSoQLZkVumnTdQG4jW9XmOCbbLOgjMEzB4lWw4QxWAdSFUabxEaCOVg==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 59ms
19ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 02:15:51 GMT
content-encoding: gzip
age: 405078
x-guploader-uploadid: ABPtcPoMi3EEMk6Tu0VDuw6AEzh1KQXDOGIe0vKLUaBkof-YuR6MVYL7Z7hFe0DiM0Bmczy_OLWUt91imycqkxC2fDRzgQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Tue, 10 Dec 2024 02:15:51 GMT

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 84ms
37ms Script
application/javascript 104.18.35.167
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.167 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 118037
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 8360da7ef9d239f7-YYZ
expires: Mon, 18 Dec 2023 18:47:09 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
13 KB 118ms
49ms Script
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

2f1ad4ec7176f493b16e0d186f222e3484248cbb48f82289c736a0877f2d5894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-aa2f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 16 Dec 2023 18:47:09 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 205ms
51ms Script
text/javascript 18.160.46.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.46.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-46-100.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 15:36:35 GMT
content-encoding: gzip
via: 1.1 f236592b6945fb3d11c8af0cdf27baf0.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 11436
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: gBnlYHlPxUO8YSiaOVjTlJLL8KGnQjvj9ZR9RwkaQdr_S4NaWGdBog==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 184ms
97ms Script
text/javascript 99.84.222.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.222.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-222-71.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Fri, 15 Dec 2023 11:00:06 GMT
Via: 1.1 2131ee05242e33f83980b2999cb3c57c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD79-C1
Age: 28025
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: ciAzfcGhVYnu3VCnb7dhOLxZBozrJ8N0-GBqE7BS_ESdlrTfGgImbw==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 160ms
120ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 5c4e26794f12c650b92efe5487e743ef
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 243 KB
38 KB 510ms
509ms Fetch
text/plain 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2066226881385168&correlator=271718936217494&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&iu_parts=21864506698%2CExpress_300x250_MREC-Article-ATF_M%2CExpress_300x250_MREC-Article-BTF_M%2CExpress_300x250_MREC-L-ART-BTF_D%2CExpress_300x250_MREC-R-ART-BTF_D%2CExpress_300x250_MREC-Sidebar_D%2CExpress_160x600_Skyscraper-L_D%2CExpress_160x600_Skyscraper-R_D%2CExpress_728x90%2C970x90_Leaderboard-Fixed_D%2CExpress_320x50_Leaderboard-Fixed_M%2CExpress_320x50%2C320x100-Leaderboard%2CBillboard_M%2C970x90%2C970X250-Leaderboard%2CBillboard_D%2C970x90_Leaderboard-Fixed_2_D%2C970x90_Leaderboard-Fixed_3_D%2CExpress_300x250_Leaderboard-Fixed_2_M%2CExpress_300x250_Leaderboard-Fixed_3_M&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2F%2F9%2C%2F0%2F10%2C%2F0%2F11%2F%2F12%2F%2F13%2C%2F0%2F8%2F%2F14%2F%2F15%2F%2F16%2C%2F0%2F8%2F%2F17%2C%2F0%2F8%2F%2F18%2C%2F0%2F19%2C%2F0%2F20&prev_iu_szs=300x250%7C336x280%2C300x250%7C336x280%2C300x250%2C300x250%2C300x600%7C300x1050%7C300x250%2C160x600%2C160x600%2C960x90%7C728x90%7C980x120%7C970x250%7C980x90%7C468x60%7C970x90%7C950x90%2C320x50%7C320x100%2C320x50%7C320x100%2C728x90%7C970x90%7C970x250%7C970x500%2C980x120%7C980x90%7C960x90%7C970x90%7C970x250%7C930x180%7C950x90%2C930x180%7C970x90%7C970x250%7C950x90%7C980x90%7C960x90%7C980x120%2C300x600%7C300x100%7C320x100%7C300x250%7C336x280%2C300x100%7C300x250%7C336x280%7C320x100&ifi=1&didk=1682146248~1682146249~1682146250~1682146251~1682146244~1682146252~1682146253~3317881192~3317881193~3317881194~3317881195~637727213~1579095338~866839170~2440421375&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1702666029841&lmt=1702665038&adxs=-12245933%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C230%2C-9%2C-12245933%2C230%2C230%2C230%2C-12245933%2C-12245933&adys=-12245933%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C1173%2C-9%2C-12245933%2C190%2C2489%2C3177%2C-12245933%2C-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C0%7C-1%7C-1%7C0%7C1%7C2%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fexpress.ba%2F&vis=1&psz=0x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1140x0%7C0x-1%7C0x0%7C1140x0%7C1140x0%7C1140x0%7C0x0%7C0x0&msz=0x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1140x0%7C0x-1%7C0x0%7C1140x0%7C1140x0%7C1140x0%7C0x0%7C0x0&fws=128%2C2%2C2%2C2%2C2%2C2%2C2%2C0%2C2%2C128%2C0%2C0%2C0%2C128%2C128&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ga_vid=891998810.1702666029&ga_sid=1702666030&ga_hid=880274238&ga_fc=true&dlt=1702666028859&idt=736&adks=4252457726%2C1619150805%2C1158325225%2C989192303%2C2269116962%2C3977863084%2C1458468742%2C2506505460%2C4225763377%2C3491635398%2C729638986%2C4148347004%2C4033188448%2C2396716584%2C3895965814&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1dfe5300e9bc9384f60d1cf490ba91453bc5e103c258ed767b12db83b80cd2f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38731
x-xss-protection: 0
google-lineitem-id: 5853136053,-2,-2,-2,5854439416,-2,-2,-1,-2,-2,5233839002,5855015672,5233839002,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138433193699,-2,-2,-2,138435239324,-2,-2,-1,-2,-2,138295780698,138434536440,138295799564,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8925 6 KB
3 KB 121ms
43ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:09 GMT
expires: Sat, 14 Dec 2024 18:47:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame C311
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&dcc=t

374 B
1 KB

67ms
67ms

Document
text/html

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

013aa04a8ea8d8edabb2174e78ff3832d96618fdf5e1905f8b82d7dff316f96c

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 374
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 15 Dec 2023 18:47:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 8D0QKH5C5B2YR9JRZYJH

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Fri, 15 Dec 2023 18:47:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: EDQ3NKA9BNZDZ9HE49F2

GET
H3 200 AGSKWxWfTpWL8SCo8e7URP2qpQA53yD-tkMsApXZ3EeveIQyJPsuUCYepgiT8CFHiAYpzkpBYV6bpjIrpEzUBaJvbhNSYIX_OsI_wXQlX2FkLUCk6BD89UAfagPNzDnjZ6-_D8XE6LvowA== Show response
fundingchoicesmessages.google.com/f/ 13 KB
6 KB 73ms
73ms Script
application/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWfTpWL8SCo8e7URP2qpQA53yD-tkMsApXZ3EeveIQyJPsuUCYepgiT8CFHiAYpzkpBYV6bpjIrpEzUBaJvbhNSYIX_OsI_wXQlX2FkLUCk6BD89UAfagPNzDnjZ6-_D8XE6LvowA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAyNjY2MDI5LDg5OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyXSwiaHR0cHM6Ly9leHByZXNzLmJhLyIsbnVsbCxbWzgsInd1UnJjZllsWWh3Il0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d046791135d3f6bf3a12ec1b61b3d141efd8eba98becd6ee6a39debfbe4a8ed2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Kj5Gp71vd91yPWKFDuZPpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:09 GMT
content-security-policy: script-src 'report-sample' 'nonce-Kj5Gp71vd91yPWKFDuZPpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fexpress.ba%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fexpress.ba%2F&rid=esp&cc=1

85 B
194 B

42ms
41ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fexpress.ba%2F&rid=esp&cc=1
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 16e665370b9be76317cbc7f69025b34bcb15899160c587a26fa5fd3d96f7f608

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-tO8SvwkIga2wgMHqODtXHmYwGbU"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Fri, 15 Dec 2023 18:47:09 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://express.ba
location: /esp?url=https%3A%2F%2Fexpress.ba%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
226 B 355ms
114ms XHR
text/plain 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:09 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 3160 0
71 B 142ms
104ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Fri, 15 Dec 2023 18:47:10 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 45AC 3 KB
4 KB 40ms
40ms Document
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

fced53afb35bf9c8f7f3cdf2951b5058e57ef79905415072e13f202840c3a9ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 3131
Content-Type: text/html;charset=ISO-8859-1
Date: Fri, 15 Dec 2023 18:47:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: C4JTANN8XZRX18C3AQ2Y

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
608 B 127ms
48ms XHR
application/json 54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: acb4fa39cb4a7a5c218267b9f8ac3cbbc28198c9779fbfb3cce48ebc79667e58

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:10 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://express.ba
cache-control: no-cache
x-server: 10.40.52.6
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 45AC
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=9c86f74d-193d-41d2-be03-eed49aa43cfa

43 B
479 B

137ms
42ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=9c86f74d-193d-41d2-be03-eed49aa43cfa

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: S51TS951969K68DEHB54
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=9c86f74d-193d-41d2-be03-eed49aa43cfa
Date: Fri, 15 Dec 2023 18:47:10 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 45AC
Redirect Chain

https://csync.loopme.me/?pubid=11405&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dloopme.com%26id%3D%7Bviewer_token%7D
https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=dd1ec317-a5c3-4802-84c1-c44adccff126

43 B
479 B

41ms
41ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=dd1ec317-a5c3-4802-84c1-c44adccff126

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZJ0GGQZ6GKSVZKZ43Q4X
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=loopme.com&id=dd1ec317-a5c3-4802-84c1-c44adccff126
date: Fri, 15 Dec 2023 18:47:10 GMT
server: _
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 45AC
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3456676308996217000V10

43 B
479 B

42ms
42ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3456676308996217000V10

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 00BHBC136AFZ5K3YB572
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3456676308996217000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 45AC
Redirect Chain

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
https://s.amazon-adsystem.com/ecm3?id=D0812E5B1E9348BAA3CDA37D98868D87&ex=simpli.fi&status=ok

43 B
479 B

83ms
43ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=D0812E5B1E9348BAA3CDA37D98868D87&ex=simpli.fi&status=ok

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: G730X7XPK68Z0YMPS361
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:10 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.amazon-adsystem.com/ecm3?id=D0812E5B1E9348BAA3CDA37D98868D87&ex=simpli.fi&status=ok
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 14 Dec 2023 18:47:10 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 45AC
Redirect Chain

https://trace.mediago.io/ju/cs/amazon?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbaidu.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=baidu.com&id=f5ef61ca1c5e52e12stycs00lq6ze55u

43 B
479 B

85ms
43ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=baidu.com&id=f5ef61ca1c5e52e12stycs00lq6ze55u

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 8P43ZNPHV4WK6QRQ77QJ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:10 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
location: https://s.amazon-adsystem.com/ecm3?ex=baidu.com&id=f5ef61ca1c5e52e12stycs00lq6ze55u
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 45AC
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=EMWHiQbNx2Kc4gM4R0hT

43 B
479 B

114ms
42ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=EMWHiQbNx2Kc4gM4R0hT

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 6MDT35E6NW7RYPB7CKZ6
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Content-Type: text/html; charset=utf-8
Location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=EMWHiQbNx2Kc4gM4R0hT
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 101
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame C15F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

1 KB
777 B

52ms
52ms

Document
text/html

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a50bed2f71021353188c867b585c509f6ea2fd247f8a98a856117caa043c1aed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8360da80dd5d3a0b-YYZ
content-encoding: br
content-type: text/html
date: Fri, 15 Dec 2023 18:47:10 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i9TEuhIMu5wrRvHzos7eSFkIklN9XJkX238b3%2BOE7Qn5lYTGv835dpLRJDvh%2FGqtjAYXmlWWRLV8IOQMtOsWU2qt1E122KpX3SeMXVXBtO3ltHKPr1gzsqh9dh0ql3chDLCYkwUgS4Igpg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8360da808c4a3a0b-YYZ
content-length: 0
date: Fri, 15 Dec 2023 18:47:10 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rR4JvFiaE9adCkDF4IATo7DwgmBCAjAqPJXg%2Fm3jjAxgVfg1D8%2Fksq8VVpSNbcvtpI9l%2BOugnUP7onEpD3sUBVfDExRT8Ld98GjvVEhNC7Gt9ItYzrXEGRCfnV4y5tA0jAqaz77XrKXlOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 1319 0
167 B 28ms
26ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Fri, 15 Dec 2023 18:47:10 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame CE80
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=9137171266367579984&gdpr=0&gdpr_consent=

43 B
479 B

42ms
42ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=9137171266367579984&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: DHKYGYTZK1P517TXWE9V

Redirect headers

content-length: 0
date: Fri, 15 Dec 2023 18:47:09 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=9137171266367579984&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame F657
Redirect Chain

https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=144359b591b070a&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAACpNFtsmHK5ANLd7uQAAAAAAA&expiration=1702752431&is_secure=true

43 B
479 B

41ms
41ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAACpNFtsmHK5ANLd7uQAAAAAAA&expiration=1702752431&is_secure=true

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: D9TQNQ415FJXF93JGPNT

Redirect headers

cache-control: no-cache, private, max-age=0, no-store
content-length: 0
date: Fri, 15 Dec 2023 18:47:11 GMT
expires: 0
location: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAACpNFtsmHK5ANLd7uQAAAAAAA&expiration=1702752431&is_secure=true
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma: no-cache
server: nginx

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4B9F 16 KB
6 KB 104ms
33ms Document
text/html 23.220.136.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.220.136.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-136-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=55300
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Fri, 15 Dec 2023 18:47:10 GMT
expires: Sat, 16 Dec 2023 10:08:50 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame F32A 281 B
555 B 102ms
32ms Document
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 15 Dec 2023 18:47:10 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame CFFF
Redirect Chain

https://ups.analytics.yahoo.com/ups/58251/sync?redir=true
https://ups.analytics.yahoo.com/ups/58251/sync?redir=true&verify=true
https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS0weVJObVp0RTJ1SnBXaXNSV0lTY0RUWms4b0xZbk0xZ35B

43 B
479 B

74ms
47ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS0weVJObVp0RTJ1SnBXaXNSV0lTY0RUWms4b0xZbk0xZ35B

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 86WEVTCSPS6577MYD15Y

Redirect headers

age: 0
content-length: 0
date: Fri, 15 Dec 2023 18:47:10 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS0weVJObVp0RTJ1SnBXaXNSV0lTY0RUWms4b0xZbk0xZ35B
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server: ATS/9.1.10.94
strict-transport-security: max-age=31536000

GET
H/1.1

200
OK

amazon Show response
ce.lijit.com/beacon/ Frame 8A7F
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

1 KB
1 KB

46ms
46ms

Document
text/html

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: fe603918c2d8655d48bf9300af8758f328536eb51d30231a0418070e3adc0147

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding: gzip
Content-Length: 457
Content-Type: text/html
Date: Fri, 15 Dec 2023 18:47:10 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Vary: Accept-Encoding, User-Agent
X-Sovrn-Pod: ad_ap3dca1

Redirect headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 0
Date: Fri, 15 Dec 2023 18:47:10 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Location: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap3dca1

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F32A 45 KB
13 KB 36ms
36ms Script
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8209006f69e596bd225d1d307774d3b6123a1279c4353b61b022e14cd3251d4a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15 Dec 2023 09:30:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=53054
Connection: keep-alive
Content-Length: 13169
Expires: Sat, 16 Dec 2023 09:31:24 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame C15F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=&google_tc=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEE5cVrVdMAgnzHZwbrvECkw&google_cver=1

43 B
732 B

58ms
58ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEE5cVrVdMAgnzHZwbrvECkw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MVNC%2Bl7tm6MdBAWqKlW8ReoZUkMtS15CV%2BqPn1pcmca5QRYxsuphY640oqcDi32yHAqJLHI1SgsRL2yHXzdCASpHCB6qF2n4hWUr5Slcv6EJ%2BG1tjgSn2fBxKjh6Lf5fisSJfjlyOdWOzw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8360da8219bd54b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEE5cVrVdMAgnzHZwbrvECkw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

usersync.aspx
dis.criteo.com/dis/ Frame C15F
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZXyfLgBuUMEGpHAFjn.29AAA%261300&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZXyfLgBuUMEGpHAFjn.29AAA%261300&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=31d66b505ab146ec9c3b386a216d1626
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

43 B
363 B

3161ms
50ms

Image
image/gif

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 312004
expires: Fri, 15 Dec 2023 00:00:00 GMT

Redirect headers

Location: https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 2

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C15F
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&expiration=1705258034&gdpr=0&gdpr_consent=

43 B
734 B

70ms
70ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&expiration=1705258034&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5kEQx9NDW9nTRIEMcq5Fdo0xVf5WEcABPo2ouJrQitDlFqc6WkqXtjkKQibf33cR0WatT7SLdW%2FkE4Ys8phupLIrplqo%2BKqE4PUf5VRje%2BysR63UJ1Zwo69kEExZawNsOm8A9nKeE9R%2BlA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8360da9b480b54b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&expiration=1705258034&gdpr=0&gdpr_consent=
date: Fri, 15 Dec 2023 18:47:14 GMT
server: Kestrel
content-length: 323

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C15F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZXyfLgBuUMEGpHAFjn.29AAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOl6zCRLhyyXiJ6CH6kW96I&google_cver=1&google_hm=2

43 B
781 B

51ms
51ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOl6zCRLhyyXiJ6CH6kW96I&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2FySUjmQqvY%2BaXXBpORj8l1ORFxI%2Bt%2BrE5q%2BOPeVl8fzArRJZFtelkkv4X%2B6JZDnv38IVsMfQXRD0QXti4M92VUrwZkN1i%2F5zXvc8Vn195gJzgaEpdjs3SGAUqsOc%2BUCGeKEgM%2B%2FnPqNMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8360da8219c154b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEOl6zCRLhyyXiJ6CH6kW96I&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 503 cs
ad.turn.com/r/ Frame C15F 0
0 10591ms
3045ms Image
text/html 69.194.242.12

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.turn.com/r/cs?pid=21
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.194.242.12 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame C15F
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=970033170905787117

43 B
738 B

60ms
44ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=970033170905787117
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dRStNG%2Fk6YqWtoRgS8q61WkVX2PQJUnrqxPNgOC6FUSxzvKglRh2Yvqjp7%2Boyvjrex5NJ7T6fwrbPQwkGIpaBG%2Ft%2F7Qm7Y1MNVHL9cZGsCmXYwKSt9LLAxx%2BIrxqybmAW9QTE6vyxWoMEw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8360daadea1e54b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=970033170905787117
Date: Fri, 15 Dec 2023 18:47:17 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET sync
sync.srv.stackadapt.com/ Frame C15F 0
0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame C15F 0
187 B 1308ms
34ms Image
text/plain 207.198.113.204
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.204 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame C15F 43 B
479 B 110ms
45ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: FFGVQY47GZYT6X4AVBDK
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4B9F 2 KB
2 KB 6973ms
51ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=6732949&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: dcbc3883c4375167b2bf36fa97402201013e8b6b7759cac3958d8916fb348415

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 15 Dec 2023 18:47:16 GMT
content-length: 1736
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 8A7F 43 B
479 B 58ms
40ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=H05njPZHz8om_qvaQHqYvv0S&ex=sovrn.com&gdpr=0&gdpr_consent=

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:10 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XTKWRPCD0DASM4FJJB2C
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

503

cs
ad.turn.com/r/ Frame 8A7F
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&zcc=1&cb=1702666030723
https://ad.turn.com/r/cs?pid=45&rndcb=2872199404

0
0

10080ms
3046ms

Image
text/html

69.194.242.12

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.turn.com/r/cs?pid=45&rndcb=2872199404
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: H2
Server: 69.194.242.12 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:10 GMT
etag: RX76c6158e892a4b5d8768fcb7ed849c5f005
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://ad.turn.com/r/cs?pid=45&rndcb=2872199404
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 8A7F
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=45905e27-008c-4916-bdda-4ccdb7efc911&gdpr=0&gdpr_consent=

43 B
2 KB

191ms
37ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=45905e27-008c-4916-bdda-4ccdb7efc911&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=27&3pid=45905e27-008c-4916-bdda-4ccdb7efc911&gdpr=0&gdpr_consent=
date: Fri, 15 Dec 2023 18:47:16 GMT
server: Kestrel
content-length: 223

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 8A7F
Redirect Chain

https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=MlO6KT0AvywpBeh_PFWgfmUDtX0pAusvZVZB9RTo

43 B
887 B

47ms
46ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=MlO6KT0AvywpBeh_PFWgfmUDtX0pAusvZVZB9RTo
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=MlO6KT0AvywpBeh_PFWgfmUDtX0pAusvZVZB9RTo
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 8A7F
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=sovrn&gdpr=0&gdpr_consent=&tc=1

43 B
2 KB

148ms
56ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT, Fri, 15 Dec 2023 18:47:16 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 8A7F 0
187 B 1104ms
33ms Image
text/plain 207.198.113.204
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.204 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 92F8 0
0 53ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsukzftHoPsuKnD1ESmIzN00l7_zhy-pFoVB3NyX8gjP-eTvzqlpt4f6k93FpPjBOAv4bCkWoP2Q4mYyrhc1F_i8IzM_4PbdbhYZAeU2MNYYesYtKU69bLaqtGkGeBouO4dkor9cCJN25PGQx1xTS0fkMEkF7mT6mKVWXRRjkxuSHRbnWgQ5L45VmX3tOdtrhvWTqnnxkwJMKn-J6vo0APm4XdRpAu5F0-JkEeB6eKaFlii9vrxhVbopFLNcbiCr1mxkcR49SjFQ2EisBpnbKj9nWaBirwCo_sFrN424kBmPnb1v3E68UZ84KrNRmanysqNqjRLyoswZw3Av44160ZXiLskS_J4eW4ClbCbvtKDcDTPy&sai=AMfl-YQch1ZEFo1pDfku6mDaDltV0Vf5WmKh7o5SaSdKh4J_WI608yHGBOITJ7inN7Hx-C2v9uIMAnC0bQ6FIo1VgJ3j9C2fZqicT5aLLXX5WrHlF8roz-FGy3UK_sFrKe69f8C2sTSvOp8Imvc2IDrnOalR&sig=Cg0ArKJSzFSP30MSnUTDEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK img.fetch Show response
udmserve.net/udm/ Frame 92F8 51 KB
9 KB 811ms
312ms Script
application/x-javascript 68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://udmserve.net/udm/img.fetch?sid=19311;tid=1;dt=6
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: 1ce72481c142f3ffab3dd15a86ca240081a76bf96d3e0108d8b58bd0c92a0b17

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3p: NOI DSP CURa ADMa DEVa PSAa PSDa OUR IND UNI COM NAV INT
Content-Type: application/x-javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Expires: 0

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 92F8 203 KB
65 KB 132ms
59ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H2 200 container.html Show response
b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5665 6 KB
3 KB 37ms
36ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:09 GMT
expires: Sat, 14 Dec 2024 18:47:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B6A1 0
0 53ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsurnjT8n3BPgHZGWWwmBlARb2YU4DGrg0eAGd07F-20E-kuim_XdR3EWsVWXChSR6HMDo11oN7ngauDxmB5VAaQz3rGExNMtDp53BmZudWv-qWH1WEe0kRHcU10_M54ci1LCNmtIfLqOKxqGMruiHp3__H6HYKmGYd_elC_ld4l2_evkM65VEZAwpJ1ZkIGoBtwdmfRyeiMgiIM6K1Aq_DSgCQjqKy2xaUUODNbhZO1a1UVLxlAixxhO_bXnRvXW82VmcAPEZNzEyan5z2gurz4K2n4w0tV6qmh4PKxQSIbuahlZalyhpljIOrSK7aik8C3EVCU7Gt59xX35hQGfLXJLIiYX-qUWgZdmtBsTEbvfCIqMUHELpMwAP6r2E5FULRWckF5b2iehlzi69E-BeFxRxjgwz-hvZfqVSQ&sai=AMfl-YRIViUxbv60HtdVWTuqStg66TZojkX6Bvlf9BhjJ4gLerRbWgO0zsYEY141zM76cOQYXbmdTuHW79j8hUuGDtt2ZIed6t8gQHIjU68O-SHKqCckmf5-XzyteiH0jJwgBAEZY1Q1edbP9xh1ErV_fHGJ&sig=Cg0ArKJSzK4UHLBpxY8_EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame B6A1 151 KB
50 KB 186ms
95ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d1ebc2f2f174e3b158ba99bea71528b7ea946f67406b10546b2d37e760d31a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51539
x-xss-protection: 0
server: cafe
etag: 6440843176281093182
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame B6A1 203 KB
64 KB 137ms
85ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D4AC 0
0 52ms
51ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvqm2buPnRWY5s1_FH_Roj35JcOEH30m6dYrZFJ1xO5k-Jebb074lhdaTRb8yZv8vVv1_mkncqWuVyfLzLutUlZ1uNjB_M2rlJnng3Vf9zFxw8mD8BQD_w3c8dLDFwGs7hpup4cFzuC7xc-kl1WPTlYEMmF30UTvXFxC60GCfk9R_1raN--KCRyJsHuF-i-b3-wyDY2bNpVEEe67eM9wjruQCJz5k8nB8jy69JQIurNg0cxp_25RG80C-bmOmFeRAK50jf8B6o_yCWnD2Nqyi-69OhIi5yDb1mE4zB-hpdIJ0RAnJkSvg_CWnrU-bb8nXCkpdhx9_G62SPYtCZczcxY_Z5emexwkduPIROL8DrKQT8NapZn5uGVntz1cg&sai=AMfl-YQU5j3Vn3MOfHRlY8BuY-wSa0LWq1JGR0XJdxBEZ6J3o7SBpx1n7RPNqbXbNYBPg-7oGNsbp4UfTi6MQc0iVD9Q0pROd7sKdaCXles3WM2yYvUub6fTnLsoOafHRi1yeBEsP1p63U9Kk3IF-Q5Ek_yv&sig=Cg0ArKJSzBaZEYdyuU7cEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 stpdwrapper.js Show response
stpd.cloud/assets/ Frame D4AC 9 KB
4 KB 327ms
29ms Script
application/javascript 104.18.31.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/assets/stpdwrapper.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.31.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b871a14951e3e3ecd4c9dc5621153da2e219442a396f8b59311e0111d682ac26

Request headers

Referer: https://express.ba/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: XLstHdN2srrbYqnEo/WEmA==
age: 6748
x-ms-lease-status: unlocked
last-modified: Tue, 19 Sep 2023 10:43:12 GMT
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: e6caa7a4-a01e-0067-7aea-1eef6b000000
cache-control: public, max-age=1200
x-ms-version: 2009-09-19
cf-ray: 8360da845b6c36d0-YYZ
expires: Fri, 15 Dec 2023 19:07:10 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D4AC 203 KB
64 KB 160ms
117ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3AE5 0
0 52ms
52ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPeZQHvNWbrpKPTqfXs8uFeitgYRYvqh5XvQgSbb8xKqP1F_dI1fTX53wnURWXz-LeRrgntfBsFtVdgUMQDG0Sbhka3WdoybxA8XxY9KPWj7ig1eT-ASvGHfXUfvg9_K3_Quobqe_YA5h44RCA04zdsGtgz8TrL69MtcUGl5YrKcFbWiyYDW29cgFigmYLtUe1ntNPoOvoY-VT7jHnDg9ff1Wy4AOYO5O1_bFgIVV6yr2pqdgr7mB2T4AbrUDwbxs9tAU-jqZ8AlEcu086tKryQGcKGICdRQif1Ub3xzy-3-UMa8JpuWIiWU_aTXbj_2CQrgM7j6xYjoGxSNygnvW8vdGQ86ef7kbmOwamV5SeXLIzZ9x5XWNYc3IbOA&sai=AMfl-YT56ngdj8i4du44lyE7JuOuk4qy1xl6SKhDIgtfswH2Y0DGQNh0evRhXRmhC3P4I2WBaSnCAD9TzYJaVouyv0PS1Ej7xr74WxAP_HhjxwpIB2nTm5SOT_rjTRoPt_QwdiRP2YHoc32hGm_NOpZFOwqa&sig=Cg0ArKJSzNS8TFGmpZG7EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3AE5 151 KB
51 KB 139ms
64ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08e1fdb0b947b8b9843af27965aee469a1538c037c25e68b06fa2363333c214f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51540
x-xss-protection: 0
server: cafe
etag: 11337161928813318098
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3AE5 203 KB
64 KB 134ms
98ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET stpd201221.js
stpd.cloud/assets/postbid/ Frame 17E2 0
0

GET afr.php
ads.us.criteo.com/delivery/r/ Frame 8296 0
0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5665 3 KB
1 KB 800ms
50ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:08:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:08:00 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5665 20 KB
9 KB 785ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:40:58 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 5665 24 KB
7 KB 788ms
40ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:07:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 13 Dec 2024 03:07:57 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5665 203 KB
64 KB 96ms
96ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
DATA 200
OK truncated
/ Frame 3AE5 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64bf35800d8652531d9e554a7a1c462d34d53c118751d71a797de4fab5d9c52f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B6A1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c2e9c31fd03016dd8ea5656943cca4090d8c22481708f2379b0dc937aceae2d

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D4AC 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec54f55629f196d38f9bde620224ba2a4ac825f3f435074dd5b74eb24a7492b5

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ Frame 3AE5 399 KB
135 KB 154ms
83ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04e257ea3ed351ea436c02e402b399d57446231f65daefe476a5299ec00696df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137924
x-xss-protection: 0
server: cafe
etag: 1236136379818482143
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/ Frame 339E 9 KB
4 KB 35ms
34ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 41621
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 07:13:29 GMT
etag: 5585625838579639069
expires: Fri, 29 Dec 2023 07:13:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame F32A 7 B
777 B 146ms
37ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
Expires: 0

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ Frame B6A1 399 KB
135 KB 107ms
107ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

756052520d2c7fd14f0d852648bf871b3001bd5036ba36650c7e7e619ae49444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137924
x-xss-protection: 0
server: cafe
etag: 925690544378965138
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:10 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 298 KB
50 KB 461ms
461ms Fetch
text/plain 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2066226881385168&correlator=3162303736329918&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&iu_parts=21864506698%2CExpress_300x250_MREC-Article-ATF_M%2CExpress_300x250_MREC-Article-BTF_M%2CExpress_300x250_MREC-L-ART-BTF_D%2CExpress_300x250_MREC-R-ART-BTF_D%2CExpress_300x250_MREC-Sidebar_D%2CExpress_160x600_Skyscraper-L_D%2CExpress_160x600_Skyscraper-R_D%2CExpress_728x90%2C970x90_Leaderboard-Fixed_D%2CExpress_320x50_Leaderboard-Fixed_M%2CExpress_320x50%2C320x100-Leaderboard%2CBillboard_M%2C970x90%2C970X250-Leaderboard%2CBillboard_D%2C970x90_Leaderboard-Fixed_2_D%2C970x90_Leaderboard-Fixed_3_D%2CExpress_300x250_Leaderboard-Fixed_2_M%2CExpress_300x250_Leaderboard-Fixed_3_M&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2F%2F9%2C%2F0%2F10%2C%2F0%2F11%2F%2F12%2F%2F13%2C%2F0%2F8%2F%2F14%2F%2F15%2F%2F16%2C%2F0%2F8%2F%2F17%2C%2F0%2F8%2F%2F18%2C%2F0%2F19%2C%2F0%2F20&prev_iu_szs=300x250%7C336x280%2C300x250%7C336x280%2C300x250%2C300x250%2C300x600%7C300x1050%7C300x250%2C160x600%2C160x600%2C960x90%7C728x90%7C980x120%7C970x250%7C980x90%7C468x60%7C970x90%7C950x90%2C320x50%7C320x100%2C320x50%7C320x100%2C728x90%7C970x90%7C970x250%7C970x500%2C980x120%7C980x90%7C960x90%7C970x90%7C970x250%7C930x180%7C950x90%2C930x180%7C970x90%7C970x250%7C950x90%7C980x90%7C960x90%7C980x120%2C300x600%7C300x100%7C320x100%7C300x250%7C336x280%2C300x100%7C300x250%7C336x280%7C320x100&ifi=16&didk=1682146248~1682146249~1682146250~1682146251~1682146244~1682146252~1682146253~3317881192~3317881193~3317881194~3317881195~637727213~1579095338~866839170~2440421375&sfv=1-0-40&rcs=1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1&eri=1&sc=1&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&abxe=1&dt=1702666030918&lmt=1702665038&adxs=-12245933%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C436%2C-9%2C-12245933%2C230%2C230%2C230%2C-12245933%2C-12245933&adys=-12245933%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C1223%2C-9%2C-12245933%2C150%2C2687%2C3645%2C-12245933%2C-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C3%7C-1%7C-1%7C0%7C4%7C5%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fexpress.ba%2F&vis=1&psz=0x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1140x90%7C0x-1%7C0x0%7C1140x90%7C1140x250%7C1140x250%7C0x0%7C0x0&msz=0x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1140x90%7C0x-1%7C0x0%7C1140x90%7C1140x250%7C1140x250%7C0x0%7C0x0&fws=128%2C2%2C2%2C2%2C2%2C2%2C2%2C0%2C2%2C128%2C0%2C0%2C0%2C128%2C128&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ga_vid=891998810.1702666029&ga_sid=1702666030&ga_hid=880274238&ga_fc=true&dlt=1702666028859&idt=736&prev_scp=amzniid%3DJI_FAT1NnUMSOebIt47rmAUAAAGMbs3K3AEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICA4iwdb%26amznp%3D1v320w0%26amznsz%3D336x280%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7Camzniid%3DJOA_c_ztiZtMd9aal8EUE2kAAAGMbs3K3QEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAfwhHR%26amznp%3D9uvrpc%26amznsz%3D300x250%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7Camzniid%3DJGlyw_R10OyNyNm1vFHhpbwAAAGMbs3K3QEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCGAMrj%26amznp%3D1v320w0%26amznsz%3D336x280%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7Camzniid%3DJAb7rl-7qSm2TDJ7vm82gd0AAAGMbs3K4QEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAG5Lc0%26amznp%3D1v320w0%26amznsz%3D336x280%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7Camzniid%3DJE4Yq_I9UTwz-1APpxzMMFcAAAGMbs3K4QEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICA9CJCj%26amznp%3D9uvrpc%26amznsz%3D300x600%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7C%7C%7Camznbid%3D2%26amznp%3D2%7Camzniid%3DJKGk5FCFNpBBHOdJTl-FZ9sAAAGMbs3K4wEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICC6u2R4%26amznp%3D1v320w0%26amznsz%3D336x280%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7C%7Camznbid%3D2%26amznp%3D2%7Camzniid%3DJE3liyiVvVTPR1SwUoihsMQAAAGMbs3K4gEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAqHCPo%26amznp%3D1v320w0%26amznsz%3D970x250%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7Camzniid%3DJMrpoTguzBnf3zmHnRwa26AAAAGMbs3K4gEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDVGrE4%26amznp%3D1v320w0%26amznsz%3D970x250%26amznbid%3Dbnt4ow%26amznactt%3DOPEN%7Camznbid%3D2%26amznp%3D2%7Camzniid%3DJGNL-LkPo5As79HRCVFSX44AAAGMbs3K5AEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBO5DXK%26amznp%3D1v320w0%26amznsz%3D336x280%26amznbid%3Dbnt4ow%26amznactt%3DOPEN&adks=4252457726%2C1619150805%2C1158325225%2C989192303%2C2269116962%2C3977863084%2C1458468742%2C2506505460%2C4225763377%2C3491635398%2C729638986%2C4148347004%2C4033188448%2C2396716584%2C3895965814&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d2eb69bdd294c982e179eed1ebf8a6a67576cff8bc31443b370ca31f0d012d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50739
x-xss-protection: 0
google-lineitem-id: 5853136053,-2,-2,-2,-1,-2,-2,-1,-2,-2,-1,5855015672,5233839002,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138433193699,-2,-2,-2,-1,-2,-2,-1,-2,-2,-1,138434536440,138295780698,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5279 Show response
stpd.cloud/tag/ Frame D4AC 380 KB
120 KB 243ms
242ms Fetch
text/javascript 104.18.31.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5279
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.31.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21270f9b1123471ad3701e59ede4d0558e0ac5e35f5d8c42c33906645097d88f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: s-maxage=300
cf-ray: 8360da857d7b36d0-YYZ
stpdhash: true

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D4AC 0
0 127ms
54ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuZr4cn4NsyLMl0tIfjjvEVrO0DApg3-GEdkJN8gnx-remq9j2qUSomcyoIeIFWkNF1oi81t5k-7mEyZBr78TJAJsivXeHIN8qoJkKhauk6Pi3zsZzFdLCyBksK8i2v3VWPoxFExV5CP1x_YnYWJxQQ4AHn8hOB_yGh9Oe19q3hXZ1Ls5KT78OAABcD-5Xv2DBeS_jygdijrpWaQWQQXGKvyjVO7E6kTy8gdciW2yySodEUfE4qObigvF9mJja1eBaExmGWYFcQBiNX2DBcc6e7NyApmxAPW6jzAv0lMkgrzfXi3hpctryOYgZg9E1yHvEhagUNj4aECIa3kvw4wzcaRMY5Bd07LIElHS7YHXR0AD_VnWLGOY0_blidO-Qf&sai=AMfl-YR02ZFDZM8lXtll8Jdg2u1qzgaIPoeakLvi8ptJoBjgjv0vVmsX3xcYi8uDok11nobaH2HhKycfXL9rJrITgCILr7VuEJGkEVqQOho8dWbCRLCnG5lsESxGGlDZoBwITvmLKsMf_7muvKZ5gB-m404A&sig=Cg0ArKJSzNUQ_fu5jDDFEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 55ms
55ms Image
image/gif 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=7.802069930750197

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-xA_x94K-D3noVFjnG4pvtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-xA_x94K-D3noVFjnG4pvtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 62ms
62ms Image
image/gif 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=6.661914345288799

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jxJmykSgzAAspC_B0vRnjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-jxJmykSgzAAspC_B0vRnjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame F32A
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LQ6ZE5RC-Q-8P8X
https://s.amazon-adsystem.com/ecm3?id=LQ6ZE5RC-Q-8P8X&ex=d-rubiconproject.com&status=ok

43 B
479 B

42ms
41ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LQ6ZE5RC-Q-8P8X&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: JJ710WY2NJBR6Q357QBQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LQ6ZE5RC-Q-8P8X&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 1537ef2fe96d186f089f142283d9817a
Expires: 0

POST
H3 204 AGSKWxWStm_XvriOhtTjztSw3XVHqfjO0fJ37KUBaeBtyjKITYdY15EXY8IABCI1LIr0S6MniscmyLxcmRh96WkFn4ZcBa4qkP6QjSzWT3zO0xIwaVLr1rSnx3igoOJUibrVB9-akvuIUQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 126ms
54ms XHR
text/html 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWStm_XvriOhtTjztSw3XVHqfjO0fJ37KUBaeBtyjKITYdY15EXY8IABCI1LIr0S6MniscmyLxcmRh96WkFn4ZcBa4qkP6QjSzWT3zO0xIwaVLr1rSnx3igoOJUibrVB9-akvuIUQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-w9H1MlOWgJeSjHT0OjdhRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-w9H1MlOWgJeSjHT0OjdhRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://express.ba
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3AE5 0
0 54ms
54ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuZfqFCKyhpNESQWJj6Lzj7Rj_aRbInN2wKD1AdGLAmNRFTvsNGXQGMoA6uu5iOcif9bnt3TvPIW-050WgdaYl6w5b2aiTcoUxnpVIAg-HTRDIvIkM8INorG2o0YuuCMAHkLl8WFAM7lfIM7n_b289KUcfcfpYSfixAl-H4xOyGVh7tvudf2rkG73K0PRjApz0rWpvefQUfH5g71kk12PUne1-CU056BEMah5QKBaOvwV70QYZrrX_hTEHrIEnNV4EgIBd9RIJvtOF4nwg8lT0dAq9Awi-SG-3zH_VV2f9lhhVS_3ItERhgNJEThZc7ro99qjO6u0yjbHQ79Irm9nZDituw6tEmuoS1Njugu8YhubLPAhdL--Pg5zy8OkXI&sai=AMfl-YStXwhGtPz_N4ivZ-EIh-1yxiv-iNMDCdwafxizjTHdkwABOsnvLak1x5FlEP6XaQbhMadZJsOffp5bG_3HTLItXO_jU_9fwKdxyPOC4IrIahqb-7omg8N8b9LLE7IQLNwUXQZRQMT-IYlUxowLiqy_&sig=Cg0ArKJSzIkS-J4g0Da-EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B6A1 0
0 54ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvQpLJSMSQ-5QtLSaIfdC651kuUjGORL_wjfzPIaE6IRO6dowGYMMVkESqIF4xnJ_gu5A_mIEj0bUBVVg8H-1f5G4gv7_B4-VSwBD-qCJh6hO-Qq8usTt79F56GHSjiIb9RGQvUNTbayeKjOzoOIjJbBrBXCJVOJ2CJBN0i-4yB8XO7FQHJZDf1xASq3hE4HTtGXeDtYzgZ9F_m3tfoH16V9d4jy0Lb-w1otYYcAweYLcNjsUS_ZJxSov-S_V1HATc3ru676Y5pdZW2Ih1UV8YEyBq_HBMJHnMkCvBRD-zJ9jyQfxa_Vyowdsh5gSEmc7_J6K4kYhb4pjxf0zztpDpVyKl8wa8xhuPcnbFnMNvI81ZHtuY_sraVSX7k6ZgwZOcs1_v1EvU-By4r_GMGuEyqSCcZ_i4mLjG0AslFNA&sai=AMfl-YSDDc7CYR4B5kht7g4pZNRw0hFkryZvV6ZhJoE21XaAlyLw1Cu6C87pf8nIXibARmA69iTBnRzAucAtlWoN1VlTbSDU5aZM5VnYyx0_ghX4kPjwwEUvKs-7jf97Hu3RtlzkGovNeBLnKJrSiOvgNB8F&sig=Cg0ArKJSzAfmci5CPYL6EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 673E 17 KB
857 B 188ms
187ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&adk=1812271804&adf=2751417936&lmt=1702666031&plaf=1%3A2%2C2%3A2%2C7%3A2&plat=1%3A128%2C2%3A128%2C3%3A128%2C4%3A128%2C8%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fexpress.ba%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666030834&bpp=21&bdt=360&idt=251&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&nras=1&correlator=8298522585755&frm=23&ife=4&pv=2&ga_vid=891998810.1702666029&ga_sid=1702666031&ga_hid=1347749769&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=970&ish=250&ifk=2831893008&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079980%2C44807405%2C95320884&oid=2&pvsid=705845930213380&tmod=1944684912&uas=0&nvt=1&fsapi=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C250&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32772&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=1.ceuot0djf21v&fsb=1&dtd=314

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d297419da101a6177907250e2d720a7124e98e5345532b7e7b1f6cb58a473c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 837
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET ads
googleads.g.doubleclick.net/pagead/ Frame D423 0
0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 3AE5 16 KB
12 KB 60ms
58ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67296da58f4072897b02f8a9623043c7e244994bd05f5c673b7bf4945223d45f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12224
x-xss-protection: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame F32A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=LQ6ZE5RC-Q-8P8X&ex=d-rubiconproject.com&status=ok

43 B
479 B

46ms
46ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LQ6ZE5RC-Q-8P8X&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: D0KZTNJG76N42HFD522H
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LQ6ZE5RC-Q-8P8X&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Expires: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0C03 17 KB
857 B 169ms
169ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&adk=1812271804&adf=2751417942&lmt=1702666031&plaf=1%3A2%2C2%3A2%2C7%3A2&plat=1%3A128%2C2%3A128%2C3%3A128%2C4%3A128%2C8%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fexpress.ba%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666030909&bpp=3&bdt=453&idt=200&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666031&ga_hid=1544998199&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=970&ish=90&ifk=1429453742&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079759%2C44807405%2C95320884&oid=2&pvsid=727034016787579&tmod=1379925485&uas=0&nvt=1&fsapi=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32772&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=1.vffgyunon8rs&fsb=1&dtd=261

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d297419da101a6177907250e2d720a7124e98e5345532b7e7b1f6cb58a473c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 837
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET ads
googleads.g.doubleclick.net/pagead/ Frame F29A 0
0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B6A1 16 KB
12 KB 58ms
57ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

490d32abb311fdf68a03b4435332ae2316efe6bff463236c16b0e100ce4e2d94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12385
x-xss-protection: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame F32A
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ6ZE5RC-Q-8P8X

0
516 B

1154ms
78ms

Image
text/plain

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ6ZE5RC-Q-8P8X
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 90885F2E3DC649CB85F86D8886C94AAC Ref B: YTO01EDGE0508 Ref C: 2023-12-15T18:47:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMkNQHG3DWWVMBIjM7fw==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LQ6ZE5RC-Q-8P8X
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame F32A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=3Ey83oLSTDCDe__nUUqUVg&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=3Ey83oLSTDCDe__nUUqUVg

43 B
479 B

42ms
42ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=3Ey83oLSTDCDe__nUUqUVg

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5ABT1NZJXY1TAP0M39BK
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=3Ey83oLSTDCDe__nUUqUVg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F32A
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFE2WkU1UkMtUS04UDhY
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPK3qbc1Xz1SU0S-sQDr6DI&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFE2WkU1UkMtUS04UDhY&google_push=

170 B
188 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFE2WkU1UkMtUS04UDhY&google_push=

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFE2WkU1UkMtUS04UDhY&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 29af2665c43893332e84c235bac366c1
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F32A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFgOvwDApJF4Wu0y0MWZn6Y&google_cver=1

42 B
843 B

162ms
36ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFgOvwDApJF4Wu0y0MWZn6Y&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFgOvwDApJF4Wu0y0MWZn6Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F32A
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://match.adsrvr.org/track/cmb/rubicon?
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&gdpr=0&gdpr_consent=&expires=30

42 B
843 B

38ms
37ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&gdpr=0&gdpr_consent=&expires=30
date: Fri, 15 Dec 2023 18:47:14 GMT
server: Kestrel
content-length: 289

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame F32A 0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F32A
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/9W_KaKNJIQJUXjujbYtphA?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-yva_zRBE2oKktbXty5gTri15QkO1IFNrfNrwCA--~A

42 B
843 B

57ms
36ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-yva_zRBE2oKktbXty5gTri15QkO1IFNrfNrwCA--~A
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-yva_zRBE2oKktbXty5gTri15QkO1IFNrfNrwCA--~A
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F32A
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTRiZmYwYzc0YzFiMmM2MDAzYTU1Nzc0YTA5Y2UzOWJhYWUwNGVhMw

170 B
188 B

96ms
96ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTRiZmYwYzc0YzFiMmM2MDAzYTU1Nzc0YTA5Y2UzOWJhYWUwNGVhMw

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-156-123-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTRiZmYwYzc0YzFiMmM2MDAzYTU1Nzc0YTA5Y2UzOWJhYWUwNGVhMw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK rp
match.prod.bidr.io/cookie-sync/ Frame F32A 43 B
433 B 5175ms
36ms Image
image/gif 54.156.123.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.156.123.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
capi.connatix.com/us/ Frame F32A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=LQ6ZE5RC-Q-8P8X&pId=11&gdpr=&gdpr_consent=&us_privacy=
https://capi.connatix.com/us/pixel?puid=LQ6ZE5RC-Q-8P8X&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true

82 B
82 B

56ms
55ms

Image
image/gif

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LQ6ZE5RC-Q-8P8X&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 8360da9d6f4736b3-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Fri, 15 Dec 2023 18:47:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://capi.connatix.com/us/pixel?puid=LQ6ZE5RC-Q-8P8X&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 8360da9cee7b36b3-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2

200

cksync
hb.yahoo.net/ Frame F32A
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ups.analytics.yahoo.com/ups/58160/sync?_origin=1&uid=LQ6ZE5RC-Q-8P8X&redir=true
https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=58160&ovsid=LQ6ZE5RC-Q-8P8X&redir=true
https://hb.yahoo.net/cksync?cs=63&axid_e=eS00TnZNczlORTJ1SHp2OTVWNXZ1MHZWMnJmS05MdjVqVn5B&ovsid=LQ6ZE5RC-Q-8P8X&dpid=58160

57 B
650 B

7413ms
91ms

Image
image/gif

23.222.4.141
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hb.yahoo.net/cksync?cs=63&axid_e=eS00TnZNczlORTJ1SHp2OTVWNXZ1MHZWMnJmS05MdjVqVn5B&ovsid=LQ6ZE5RC-Q-8P8X&dpid=58160

Requested by

Protocol

Server

23.222.4.141 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-222-4-141.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ed079d77ba54a8e4bfc931029de75b1f5128fcae45e274d53aca95f8ab17b438

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Fri, 15 Dec 2023 18:47:18 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 57
x-mnet-hl2: E
expires: Fri, 15 Dec 2023 18:47:18 GMT

Redirect headers

location: https://hb.yahoo.net/cksync?cs=63&axid_e=eS00TnZNczlORTJ1SHp2OTVWNXZ1MHZWMnJmS05MdjVqVn5B&ovsid=LQ6ZE5RC-Q-8P8X&dpid=58160
date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame F32A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LQ6ZE5RC-Q-8P8X
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ6ZE5RC-Q-8P8X
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ6ZE5RC-Q-8P8X&ckls=true&ci=uZrSoNNEwH&nc=false&trid=-849632242

43 B
1 KB

68ms
42ms

Image
image/gif

52.85.132.15
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ6ZE5RC-Q-8P8X&ckls=true&ci=uZrSoNNEwH&nc=false&trid=-849632242
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 52.85.132.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-132-15.iad50.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: FsLXFGyTEPTHBZh7WGoRhnkQxdYG88WXGu9h3_Hl0F5OMO5GEkTtbg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LQ6ZE5RC-Q-8P8X&ckls=true&ci=uZrSoNNEwH&nc=false&trid=-849632242
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: QcytabON1omanrRkmfBZhBBLKy5evby6IvAnQi-Qx97pynAJhLvTsQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame F32A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://prebid.a-mo.net/setuid/magnite?uid=LQ6ZE5RC-Q-8P8X

0
449 B

102ms
35ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LQ6ZE5RC-Q-8P8X
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:10 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LQ6ZE5RC-Q-8P8X
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
Expires: 0

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame F32A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LQ6ZE5RC-Q-8P8X

43 B
942 B

115ms
42ms

Image
image/gif

68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LQ6ZE5RC-Q-8P8X

Requested by

Protocol

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
an-x-request-uuid: 955c3d53-0e85-405c-bc0f-9b97d5956502
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LQ6ZE5RC-Q-8P8X
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Expires: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame F32A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ6ZE5RC-Q-8P8X

68 B
280 B

5225ms
51ms

Image
image/png

54.80.149.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ6ZE5RC-Q-8P8X
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 54.80.149.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-80-149-98.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LQ6ZE5RC-Q-8P8X
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
Expires: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 3AE5 17 KB
6 KB 128ms
55ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 30A1 90 KB
29 KB 62ms
62ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bed2b5b13a447911cdbf523b3eb74110691781efc58578d13a5b906480fef77a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29441
x-xss-protection: 0
server: cafe
etag: 238 / 19706 / m202312060101 / config-hash: 17400476758908410755
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame B6A1 17 KB
7 KB 102ms
52ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET udm-r3_v2.23.3.js
bid.underdog.media/ 0
0

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 145ms
42ms Script
application/javascript 192.184.68.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: udmserve.net
URL: https://udmserve.net/udm/img.fetch?sid=19311;tid=1;dt=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.184.68.134 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
etag: "bvEECQq4Zy6gU9J/qv1O6Q=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 22 Dec 2023 18:47:11 GMT

GET quant.js
secure.quantserve.com/ Frame 92F8 0
0

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bapnid%3D%24UID%3Bcb%3D0.9522964
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fudmserve.net%252Fudm%252Ffetch.pix%253Fdt%253D1%253Bapnid%253D%2524UID%253Bcb%253D0.9522964
https://udmserve.net/udm/fetch.pix?dt=1;apnid=5638150801812241363;cb=0.9522964

43 B
612 B

138ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;apnid=5638150801812241363;cb=0.9522964
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
an-x-request-uuid: 600048dd-c9a4-4222-9a1e-96b397c312e2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://udmserve.net/udm/fetch.pix?dt=1;apnid=5638150801812241363;cb=0.9522964
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%...
https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OEFCMjZBNUYtRjQ4OC00NjUwLTkyNjQtNjE2QkIzRDM1RDBE&gdpr=-1&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=

0
74 B

4488ms
35ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 08:53:45 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=199174&cb=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bcb%3D0.9522964%3Bindx%3D
https://udmserve.net/udm/fetch.pix?dt=1;cb=0.9522964;indx=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB

43 B
624 B

166ms
83ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.9522964;indx=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:11 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8fkEuCTbuqs5wioHGGl7kmPRJ1veeXMoHeYPmxTjjwPtojw%2FVAJLCzNGatMbQ4gSrpWfjXKL9Lm24w1yDzhIlPNdth%2BZo3gAfMVfc4GqTqVY90DEIVS67G0tcwjC8DRGVs4fC1aHxcJVvA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.9522964;indx=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB
cache-control: no-cache
cf-ray: 8360da877a6254b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58806/sync?redir=true&cb=0.9522964
https://udmserve.net/udm/fetch.pix?dt=1;yahoo=y-wkF9MXhE2uL36cXXVj87KdxGiKK39ZEQ~A

43 B
629 B

82ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;yahoo=y-wkF9MXhE2uL36cXXVj87KdxGiKK39ZEQ~A
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:11 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://udmserve.net/udm/fetch.pix?dt=1;yahoo=y-wkF9MXhE2uL36cXXVj87KdxGiKK39ZEQ~A
date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bcb%3D0.9522964%3Bsonobi%3D%5BUID%5D
https://udmserve.net/udm/fetch.pix?dt=1;cb=0.9522964;sonobi=0792541b-be8f-4a4e-b055-c95ce4edba80

43 B
630 B

83ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.9522964;sonobi=0792541b-be8f-4a4e-b055-c95ce4edba80
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:14 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:14 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-225
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.9522964;sonobi=0792541b-be8f-4a4e-b055-c95ce4edba80
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=24042&cb=0.9522964
https://udmserve.net/udm/fetch.pix?dt=1;magid=LQ6ZE5RC-Q-8P8X

43 B
608 B

83ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;magid=LQ6ZE5RC-Q-8P8X
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://udmserve.net/udm/fetch.pix?dt=1;magid=LQ6ZE5RC-Q-8P8X
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 750589468d5634b7e99830971becaf64
Expires: 0

GET services
sync.technoratimedia.com/ 0
0

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://cm-x.mgid.com/4c7eda2d9428691cd8f54d15244a36a7.gif?ccpa=0&gdpr=0&redir=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bmgid%3D%5BUID%5D
https://udmserve.net/udm/fetch.pix?dt=1;mgid=85f05935-2b68-4b4c-b7d9-e092f1b07c3c

43 B
628 B

417ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;mgid=85f05935-2b68-4b4c-b7d9-e092f1b07c3c
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:11 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Transfer-Encoding: chunked
Location: https://udmserve.net/udm/fetch.pix?dt=1;mgid=85f05935-2b68-4b4c-b7d9-e092f1b07c3c
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Expires: 0

GET
H3 200 pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ Frame 30A1 347 KB
0 36ms
36ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 14:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16875
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 14 Dec 2024 14:05:56 GMT

GET runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 86D6 0
0

GET aframe
www.google.com/recaptcha/api2/ Frame 10FE 0
0

GET runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E7D1 0
0

GET aframe
www.google.com/recaptcha/api2/ Frame E033 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 5665 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame B6A1 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame D4AC 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 3AE5 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 453A 0
0 52ms
51ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssv2CmBsUWf3coQX9u36ax1VXhgtYbTcxrXDUI15igZhXqXaR_4QorG_Psg_SOpkgQaj3yYz4t-09a2XO_UFu6fTASt3mlOHf-EFNyQmYFoC_EkKu1czw7aOPldgZ6aDyCNJ2gW65DO9Z1kd1XyrzKTEljL_U8oURczqsNGoEDdBP4CAig_laYE6CdDvMGm4ZnG36yxfqSnepzuUXIXCuRzkufNDD6IbPEqucvkMcZ9p1FeNEm-H1bHK5ix_FXePst-4A-B9ANcJ7NqW3I14VZJwiLh94CKv71bYt0pkrf_z7Uiuf4sNQME9k3KKceoN69yusVEBAPuYrQ5HtXX-DpbuUxZI7RvgqeGBYZp7HWNKtbI&sai=AMfl-YTsLGLMpEXgQDfcG2vuT4TwUNi2qW5QYGgH2BukBcU9fXsctg-Re0vWI4V0gehP-nmSETEv6_Frsc8Xl9wwX4s1Qj2a9NNMbFiQWhUxk4DNuI49qrp2InHqGBvEYEo&sig=Cg0ArKJSzCTertCHCmgEEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK img.fetch Show response
udmserve.net/udm/ Frame 453A 53 KB
10 KB 398ms
387ms Script
application/x-javascript 68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://udmserve.net/udm/img.fetch?sid=19311;tid=1;dt=6
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: daf5e7bb5fcd71e2227d59478baaa6a27b3aefa14445d133a83c7b40b6b6c271

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3p: NOI DSP CURa ADMa DEVa PSAa PSDa OUR IND UNI COM NAV INT
Content-Type: application/x-javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Expires: 0

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 453A 203 KB
64 KB 51ms
51ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 container.html Show response
b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6E67 6 KB
3 KB 36ms
35ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:09 GMT
expires: Sat, 14 Dec 2024 18:47:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3232 6 KB
3 KB 35ms
35ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:09 GMT
expires: Sat, 14 Dec 2024 18:47:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FC03 0
0 53ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvD97FL72LGR-HcdLYeNbGIKd9hlIjKizghHFUM6rxAai1M3seH-Lf2A2NycTGTWw1js_GiNl0Irb6Va9IWAYwmNQZ502kY4IXFqEiEp37gc03eVL7lSyzLAKim6cIod7KFw8joSMehydjz1Q2Afd8sRf41tu9jPqam9Pl0YA6brFEWPnnkgFtY7XC8ealmvFu_lSkaA2otgrluY-6H9dpKl2Zm1NVF8PT9ZCuWOElj6r8Bfht-UcHZ36c6-1uFFpkWPe5cBupap8ziUE4wiIgBKPmjmmDBeYEpJZkEF7_1rhVYyPdiCDfo-gs_9Oze0oWehqW4qZ9ffDv0um228jk-aYIy1HrnzWFfb-OAxhRbK-lJjBV_FPBWyX9IDg&sai=AMfl-YSqKJvsq9SGPAWyGigEK5jba_cKjN5Wq_hBK2VddM1alPGlvedr07ys7PqNTzjMh3EGg71d3X660QPKHKsobLpAei0v4VK3EW55EZVSXTLKA_tEnvxQ4v5zK_E1Q0g&sig=Cg0ArKJSzHWZQmSQ192SEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 stpdwrapper.js Show response
stpd.cloud/assets/ Frame FC03 9 KB
3 KB 32ms
31ms Script
application/javascript 104.18.31.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/assets/stpdwrapper.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.31.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b871a14951e3e3ecd4c9dc5621153da2e219442a396f8b59311e0111d682ac26

Request headers

Referer: https://express.ba/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: XLstHdN2srrbYqnEo/WEmA==
age: 6749
x-ms-lease-status: unlocked
last-modified: Tue, 19 Sep 2023 10:43:12 GMT
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: e6caa7a4-a01e-0067-7aea-1eef6b000000
cache-control: public, max-age=1200
x-ms-version: 2009-09-19
cf-ray: 8360da88ebdc36d0-YYZ
expires: Fri, 15 Dec 2023 19:07:11 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame FC03 203 KB
64 KB 52ms
52ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 965C 0
0 53ms
52ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZ5qW_s4ZsuU0GMMCpJEMnc3eYXLTOX0B-Y5BF-c2LmHqIMNu2NBrAA1vGTis60Cntxqqzvqtb6TxoIerQGiw3EJDnJqncoz9k5duqL7X5hMV4M3XapGn0_OIS2WY_pJpTbsyzcn9FxfgETjiBqwnaEj7rDjmJ54T1bTUJqLJVpfCmyIJeoXQhvgljekLCe3FhnEyzu-hrwWPfICvUj9aTKAN74tbq2Fqs_-B519GouZ3CBltTvLTxFDosy-fjsNDZWFClqsPZFpuaQO6gMsPwY1Vg_XgmC__JVqiq7f7crmMoQLG754peRtagBK-ulAJp-AUbCBXyL7slbYof06L7kDBq0-SrZdX8Mr_-kOfYRitY4oGY4LsF4Nc_0g&sai=AMfl-YQ0-G2pspNSEOO02e-Xp1yzEaU6fOb-4tpjN-sIAfh-QPGYjqb_B2sa-GAs2-KYO0YfusVC9QCu0GsmKtoBcFBhcj7zbPTU9sNNEKgCx3lOy0CbyTPbKsQR9WQKo6k&sig=Cg0ArKJSzBhxxggPDMxvEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 965C 151 KB
50 KB 61ms
61ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68cf3c391ad0c6134f6a9ad43166dad4d9ea7a3dc16dd623a072679949a84b32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Origin: https://express.ba
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51540
x-xss-protection: 0
server: cafe
etag: 18179071379393778126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 965C 203 KB
64 KB 81ms
80ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H2 200 stpd201221.js Show response
stpd.cloud/assets/postbid/ Frame C5CD 461 KB
142 KB 1116ms
67ms Script
application/javascript 104.18.31.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/assets/postbid/stpd201221.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.31.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f5083c8eb8bc90cd7ba3358c406ddb6e8c6bb989b014ac7521f09e7e28946ca

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: /FnTyG7mivuubIGMmM4B7Q==
age: 1042
x-ms-lease-status: unlocked
last-modified: Tue, 19 Sep 2023 10:43:36 GMT
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: aede7035-b01e-0009-30fb-1eba44000000
cache-control: public, max-age=1200
x-ms-version: 2009-09-19
cf-ray: 8360da8fc9bf711c-YYZ
expires: Fri, 15 Dec 2023 19:07:12 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 2931 42 KB
16 KB 2383ms
60ms Document
text/html 74.119.119.65
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfLwAAh7IITwr6AAgOri--l8x_rEZqrUyjSg&u=%7CQz6W3wT3zbnLzAY5lXa10cn0IYPub%2BsK30d9sxv0Yzc%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92JnU_9zagUY5e8WyNGK0N8eD1fsGFXj2-TtmuctVpKB_hK47gjvkCKfVxFB59H-PN9ivfW2oFpwG-ptVdc9vhznbcz5XNuTIYpKnL6hUjIZfxzrVa0VDkCbkSm9xEoYtWLgVwNtF9l4ia5w7Tq2T02eIKfM9LhXGXz8f04oElejNf5jkciEvo4a85X8irT9_HF544HOdm3UbXyDHIrCa4BsSDBdsYHk0ICFmaMORnHWyLWBMk3VMST2ugb2w0B5CF9fw2_Zji7T9gwha4mOSy7wb2nisy7pdwyCuSYW37IAozHa_8s4IV12BSN_u6xIIHfVDXxEgbzQFPoJCCCwYrpnkhwkqEKEwDQmwBKBKaAnekwKXP-GOv8bSAMFSipNhLkY89KK_c8pe0RTKCZ05SxDFg8R5yf00SCPeo3UP0qyD7GQnQr_NGpXNflmjMjeSV-n-8s8bBv1ZWfX3VtYlwL5yikaJ67i9ymLcvavCSTHss6nxA0y2yca2rTMa9bZuSMNVn3MTsS7gG6UhERSK5VoDqmrhjhM2dnprWbEAxu4cGiiSxIqZZkE&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC26qlL598ZbKPAvqVvPIPrp2gqAecge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQngAgCoAwHIAwKqBK4CT9BEwolt8V4nwp-F9WjBLq-Smo0fCnFIOPs9weG8LyLpDDHWzLH6EP3PjbIJxQb40StgQbokWeivPwmJCU7i3Zb4-UusRrH7zgugoaMOu4999YHiWHgk5yx0Xis5oLBOTfkoBPtS4Y9duV9sWAQA8TRcyOi8_oY69L8Id0se76UOMcA8hrW_MPAQZAgbUtkWDCc2rF5G1GWdPmxUkEthWcurTWlZClaAtMH1ZDoQZUyvIz5A-tj_Do3rebYZ6peqULD7Z0Xm9GW_HQu0fs8WEYeU-xRb2ENRK_pEw9MnD2ADZah8w9qMRbg22e0OoZmp9-sbdHrMaxIcmf_ddA0L4ocfYkfI4FRUKz7SuhwXlIr8u8RtjWZwbXgy1Rcb_LLFEkdxkX75fIMgHnJ7QR_gBAGABtHu-I3jj6msBaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgGEQATICigI6BIBAgEBIvf3BOlj_1cmfjZKDA_oLAggBgAwB4g0TCOLOyp-NkoMDFfoKTwgdrg4IddAVAYAXAQ%26num%3D1%26sig%3DAOD64_2vwBa-4jx1u6FNVkXHYsx56PRobg%26client%3Dca-pub-9923238532781884%26adurl%3D

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.65 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

6b6738462e524327df099196c8a9d1ae06e82a719c4ede425764d1bed25158e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=6ZBisMMhtBx30VKq3l4uOBsp0R8pO26-2o1HAOA-neuas5mO6dpwOg1mES16v6gvu6L8xJw1z73lPao4udn-ZFzKsdc6bKOpftxsbLwcX_m81cyurZbJD9_yZ8y3I4f7Zd8VaxbKDkizCl4pjP7olugxSZVVfd-GigVvdgRr01p0lHj8xEuCkepn-2VGYFyVPzrZFC5zQc2SxgvRcuh77nSzopSUb9D9oigH3Vj-n2YPQ-HiJDGMkJWM4I3vCkrnXMrayPlkXIyPuWiQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 4674160
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 6E67 3 KB
1 KB 36ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:08:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:08:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3447 1 KB
643 B 37ms
35ms Document
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 66140
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 00:24:51 GMT
etag: 48472445140208031
expires: Sat, 16 Dec 2023 00:24:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 6E67 20 KB
8 KB 36ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:40:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 6E67 0
0 49ms
47ms Image
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSK1R-VRrgT339wvZLC1Uu2KJv4nbPfnuEi5D1kLfW_Dt-9wFgqqQckFrvuFbvdcuHjAoMfittB4__o2lxfDEcpSh8LQQ
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 6E67 24 KB
6 KB 37ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:07:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 13 Dec 2024 03:07:57 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6E67 203 KB
64 KB 51ms
50ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame A9F8 38 KB
15 KB 2393ms
75ms Document
text/html 74.119.119.65
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfLwAAh7QITwr6AAgOrvWK2ho-0iiFozkTmQ&u=%7CQz6W3wT3zbk9k8uCw7JrMG5aY6I1LlTnVH7D0X%2BoG2g%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92JnU_9zagUY5e8WyNGK0N8eD1fsGFXj2-edh7eOGOGiuSprOvMxSeF10iU0BuGFprvErR7xsWHr4YqOxrSKB2WVpB7fwxAnrtDqiweBp-pIlW2PVnFjj3EDcCZOSeTf8NVhA0IUsu1Ay67MzzQZWNKp9jIh_oaaXr0OQWY5ocYqbCtIVhBPpQe5aeYLKBqZ753w6bjThj_LPesbFttxoJAkLaDf7dAnp1HLjwnMSq71I3HLzf3QiTUKyekBer5JzNJFqTLUAGAQ9p6gE1lmX40mQhHIlWh6INIXnO3qo7-_JQ7zQKMLc29dDbJn9IXKmF7lj8yfQhEMcbK1XKBt63DCNKjPdJVC_fNYa1wU-JpODD3djlPboz6_zEhcwKstOGHqKAxbrWV4EaenUkdLxhvBlYzwfAbLYrBwlxAS9eLUCT6Z55OGWa4gMT52g_WhJCEd-i90wYe8TSG-P776mGpbcrXeXDjtWGh2GyXKvmMzCn9BJwCytATJGZ9BaeIG-vEJ0zZV2oLHfdMiBZ1zzHCi3y3Y7JMvp8REBzHythJUlBTvS5TgKAso&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCYCOZL598ZbSPAvqVvPIPrp2gqAecge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQngAgCoAwHIAwKqBLYCT9A9EixpBu8GRD27a3qEBfH-kW7Pa8BU7s-jmA_hdB-5L-yg5mJ8_2nfTcFVL9HjvddW8BhQqvN0ZGt3Vnv51SP4X4yRsCo0nYEPLAxS-OeR5Fd_H9fQksKj1x5b6T9w9Fb-4DYOxRE8XV7YivR_afUMqyA_CWR5WBIFtgW5uS_DNP3vO6H6kqrnkfYkytqx2zbU1dpvwdK5AictCu1W4FRt8Vt99vNbQ-r_rlo0BmGJvYnRwa97Oj5EItWD7vhK2JDDzGjL4KY6jL5seyKRp_8alBbxGgKqryeCJuHj20QRFcRqIfcBs_YbzIEnhrvkWzB10rbchlURGllb4SiWz2W9qH5uoxMzhxxVufcSkg6dHraYXB3cqg8aQXXA_RRcuZLt8CrWMmx7obZgPkFieNWceyKaC-AEAYAG0e74jeOPqawFoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiAYRABMgKKAjoEgECAQEi9_cE6WP_VyZ-NkoMD-gsCCAGADAHiDRMI5c7Kn42SgwMV-gpPCB2uDgh10BUBgBcB%26num%3D1%26sig%3DAOD64_2H7-cumn1AO2kAhZv0DZnN5iXgqg%26client%3Dca-pub-9923238532781884%26adurl%3D

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.65 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

076fc81e5ca8cb23219ea824a6a2911c12700ac950157a61847df8cf16444a30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=W6-GFsMhtBx30VKqzlpwylwJR4mRU0aW1YAtl48gL9MdrrwRgzOb7vKDzf2Zt6ol4K6VFPO8kmgSMW-FKcVp2pY1quLC6pOTV2xUhHMqnmw9R_6Ie2rFfIZjJYoTwzy2MXq-0Vi6ZKj7Pkmjvaw0eQ6zlwI0zVRSykdl3X3U8Ojk-641KHWcauqulKMPrUMDcWZrRZo2QFuzDBFOSdc82-Ozji6ARrvPl5AQro2WfDee1TsGMUfBsABglIkvjZe6fMabSxbsgFqiszaa"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 3934761
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3232 3 KB
1 KB 38ms
38ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:08:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:08:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 789D 1 KB
643 B 37ms
35ms Document
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 66140
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 00:24:51 GMT
etag: 48472445140208031
expires: Sat, 16 Dec 2023 00:24:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3232 20 KB
8 KB 39ms
37ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:40:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 3232 0
0 54ms
51ms Image
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRkmDFfWHBnl7v1NAcRp0Sj7PH4zufepobC3JTydT_HjYRpOcaT5jKqwCQfhcT4LNZYdp7XZuh5_lplisrrG-WMSABjqQ
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 3232 24 KB
6 KB 45ms
43ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:07:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 13 Dec 2024 03:07:57 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3232 203 KB
64 KB 55ms
53ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H2 200 5279 Show response
stpd.cloud/tag/ Frame FC03 380 KB
120 KB 66ms
65ms Fetch
text/javascript 104.18.31.49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5279
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.31.49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21270f9b1123471ad3701e59ede4d0558e0ac5e35f5d8c42c33906645097d88f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 15 Dec 2023 19:07:11 GMT
date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Dec 2023 18:47:11 GMT
server: cloudflare
age: 0
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
cf-ray: 8360da897cec36d0-YYZ
stpdhash: cache

GET
DATA 200
OK truncated
/ Frame FC03 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe5c2a9241518986fcf977ff386c4fe67ab3c7afc40ea57e5abc135f4eb8711e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FC03 0
0 53ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_Nm8XWr8SyFcJV7_vV1M4fZJn5veFeJDQTUqSyRU903KtFBvXEZ5F1irGfJMC8dzkHG6CXVKFVrzU7TqXq_XMf3EiBdOr-mDcKM1XwUA6113Wy8ydrlgvFRxnDD3uh8szpcEq6G8g0shTJ3C6lsCc5rnKwJvvuMFtftgDxIafyp_r8LhVukYS-mJTkarnvnC6h0fcaxKgIgSZ_jH6pGGe-WxiTmX9lpGB_tjIAoSV5XFZfFPuCgOx8L3I9MXt-dXGjYIMfHDG7BFnKiQ-tnxNxS22aSpuJzFJLV756yaI2YQYy3V9aT0BJKNLpFRZmJpcH0QSIh3fP4QhREeDok4gDjzpNFaTGYyeuQpZyZVbV2RhLgVioVYuX6W8VUA1&sai=AMfl-YRJ7U-IyZwh6ODm4jknS66l40yByZuMAhZer-4IeraKcu8IV22HSrIRPbgORx8HYnXoEWSaZcmRP0YOD0mLeeykbFQs6uGjI7zC7BGZCQtDM-ptWoKBWWhJamTN3dE&sig=Cg0ArKJSzG6LbGjJWSQ8EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
DATA 200
OK truncated
/ Frame 965C 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b422086260764aedab9007d616e0c212de4687fe07efb7718f4965dbf4a3bdd

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ Frame 965C 399 KB
135 KB 91ms
91ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d674e81b448f5330b5064c9f27f55735fc2d4c05899d204d53d4a42153cbc667

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137927
x-xss-protection: 0
server: cafe
etag: 18238752853480811934
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/ Frame 719F 9 KB
4 KB 35ms
34ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9923238532781884

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 41622
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 07:13:29 GMT
etag: 5585625838579639069
expires: Fri, 29 Dec 2023 07:13:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6E67 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be28ba8756185a58a28784dae232d0af466a4d03db16e4c66236c1bf1f445aed

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET

ecc
px.owneriq.net/ Frame 3447
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESECVkOjg1XOr2u4a2rXxeseg&google_cver=1&google_push=AXcoOmTBFaEKyCC7jaQhd4kxUKhSsiicqMXkM7aOakxHCSKbA9rGv5v8lp9CL2zWk4YFqLWMjOCRv3fkL4kb40CuMwORlKhDyHmhxP7i...
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmTBFaEKyCC7jaQhd4kxUKhSsiicqMXkM7aOakxHCSKbA9rGv5v8lp9CL2zWk4YFq...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3447
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEL7s9F3tmv9JgsdnpGyIa5Y&google_cver=1&google_push=AXcoOmS439CAKm54f080i5p15qqUrtI7ipCh4Ba84u-msPcVIjQ3xPuMnCvI06SYWwqx6YdSQih_ZnHPxuBo1ZuhDuOZZoIlkL0X2B...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D0812E5B1E9348BAA3CDA37D98868D87&google_push=AXcoOmS439CAKm54f080i5p15qqUrtI7ipCh4Ba84u-msPcVIjQ3xPuMnCvI06SYWwqx6YdSQih_ZnHPxuBo1Zu...

170 B
188 B

47ms
46ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D0812E5B1E9348BAA3CDA37D98868D87&google_push=AXcoOmS439CAKm54f080i5p15qqUrtI7ipCh4Ba84u-msPcVIjQ3xPuMnCvI06SYWwqx6YdSQih_ZnHPxuBo1ZuhDuOZZoIlkL0X2Bx_msKdOrz0GHQvbNuK4rLHs5CkBodt1_VT_FY4tP--wOHCx9olnlZ0XQ

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D0812E5B1E9348BAA3CDA37D98868D87&google_push=AXcoOmS439CAKm54f080i5p15qqUrtI7ipCh4Ba84u-msPcVIjQ3xPuMnCvI06SYWwqx6YdSQih_ZnHPxuBo1ZuhDuOZZoIlkL0X2Bx_msKdOrz0GHQvbNuK4rLHs5CkBodt1_VT_FY4tP--wOHCx9olnlZ0XQ
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 14 Dec 2023 18:47:11 GMT

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame 3447 0
287 B 3169ms
50ms Image
text/plain 52.21.58.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEPktq5kJ1muE3Um6kmYx4ak&google_cver=1&google_push=AXcoOmTWTSmJxs8RJZbamSetDe_BucfxFEe-shlGg_KOwwsDU0GkOK9zIGAYxR_JQG6MlKREHb0x9POPztwjeoCE9kqphiyw0q4AHBa5YxI5iYwkCCzpduZLVaqy65nfHvghjNx4t6mazqC6lbaYWcTIRLKJUOw
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.21.58.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-21-58-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT

GET r.gif
sync.extend.tv/ Frame 3447 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3447
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEHjFQQc23CyE9P9X2JFMqK8&google_cver=1&google_push=AXcoOmR_XHfWWp6LLuM1bgLXYH3bT6fMRlT2xk57jV8MdHQ2BeqNIpbrnNsOPFiMmb51Dt1VPmZbnHtfGmbot...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmR_XHfWWp6LLuM1bgLXYH3bT6fMRlT2xk57jV8MdHQ2BeqNIpbrnNsOPFiMmb51Dt1VPmZbnHtfGmbot6ZaNxklh3GvYcZDMV4QYSus7A3MheW25Yy4HNSMoSHzKoC...

170 B
188 B

51ms
50ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmR_XHfWWp6LLuM1bgLXYH3bT6fMRlT2xk57jV8MdHQ2BeqNIpbrnNsOPFiMmb51Dt1VPmZbnHtfGmbot6ZaNxklh3GvYcZDMV4QYSus7A3MheW25Yy4HNSMoSHzKoCmDp7ttmfUNjPvhX8ycHLEARVdjRs&google_hm=RU1XSGlRYk54MktjNGdNNFIwaFQ=

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmR_XHfWWp6LLuM1bgLXYH3bT6fMRlT2xk57jV8MdHQ2BeqNIpbrnNsOPFiMmb51Dt1VPmZbnHtfGmbot6ZaNxklh3GvYcZDMV4QYSus7A3MheW25Yy4HNSMoSHzKoCmDp7ttmfUNjPvhX8ycHLEARVdjRs&google_hm=RU1XSGlRYk54MktjNGdNNFIwaFQ=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 295
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK sync
dsp.adkernel.com/ Frame 3447 42 B
233 B 1621ms
35ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEO4RywLWKkS4PAQRwivD2So&google_cver=1&google_push=AXcoOmT12JotI4GclRkZd-GoUPW_hzTYxzZeJ1CBQ-JC29u-52wa0YPzXx0SFlPwyTZfijqwTJ6GlSEZW7Nr03mcbjw8UBe5KuGNOAcHzBhuEGVpdlii4B-m8LOXeV_9tdTJ_-quJp2NXD_wfjoNrgYEJJWPpJw
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:13 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H2

200

report
sync.teads.tv/um/ Frame 3447
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEIfzRPZgl-LJ...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=ZDVkMjgxZjItNDUxMy00MWYzLWEwOGYtMzkyMGVmNzU4NDIw&google_push=AXcoOmQA8SOADbJXpN030tpjNSqQAtONCNjmyZrDceP26XRg2ar0lcyXIxLKKvM0mCXGC...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

36ms
36ms

Image
image/gif

23.55.205.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 23.55.205.47 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-47.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 15 Dec 2023 18:47:13 GMT
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3447 0
12 B 57ms
56ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KU5SM52fjAR5MrHDF68U2boJFs3zP_FMFCSQHKpnLqvq_a1eBWypDBQc-MUsPyBldNHLSNBQ

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET ecmg
px.owneriq.net/ Frame 789D 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 789D
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEM1zg2RVmeV34-O8yF4Csfo&google_cver=1&google_push=AXcoOmSAWUseXlbgV5Lo7adcOnv29EayLlQL89Pj_NINAvfdPquiUQfl46oYvzRyHwXP0L5YCp4Oh...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSAWUseXlbgV5Lo7adcOnv29EayLlQL89Pj_NINAvfdPquiUQfl46oYvzRyHwXP0L5YCp4OhKgU-VLCIcav6e6Gy57eb1_Nfw

170 B
189 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSAWUseXlbgV5Lo7adcOnv29EayLlQL89Pj_NINAvfdPquiUQfl46oYvzRyHwXP0L5YCp4OhKgU-VLCIcav6e6Gy57eb1_Nfw

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:12 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: F2D66D3CBE9B4D55BFE98887B29467BA Ref B: YTO01EDGE0508 Ref C: 2023-12-15T18:47:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmSAWUseXlbgV5Lo7adcOnv29EayLlQL89Pj_NINAvfdPquiUQfl46oYvzRyHwXP0L5YCp4OhKgU-VLCIcav6e6Gy57eb1_Nfw
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYMkNQHIr2y6hFQGwl78A==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 789D
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIHKZvCd9mv0EfswVRn05cs&google_cver=1&google_push=AXcoOmQNEgMGpUD7bAnKFI1JIeAgVN91y16jeNwnfz9aiqEhUM6O8c6PiQ875uNJK9T96p3KktP5Oi64wU64Cfu2tD...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEIHKZvCd9mv0EfswVRn05cs&google_cver=1&google_push=AXcoOmQNEgMGpUD7bAnKFI1JIeAgVN91y16jeNwnfz9aiqEhUM6O8c6PiQ875uNJK9T96p3KktP5Oi64wU64Cfu2tD...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MmI5YmJlZmUtN2MxNy00MDVjLTgxZmUtZjRjZGNiNTBjNTNh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a

170 B
192 B

44ms
44ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MmI5YmJlZmUtN2MxNy00MDVjLTgxZmUtZjRjZGNiNTBjNTNh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MmI5YmJlZmUtN2MxNy00MDVjLTgxZmUtZjRjZGNiNTBjNTNh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a
date: Fri, 15 Dec 2023 18:47:14 GMT
server: Kestrel
content-length: 423

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 789D 43 B
362 B 1909ms
50ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSp2kmKdhylmiXaFXRqtoROuG3gD0c2CSCf2hh4GCL9IASgN05VAEtU2wXFhpWPwXiad-i3Nq2syfDcAm8_xZxRVxQSrH0vB50&google_gid=CAESEH22_nBNWh0GYS-lBHhjhiA&google_cver=1

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 484459
expires: Fri, 15 Dec 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 789D
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEHjFQQc23CyE9P9X2JFMqK8&google_cver=1&google_push=AXcoOmSHkMdyOhVt-Vk_CcfMZb_QUGLwdjdptTbp7x9_LhFvJ9qy7YOC0Z0fypzJgk1Lxi0TQETNqnLHJsm96...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSHkMdyOhVt-Vk_CcfMZb_QUGLwdjdptTbp7x9_LhFvJ9qy7YOC0Z0fypzJgk1Lxi0TQETNqnLHJsm969mzLwDTXALX9Sardw&google_hm=RU1XSGlRYk54MktjNG...

170 B
188 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSHkMdyOhVt-Vk_CcfMZb_QUGLwdjdptTbp7x9_LhFvJ9qy7YOC0Z0fypzJgk1Lxi0TQETNqnLHJsm969mzLwDTXALX9Sardw&google_hm=RU1XSGlRYk54MktjNGdNNFIwaFQ=

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:11 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSHkMdyOhVt-Vk_CcfMZb_QUGLwdjdptTbp7x9_LhFvJ9qy7YOC0Z0fypzJgk1Lxi0TQETNqnLHJsm969mzLwDTXALX9Sardw&google_hm=RU1XSGlRYk54MktjNGdNNFIwaFQ=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 238
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 789D
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmTQ5LRHlL4ZgkPnRrTy8PGtkNP4_id5t2uOFp9SXGgG1tGQQaPGtUAnGXmpsPv03mXPSoIVefxcaYE9kefPfCop8gjwdIemgC2e&google_gid=CAESEDG7QllhP...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEDG7QllhPqAvRlqxwCqa1zM&google_hm=T1BVZDJmNjUzMjY1MTY4NDJmNmFkYTNjNzRhZGRhNjE5NDY&google_nid=opera_norway_as&google_push=AXcoOmTQ5LRH...

170 B
195 B

45ms
44ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEDG7QllhPqAvRlqxwCqa1zM&google_hm=T1BVZDJmNjUzMjY1MTY4NDJmNmFkYTNjNzRhZGRhNjE5NDY&google_nid=opera_norway_as&google_push=AXcoOmTQ5LRHlL4ZgkPnRrTy8PGtkNP4_id5t2uOFp9SXGgG1tGQQaPGtUAnGXmpsPv03mXPSoIVefxcaYE9kefPfCop8gjwdIemgC2e

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: nginx
access-control-allow-methods: POST, GET
content-type: text/html; charset=utf-8
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEDG7QllhPqAvRlqxwCqa1zM&google_hm=T1BVZDJmNjUzMjY1MTY4NDJmNmFkYTNjNzRhZGRhNjE5NDY&google_nid=opera_norway_as&google_push=AXcoOmTQ5LRHlL4ZgkPnRrTy8PGtkNP4_id5t2uOFp9SXGgG1tGQQaPGtUAnGXmpsPv03mXPSoIVefxcaYE9kefPfCop8gjwdIemgC2e
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 328
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

report
sync.teads.tv/um/ Frame 789D
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEIfzRPZgl-LJ...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=ZDUzNzRiMzAtZDdhZi00ZjBlLWI5Y2YtZThlZGY0Zjk0NTFi&google_push=AXcoOmTxqyPYpY9xToxZo3_XmZKR5CjkGtL86y6Xv2Z_Nrtxvz8DyZ-BKonfftrbgyg0U...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

35ms
34ms

Image
image/gif

23.55.205.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 23.55.205.47 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-47.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 15 Dec 2023 18:47:13 GMT
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 789D 0
12 B 45ms
44ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13If7CiZWVBVCQ2-R8I8bUoKAWOkrRzKc_Yack5TjwPq8y9w9SYgxvUckk5SRvJSKfOGylBlrl4

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 3232 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c906246c8247c3db838465ea18fde75fd456c05e5f938b0a5678bb91052acfe

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 20A6 90 KB
29 KB 59ms
59ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24b21971270c7296ded38269926f6f26026c9fef90df7e0f4a2df6cc4101fba3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29447
x-xss-protection: 0
server: cafe
etag: 938 / 19706 / m202312060101 / config-hash: 17400476758908410755
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6E67 0
0 59ms
58ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CHoA-L598ZbKPAvqVvPIPrp2gqAecge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQngAgCoAwHIAwKqBKsCT9BEwolt8V4nwp-F9WjBLq-Smo0fCnFIOPs9weG8LyLpDDHWzLH6EP3PjbIJxQb40StgQbokWeivPwmJCU7i3Zb4-UusRrH7zgugoaMOu4999YHiWHgk5yx0Xis5oLBOTfkoBPtS4Y9duV9sWAQA8TRcyOi8_oY69L8Id0se76UOMcA8hrW_MPAQZAgbUtkWDCc2rF5G1GWdPmxUkEthWcurTWlZClaAtMH1ZDoQZUyvIz5A-tj_Do3rebYZ6peqULD7Z0Xm9GW_HQu0fs8WEYeU-xRb2ENRK_pEw9MnD2ADZah8w9qMRbg22e0OoZmp9-sbdHrMaxIcmf_ddA0L4ocfYkfI4BZWC6wUB_dtHWHDb0hUasLBYlA7-w_fZ0G_m47Pj1Lh_Ue0J5XgBAGABtHu-I3jj6msBaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgGEQATICigI6BIBAgEBIvf3BOlj_1cmfjZKDA4AKAfoLAggBgAwB4g0TCOLOyp-NkoMDFfoKTwgdrg4IddAVAYAXAbIXHAoaEhRwdWItOTkyMzIzODUzMjc4MTg4NBi_hnQ&sigh=edCDSozO4nY&uach_m=%5BUACH%5D&cid=CAQSPAAvHhf_39YMHxtjjCBFG8h9Yq_ccqOHGX0ekZpgHuZVrh79aV8RdlRMKCb9wFGlYQfPmRA3OrPP9rmtNhgB&cbvp=2&vis=1
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame 6E67 0
126 B 101ms
33ms Image
text/plain 74.119.119.130
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kOaAGY-CMNgFWuIinRcCAAAA9Rud10bWSW8QLp98ZZpCPXsjvlMxzu0AABIAAAoKQVFVQkNnRUJDZw&wp=ZXyfLwAAh7IITwr6AAgOri--l8x_rEZqrUyjSg&cbvp=2

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.130 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 147726
server: Kestrel
content-length: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 3232 0
0 57ms
56ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C6HI6L598ZbSPAvqVvPIPrp2gqAecge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQngAgCoAwHIAwKqBLMCT9A9EixpBu8GRD27a3qEBfH-kW7Pa8BU7s-jmA_hdB-5L-yg5mJ8_2nfTcFVL9HjvddW8BhQqvN0ZGt3Vnv51SP4X4yRsCo0nYEPLAxS-OeR5Fd_H9fQksKj1x5b6T9w9Fb-4DYOxRE8XV7YivR_afUMqyA_CWR5WBIFtgW5uS_DNP3vO6H6kqrnkfYkytqx2zbU1dpvwdK5AictCu1W4FRt8Vt99vNbQ-r_rlo0BmGJvYnRwa97Oj5EItWD7vhK2JDDzGjL4KY6jL5seyKRp_8alBbxGgKqryeCJuHj20QRFcRqIfcBs_YbzIEnhrvkWzB10rbchlURGllb4SiWz2W9qH5uoxMzhxxVufcS0Ay9jHAlt2dVQTDOzUwnWaVTkZvD6O5NwRbyaAh-ElnjvEGlnOAEAYAG0e74jeOPqawFoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiAYRABMgKKAjoEgECAQEi9_cE6WP_VyZ-NkoMDgAoB-gsCCAGADAHiDRMI5c7Kn42SgwMV-gpPCB2uDgh10BUBgBcBshccChoSFHB1Yi05OTIzMjM4NTMyNzgxODg0GL-GdA&sigh=GqmKTU2zGQc&uach_m=%5BUACH%5D&cid=CAQSPAAvHhf_39YMHxtjjCBFG8h9Yq_ccqOHGX0ekZpgHuZVrh79aV8RdlRMKCb9wFGlYQfPmRA3OrPP9rmtNhgB&cbvp=2&vis=1
Requested by: Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame 3232 0
125 B 97ms
33ms Image
text/plain 74.119.119.130
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kOaAGY-CMNgFWuIinRcCAAAAHpRshadqXfcQLp98ZTs5TK7jaKOiA5cAABIAAAoKQVFVQkNnRUJDZw&wp=ZXyfLwAAh7QITwr6AAgOrvWK2ho-0iiFozkTmQ&cbvp=2

Requested by

Host: b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com
URL: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.130 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 142656
server: Kestrel
content-length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 965C 0
0 53ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstEJl4fAR1x8_cc0O6k_UDF1qIYoiR3PvwUvqZLaVZ4ThQl46prgBry1PkBdJ9M7QSvBhV9ZZI9vBNyd6ti_H8weZa78sGbdm9K5sY9nJ7lDp2hsssnE1jTzxnssol3pj56jzMGVUoDla2y0PhM0NIGWOPQ5IDVm5HrzZhvIW8oNmfTxhOYN_gh01i0hwi1UhuDl0QlSigUS0eoR-RiKnLqfXg_yYfS5D4dz_uHYdu_X9HOMwC3zD_udMOBobKrDOKfvHf6dZWWfS9dVrA2whuXLdytPgevW06Q8Y-d_c-__kbk2_1kjF0M2v5BZSzipTOsaz4-XocPV68yfJED-Prk6Zh-H6Adi5wjo81lzJkVHrj-e3z5xttIYAi5TnUM&sai=AMfl-YSszqlUU7x6SFimNUnBR-Og2MSZjo2YlZinnmlEzZUMcPVOF2iU5mlTdCUhJftk48R0usDtK6mkjIfJYjoJv72MZNKxNfmVmzlhyz35LX_QU3Lzoj_51jtqxSIcqA8&sig=Cg0ArKJSzFHIh-3PnlE_EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:11 GMT

GET
H3 200 prebid2.-article-ads- Show response
fundingchoicesmessages.google.com/f/AGSKWxVR_YVoiw_rwDh6RZQPcbBF6qJP7SjwHvjEY88sddzWBtbBm1HndhroX2UBX-PU11bTE1wj4lnfQrllQYhQVrl1L3BNph0Qlmx8UxSuwivTmOaJxUpiwRjYSxvFkGbYSmFlQyhy3nyGXmkcPajq0sWFLoqfG... 54 B
109 B 64ms
64ms Script
application/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVR_YVoiw_rwDh6RZQPcbBF6qJP7SjwHvjEY88sddzWBtbBm1HndhroX2UBX-PU11bTE1wj4lnfQrllQYhQVrl1L3BNph0Qlmx8UxSuwivTmOaJxUpiwRjYSxvFkGbYSmFlQyhy3nyGXmkcPajq0sWFLoqfGJypWsHqENOipU6lyuYWupD-7DtEREux/_/topadImg./custom11x5ad./adzone./prebid2.-article-ads-

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.wuRrcfYlYhw.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMyNreoDFLSym4fIlcqYY32kVmLO6g/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bb31ff41e497b88df16151cbf466e1acc6b2e5f7f4b1e3a5b8274f7c8397ea8d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lrO4YuhjgEJYnMgeiIc-Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-lrO4YuhjgEJYnMgeiIc-Yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 37ms
36ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:34:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 762
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51
x-xss-protection: 0
server: cafe
etag: 16023549773543154165
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 19:34:29 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWStm_XvriOhtTjztSw3XVHqfjO0fJ37KUBaeBtyjKITYdY15EXY8IABCI1LIr0S6MniscmyLxcmRh96WkFn4ZcBa4qkP6QjSzWT3zO0xIwaVLr1rSnx3igoOJUibrVB9-akvuIUQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-QP_s7qfPs2yFvy5vVMkc3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-QP_s7qfPs2yFvy5vVMkc3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://express.ba
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 751E 17 KB
859 B 162ms
162ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&adk=1812271804&adf=2751417936&lmt=1702666031&plaf=1%3A2%2C2%3A2%2C7%3A2&plat=1%3A128%2C2%3A128%2C3%3A128%2C4%3A128%2C8%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fexpress.ba%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666031693&bpp=3&bdt=197&idt=149&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666032&ga_hid=1364588476&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=970&ish=90&ifk=3414372573&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079265%2C31079979%2C44807405%2C95320884&oid=2&pvsid=1027397839121383&tmod=1769381464&uas=0&nvt=1&fsapi=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32772&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=1.eawlljj4thsp&btvi=1&fsb=1&dtd=171

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d297419da101a6177907250e2d720a7124e98e5345532b7e7b1f6cb58a473c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 837
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4D32 39 KB
16 KB 304ms
303ms Document
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&h=90&slotname=5659738177&adk=3491810937&adf=776186318&pi=t.ma~as.5659738177&w=970&lmt=1702666031&format=970x90&url=https%3A%2F%2Fexpress.ba%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666031693&bpp=1&bdt=197&idt=154&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&prev_fmts=0x0&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666032&ga_hid=1364588476&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=3645&biw=1600&bih=1200&isw=970&ish=90&ifk=3414372573&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079265%2C31079979%2C44807405%2C95320884&oid=2&pvsid=1027397839121383&tmod=1769381464&uas=0&nvt=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=2.o9vu01xoanmv&btvi=2&fsb=1&dtd=176

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ca3e96a9f5e46ebaa0cad4d2af90a8a379c0616af7dd2896394c48c5fa566b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 16649
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:12 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 965C 16 KB
12 KB 62ms
61ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231207&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c338598826bc217130544dffdf6f7df6f69047e74524d39c4c40940da368d1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12304
x-xss-protection: 0

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 42ms
40ms Script
application/javascript 192.184.68.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: udmserve.net
URL: https://udmserve.net/udm/img.fetch?sid=19311;tid=1;dt=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.184.68.134 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
etag: "bvEECQq4Zy6gU9J/qv1O6Q=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 22 Dec 2023 18:47:11 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ Frame 453A 23 KB
9 KB 48ms
46ms Script
application/javascript 192.184.68.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: udmserve.net
URL: https://udmserve.net/udm/img.fetch?sid=19311;tid=1;dt=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.184.68.134 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
etag: "bvEECQq4Zy6gU9J/qv1O6Q=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 22 Dec 2023 18:47:11 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bapnid%3D%24UID%3Bcb%3D0.4775651
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fudmserve.net%252Fudm%252Ffetch.pix%253Fdt%253D1%253Bapnid%253D%2524UID%253Bcb%253D0.4775651
https://udmserve.net/udm/fetch.pix?dt=1;apnid=6683953537462370844;cb=0.4775651

43 B
612 B

94ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;apnid=6683953537462370844;cb=0.4775651
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
an-x-request-uuid: 00458e74-2874-4ded-825e-7094a82de5b2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://udmserve.net/udm/fetch.pix?dt=1;apnid=6683953537462370844;cb=0.4775651
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%...
https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MkM3QUIxODItOTg2My00RkZGLUIyNzgtRTAzQjEzODgzNjlD&gdpr=-1&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=

0
225 B

4487ms
33ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 09:05:45 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=199174&cb=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bcb%3D0.4775651%3Bindx%3D
https://udmserve.net/udm/fetch.pix?dt=1;cb=0.4775651;indx=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB

43 B
624 B

101ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.4775651;indx=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:11 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4VbDwzNKt4Uzp4%2B9qdwJ7u0%2BoYfbz%2BgkEE2yRi1b9IQzdFSesdb2I3fnyQ7D4sbDga3Iuojnhl%2FwsCvMYCHlKoHy3Z0weNPEaIc56rxOQR4gIuaEIVWbIo9KQfh9AIYRR%2BV%2BKhO7uiob3w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.4775651;indx=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB
cache-control: no-cache
cf-ray: 8360da8b492f54b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bcb%3D0.4775651%3Bsonobi%3D%5BUID%5D
https://udmserve.net/udm/fetch.pix?dt=1;cb=0.4775651;sonobi=b3786afc-c6d9-4961-b1c3-da11bd202aa8

43 B
630 B

83ms
83ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.4775651;sonobi=b3786afc-c6d9-4961-b1c3-da11bd202aa8
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:14 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:14 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-123
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://udmserve.net/udm/fetch.pix?dt=1;cb=0.4775651;sonobi=b3786afc-c6d9-4961-b1c3-da11bd202aa8
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=24042&cb=0.4775651
https://udmserve.net/udm/fetch.pix?dt=1;magid=LQ6ZE5RC-Q-8P8X

43 B
608 B

82ms
82ms

Image
image/gif

68.71.249.118
PERFORMIVE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;magid=LQ6ZE5RC-Q-8P8X
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Server: 68.71.249.118 Toronto, Canada, ASN46562 (PERFORMIVE, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://udmserve.net/udm/fetch.pix?dt=1;magid=LQ6ZE5RC-Q-8P8X
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 750589468d5634b7e99830971becaf64
Expires: 0

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ Frame 20A6 431 KB
135 KB 36ms
35ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

108cdb682e1d256ba58174d96775ec12fe2e9515ffa2ca7edfff49343a4d97ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 14:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16875
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 14 Dec 2024 14:05:56 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWStm_XvriOhtTjztSw3XVHqfjO0fJ37KUBaeBtyjKITYdY15EXY8IABCI1LIr0S6MniscmyLxcmRh96WkFn4ZcBa4qkP6QjSzWT3zO0xIwaVLr1rSnx3igoOJUibrVB9-akvuIUQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WlvVNpRHKe5AuGXpNRUXGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-WlvVNpRHKe5AuGXpNRUXGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://express.ba
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWStm_XvriOhtTjztSw3XVHqfjO0fJ37KUBaeBtyjKITYdY15EXY8IABCI1LIr0S6MniscmyLxcmRh96WkFn4ZcBa4qkP6QjSzWT3zO0xIwaVLr1rSnx3igoOJUibrVB9-akvuIUQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zkPg8QtvAk1PxDI-N5U3UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-zkPg8QtvAk1PxDI-N5U3UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://express.ba
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWStm_XvriOhtTjztSw3XVHqfjO0fJ37KUBaeBtyjKITYdY15EXY8IABCI1LIr0S6MniscmyLxcmRh96WkFn4ZcBa4qkP6QjSzWT3zO0xIwaVLr1rSnx3igoOJUibrVB9-akvuIUQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--R1moxnFKr6fWvraEoGMrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: script-src 'report-sample' 'nonce--R1moxnFKr6fWvraEoGMrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://express.ba
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxXVbjn51aEX9ft0ZffEW2-doL952Fcd6hZ1Hjk1OI6TLn_k5VafEA43xJrDiPEzenm0gE5iNN-dd2i1PqrFBnW-DnUs_IgyZXTBZ7ksdgTnuStUx1K5Sl23TS7iQInPME99FF0ceQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 75ms
72ms Script
application/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXVbjn51aEX9ft0ZffEW2-doL952Fcd6hZ1Hjk1OI6TLn_k5VafEA43xJrDiPEzenm0gE5iNN-dd2i1PqrFBnW-DnUs_IgyZXTBZ7ksdgTnuStUx1K5Sl23TS7iQInPME99FF0ceQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAyNjY2MDMxLDkyNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9leHByZXNzLmJhLyIsbnVsbCxbWzgsInd1UnJjZllsWWh3Il0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

10809236c95809e3f1f33b1bd74776d89127440778fd0c8602894b81bf0e38ae

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-TpmO3lhlL_gsVO0_oPktbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-TpmO3lhlL_gsVO0_oPktbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-effSsmMYCbAck.js Show response
rules.quantcount.com/ Frame 453A 160 B
643 B 1141ms
35ms Script
application/javascript 52.85.151.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-effSsmMYCbAck.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-12.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f4110d145ad25681a3ef677782ec9a807407fe09b028c2ea15648833ed9cac60

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 17:50:43 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD89-C3
age: 3403
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 22:21:01 GMT
server: AmazonS3
etag: "435cbd9bc4b3440e866ad1f4f7d1ef02"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: rwWssSXvrkYLweh1MMt4JgsiWnAEZey6dElWf_5NMEi0mDD_Sh_nkA==

GET
H2 200 rules-p-Pz67dCqdsHfxh.js Show response
rules.quantcount.com/ Frame 453A 160 B
642 B 1059ms
35ms Script
application/javascript 52.85.151.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-12.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 11b2088deff6ac044087d2ef9e23453bc600e5e505f5cca9bd62a4cfe6d11a74

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:41:14 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD89-C3
age: 392
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 23:00:33 GMT
server: AmazonS3
etag: "eee1bd1fc55b604b66cd9e63c4f811b8"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: mQNCOgVGxN92cHUzVoB78AjlzlRMunMXUtOHAyme3CWjQ-aJbBOhAA==

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 965C 17 KB
6 KB 40ms
38ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Dec 2023 18:47:11 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 102ms
34ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fexpress.ba%2F&domain=express.ba&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://express.ba
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 15 Dec 2023 18:47:11 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 205105
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame 20A6 16 KB
7 KB 375ms
37ms Script
application/javascript 18.67.65.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-65-21.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1812f550e789750740cd3857a9e6e3a44ea37528e5740e1178979255982a8b05

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 17:50:09 GMT
content-encoding: gzip
via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
x-amz-version-id: vFmMWTGjNYnIOOTqUBhOG3Nl0TgsBwDW
x-amz-cf-pop: IAD89-P1
age: 3424
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6975
x-amz-meta-git_commit: 935e2f1
last-modified: Fri, 15 Dec 2023 15:00:12 GMT
server: AmazonS3
etag: "abd7ecac221cf49e3ca305828e7329db"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: yxfqUcaWbMmzvOLlhwX6LsOoPMFWilPIqmZ-qqq5nBeAgrmYTLkolg==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 20A6 282 KB
70 KB 36ms
36ms Script
application/javascript 18.160.53.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.53.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-53-102.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 99c6eb6c3f17d69837d604201ac0453a5677eef91484aee37e72dff818ddadbc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 17:54:12 GMT
content-encoding: gzip
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront), 1.1 5443600a954c786f2e851cd6ea9e7e98.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 22:20:11 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, IAD55-P2
age: 3181
x-amz-server-side-encryption: AES256
etag: W/"bab82e5d8801f394c1ef53a45dc29542"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: R-SnPivSKvYBO3tYd7HlsQNxylhKjVQNAOQh2OKlNWYC_ACosmFLKg==

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 20A6 135 B
410 B 115ms
114ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7c2589f966c01479236dda131a4942c70ba281e3be202cc12d56680f86977a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 20A6 359 B
658 B 1061ms
34ms XHR
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fexpress.ba%2F&domain=express.ba&cw=1&lsw=1

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2ac12c5d190c56d27a7537f13e9403cc085c66e8b8ec59515d76dca17b54d5a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 502372
expires: 0

GET
H3 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 20A6 2 KB
1 KB 37ms
17ms XHR
application/json 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20231215

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1bd602e1b0e6550c4d17fdf143690c739165c62ce5b06b6117721aef5046f8d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 15 Dec 2023 18:47:12 GMT
x-content-type-options: nosniff
content-encoding: br
age: 9987
x-jsd-version: 1.0.1904
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 848
x-served-by: cache-fra-eddf8230103-FRA, cache-yyz4583-YYZ
x-jsd-version-type: version
etag: W/"63a-aCy8v1I2wKkYEp4sVyxxZyBL39E"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 20A6 483 B
1009 B 317ms
29ms Script
application/javascript 104.26.9.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Mon, 27 Nov 2023 07:14:08 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 1506732
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IFQ5yKyLmO2fed0ay3%2BMWlpqwztEfavN5Jj46Q7cW6PcFQ%2BlKdINQjd7NXYyDLEu2QI4VC2M6Sm33%2FZD82ExoNI6iWCBKrLmCk6h%2BYOi3yH%2BFSFwzdoI%2BV2dA6SdHzMk"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 8360da90bb917118-YYZ

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3682 13 KB
5 KB 37ms
36ms Document
text/html 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 17775
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 13:50:57 GMT
expires: Sat, 14 Dec 2024 13:50:57 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 77DF 829 B
1 KB 52ms
51ms Document
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f103.1e100.net

Software

GSE /

Resource Hash

a8daa17e53469faafd68e0d34f9802e01c577b8e2f6bd86151b6b7f8d035f5f4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--3aUylqniuvCFxRg_89rzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce--3aUylqniuvCFxRg_89rzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:12 GMT
expires: Fri, 15 Dec 2023 18:47:12 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H3 204 AGSKWxW16P6Szrnc9eM30igIrfz3B9_-cU8Vj5i-SCATC2GG-r34-B6MTgJ3x_GORUJDpNcp2Ycf6uBRLeHhbEhiz8BzYOPYE5OxIrTFrtS5BtD-jQs5Yb9WoIKQrFX4WZLb_q-LGp9pJg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 51ms
51ms XHR
text/html 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW16P6Szrnc9eM30igIrfz3B9_-cU8Vj5i-SCATC2GG-r34-B6MTgJ3x_GORUJDpNcp2Ycf6uBRLeHhbEhiz8BzYOPYE5OxIrTFrtS5BtD-jQs5Yb9WoIKQrFX4WZLb_q-LGp9pJg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-18-160-23-201.iad12.r.cloudfront.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vhoAM7-HGwPZzO9Y0adT1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
content-security-policy: script-src 'report-sample' 'nonce-vhoAM7-HGwPZzO9Y0adT1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://express.ba
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac Show response
config.aps.amazon-adsystem.com/configs/ Frame 20A6 564 B
838 B 35ms
34ms Script
application/javascript 18.160.10.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-17.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: cff4fa7f2b6a29e998e9de4ec883bcd768025a8283c4fbd3ffc0c26d94f5d918

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:02:55 GMT
via: 1.1 68a3b1d5c75429221abc685a453afb60.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: IAD12-P3
age: 2657
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 564
x-amz-cf-id: huXQsLdMFTKtP8dcIWi7QpL-2nsNt2d5zMtk2GPyq2lsruLQx4F6vw==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ Frame 20A6 4 KB
4 KB 41ms
41ms XHR
application/json 18.160.53.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fexpress.ba&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.53.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-53-102.iad55.r.cloudfront.net
Software: Server /
Resource Hash: 5f27f2d6fd0d7a35050e1868e67548df87f1c88964ee798f826cca6ea1cd747b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
via: 1.1 5443600a954c786f2e851cd6ea9e7e98.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD55-P2
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://express.ba
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 3623
x-amz-cf-id: gmrOS5SMqDdMpd1g4QFS5fiqIElbdwY9iYMPWoEUiyCQz9Q_W0vtEA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ Frame 20A6 23 B
457 B 44ms
44ms XHR
text/javascript 18.160.23.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fexpress.ba%2F&pid=qFCwaaP8cyjMm&cb=0&ws=300x150&v=23.1211.1645&t=800&slots=%5B%7B%22sd%22%3A%22express_ba_970x250_Leaderboard_Billboard_D%22%2C%22s%22%3A%5B%22970x250%22%2C%22728x90%22%2C%22970x90%22%2C%221300x300%22%2C%22980x300%22%2C%221200x200%22%2C%221100x200%22%2C%221000x200%22%2C%221000x250%22%2C%22970x300%22%2C%22980x240%22%2C%22980x120%22%2C%22970x200%22%2C%22970x120%22%2C%22728x100%22%2C%22728x250%22%5D%2C%22sn%22%3A%22%2F147246189%2C21864506698%2Fexpress.ba_970x250_Leaderboard_Billboard_D%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.23.201 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 5ea972e689f9b02c2fa2ba9f72e70ede.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: IAD12-P4
x-amz-rid: 5T6DCGXHEF4GGV38PTCF
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://express.ba
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: nLrMjab4Ec7gHxkdqp8biOp0UX-jcdIhzLrwxW8Np2kvFA2yH3JGGQ==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 20A6 6 KB
3 KB 35ms
35ms XHR
application/javascript 18.160.53.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.53.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-53-102.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:16:52 GMT
x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 9c13d38452f2017c92d65c8904408686.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P2
age: 66621
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: -bvKqduIceVWuBI1fpBjYHHnVf8RUmFiTMmizG3I7FuNGUAmblZjWg==

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame 20A6 42 B
549 B 196ms
152ms XHR
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57ce2b08ef8da65d0f5627d6e41c7725efd32d3e377dea3c91025a375ae93fdf

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qGVKfQUyDigwY3c5%2BCv2eHoJtaF06VwUve9s9nnwlmLIvqi1Mj3vwt4I07qhNaecxxmri79xGafW6G%2BYNnF0jyCHyg2%2BwwQ%2Fx9pzUA0qvjR56eCxSdxK0O2xnjyEf1eOFpcOf6qNH9wB"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 8360da8ce99039fa-YYZ
content-length: 42
expires: 0

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame 20A6 295 B
533 B 248ms
208ms XHR
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f58ec854efae854dd9f0dc2da3abc20497b62ace9d53f5de3460b9d9517211aa

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-prebid: pbs-go/0.259.0
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=myUX%2BKEAvdCHBI58GpqlE1HIPHoiKDoEdnKngUMPTEaxy2dZohCRMhsZPT6UqbxHAhfaunnSY%2FAg%2FogPq3ouh4sMpPdR82m4jCdE8kERDoVly%2F%2FDK4BmKhYai2EWj5N0r1nW4PjJ2Z1f"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 8360da8ce98e39fa-YYZ
expires: 0

GET
H2 200 arj Show response
setupad-d.openx.net/w/1.0/ Frame 20A6 174 B
494 B 145ms
142ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://setupad-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fexpress.ba%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=480&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=6b11a5fc-7077-442b-b47b-b30074b17922&nocache=1702666032097&gdpr=0&x_gdpr_f=1&pubcid=d8c42b1f-3143-46aa-8ced-656c3e1648ec&aus=970x250%2C728x90%2C970x90%2C1300x300%2C980x300%2C1200x200%2C1100x200%2C1000x200%2C1000x250%2C970x300%2C980x240%2C980x120%2C970x200%2C970x120%2C728x100%2C728x250&divids=express_ba_970x250_Leaderboard_Billboard_D&aucs=&auid=556413529
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: a905ff725508932b4618ee2a3e5a32c4b47cddc4ced1b025e1e181be1b17f0d5

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://express.ba
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 166
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 20A6 0
0

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 20A6 0
173 B 642ms
109ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:12 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST cdb
bidder.criteo.com/ Frame 20A6 0
0

POST openrtb
adx2.adform.net/adx/ Frame 20A6 0
0

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 20A6 840 B
696 B 58ms
58ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 04f665f0c7065d754a127915580431f4050646bfb2c97ce5c5ba8cd5e103f183

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:11 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 25
content-length: 437

POST translator
hbopenbid.pubmatic.com/ Frame 20A6 0
0

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame 20A6 94 B
969 B 59ms
59ms XHR
application/json 63.251.86.49
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.27.0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.49 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: /
Resource Hash: f42a7fac2a132e5099e8b97fd69f2fc986362e13b5012d62f8294f2b4a7045aa

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://express.ba
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST prebid
mp.4dex.io/ Frame 20A6 0
0

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ Frame 20A6 54 KB
17 KB 159ms
58ms Script
application/javascript 104.67.206.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.67.206.143 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-67-206-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Fri, 15 Dec 2023 19:02:12 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ Frame 20A6 39 KB
39 KB 40ms
40ms Script
text/javascript 18.160.46.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.46.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-46-100.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 17:39:57 GMT
via: 1.1 f236592b6945fb3d11c8af0cdf27baf0.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 4036
x-amz-server-side-encryption: AES256
etag: "6e8b1f94eaf615b7d0953ad4e8d8bb85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
content-length: 39537
x-amz-cf-id: vU5wXmbpgQc6ZhCKnk2DOPFUpayNVGzy1MxyjUFyOI8wOtOozJW5zA==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ Frame 20A6 55 KB
10 KB 3132ms
53ms Script
application/javascript 104.22.52.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fexpress.ba%2F&ref=https%3A%2F%2Fexpress.ba%2F&_it=amazon&partner_id=533
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.52.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 29 Nov 2023 15:31:45 GMT
server: cloudflare
x-amz-request-id: 01CC8G5F16RM7B26
age: 6289
etag: W/"13043c1bbaf21ccc6e8ed474a744d3f2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 8360daa449b87115-YYZ
x-amz-id-2: HXRUR8HjAo6USwQLdtHY+PYQf8tGuqDCh/+7XnINsX6lV9HyCEeo0/fdHmm/D8O2xprGCoT8y84=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ Frame 20A6 151 KB
33 KB 30ms
30ms Script
text/javascript 104.22.53.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.53.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12ba93db33de679d443dc28aee4a2190b580b8ad3fc53216d5bb2678d4e17f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: HZ2NTTXSW6MGPZF8
age: 1695
etag: W/"7229163a9092e2cee472ddee92dcb6ba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8360da8cebdca250-YYZ
x-amz-id-2: zIxbOJy3tJB3MVNb2ETIUsQeNLhNE8AAqxzt9RFr7lRWB6Ytei0o9T1UI2r27V6bAc22RqK3R6Uy/mA/5NQ+PQ==

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ Frame 20A6 14 KB
5 KB 68ms
67ms Script
application/javascript 104.67.206.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.67.206.143 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-67-206-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "38c0-5e92054540ea5-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 5252
expires: Fri, 15 Dec 2023 19:02:12 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 20A6 33 B
270 B 359ms
118ms XHR
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

57fc69396eba1cad17d9ac71dd535f7ee3befdb63c54c1ee10836da118cdcfed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 77DF 0
0 50ms
49ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231207&jk=1027397839121383&rc=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 3682 39 KB
15 KB 36ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 07:42:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39876
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 07:42:36 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 4D32 3 KB
1 KB 37ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&h=90&slotname=5659738177&adk=3491810937&adf=776186318&pi=t.ma~as.5659738177&w=970&lmt=1702666031&format=970x90&url=https%3A%2F%2Fexpress.ba%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666031693&bpp=1&bdt=197&idt=154&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&prev_fmts=0x0&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666032&ga_hid=1364588476&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=3645&biw=1600&bih=1200&isw=970&ish=90&ifk=3414372573&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079265%2C31079979%2C44807405%2C95320884&oid=2&pvsid=1027397839121383&tmod=1769381464&uas=0&nvt=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=2.o9vu01xoanmv&btvi=2&fsb=1&dtd=176

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:08:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56352
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:08:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 4D32 20 KB
8 KB 37ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54374
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:40:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4D32 0
0 47ms
47ms Image
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSrTXFfKMSsgzg0P-bKaWXNZnRZJnjwYTYL8MamuR88dCq0aRO3mUVcA4DHklnnZXHdaoYmnCBLIg17m6xnQQNoUddZCg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&h=90&slotname=5659738177&adk=3491810937&adf=776186318&pi=t.ma~as.5659738177&w=970&lmt=1702666031&format=970x90&url=https%3A%2F%2Fexpress.ba%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666031693&bpp=1&bdt=197&idt=154&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&prev_fmts=0x0&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666032&ga_hid=1364588476&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=3645&biw=1600&bih=1200&isw=970&ish=90&ifk=3414372573&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079265%2C31079979%2C44807405%2C95320884&oid=2&pvsid=1027397839121383&tmod=1769381464&uas=0&nvt=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=2.o9vu01xoanmv&btvi=2&fsb=1&dtd=176
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4D32 203 KB
64 KB 202ms
201ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:12 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 2B23 179 KB
55 KB 1836ms
132ms Document
text/html 74.119.119.65
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfLwAORToF_eE-AAQ16BeqeHmWfFJAqpheVQ&u=%7C9QHVuHg3G3ymXLAwC239yHoTX94oL1OKSYGmwUiAbkI%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC780SdfuP4sG0R_tRwZ3ha5ZXtGwcc0zmrusvu8bfKQbYhNvXgU_9hRQyX-tOCFr0hslcM6sx7mIgRbnKZeRIlbSbPm4fD-hPjTyzW_xxooaYlNLDdXiHhZkThF8OSvzY-xiy1ioANm3LKGtQ0Oz7HmTzADGeAjDswjYlEHYJOcRMV7PSoh4bvlYw_MwzAbtt72zJ0ek-KcO0hX36a3lxOpZQ5fnj1WzPTdBkAyqOLe8V78aZh0M3uxO7MXjdQGuxrm-KaaH5dGIUoW_vU8-c-toLB_3eB1w6lQ-cOdTrf69DFeWS7QyhtYfm2oJ-lf8H_mkjO5BB6VoE_NEoP5VzYmH2JWXLwLo7jMQaJfX3H0LAwWgXOe263DRhGJ0mLWuSDBt-DZSB2tvUQcNxiiEXCC3vHHxOxnAF2hproqgl-zJz0RdRdigBTavkaeouO1pHvW-cUgO1yuHNTBx9u85I-qrYXZojIL5x-W2M7UF7pDQBB0XTD6lN8hyziDaVyzJzIYD4eP0GqfW9aoD-urLigDOGhSZgLWLz1pF706K1GlNlK0c5G4tgrbEEaXh7DXr28f&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJxcrL598ZbqKOb7C998P6OuQoAycge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQmoAwHIAwKqBOwBT9BEbJ85lwhJKy689HEYk_Sazh2XOMwilQE6VA4wogvw3-LPQFAv_0B3d_e_5-PCFXx_lYYPmCXt51jgVE4RbkfiqTYqGMpzjKbmBGJcYi7mtJ9Dv9s4jFO9aterdCG3rHgTr8pz2o36PTIS64LJXaeG_MUiyVCAb8Gp0_yIIYCIllS3KSC_acJB20xG2LoaOsXYjaXUgmDNTCGqKP6XVC32jERyfyb1o5-4xabwXoDGNgVwkq5iNXfTbmlb0DkII1S46uKR8pd1d4vhv9R_b5LVBddyBuTc23-0ighYtzCh5K8l7nbb-HCSB9uABrTpi6362IDTrgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIBhEAEyAooCOgSAQIBASL39wTpYktyCoI2SgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0E_v19Km7jmuFhXGzdYZj933Bn8g%26client%3Dca-pub-9923238532781884%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.65 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b8a57a112d9843ac5491c59ab101dfbbb2ac030f7ddb2b4b13d390c4a614725a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=NbwI9MMhtBx30VKqvFFbq4cufvD-a17LMritGiuYNiZQDZmeB3U5jXe1xEKea0l0l7qHfgloH9s8w3jpb8-H8iL1nK28I9aW_9k-cBfvxI9vbf_kOxS8w8TBWPQuvNKRAVnbHTFZm-y-Dmi8BQzMp7wghlUMPfVfZ08OJaMrgfYdPu9ye1o848OUZ4Rss9ttBvAlgrRNMcegqyRhSqB5FJ-w4B4JBrfzRonSE9zbqayeLgBp5HaIZQMNbii9GByMlqQwizX180_I-zKY"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 76815222
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4139 1 KB
643 B 36ms
35ms Document
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 66141
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 00:24:51 GMT
etag: 48472445140208031
expires: Sat, 16 Dec 2023 00:24:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4D32 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 47d90e61bc8f5a64fb718b48901fdfcbba6020405ed78b3ddd57ac597dc49349

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4139
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMwBW6M94EixSNcaFJoD1nc&google_cver=1&google_push=AXcoOmTr_74Iv8IkuugtdBy8HQ15nzESwEpKZMbounHGMe62HrfQvZ5FF3...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AXcoOmTr_74Iv8IkuugtdBy8HQ15nzESwEpKZMbounHGMe62HrfQvZ5FF3K5ozFFRIc32FwlZMMp3Py-E09CZYXK-b7_gian5UfPH76Lf3idrBWS9x-4G...

170 B
189 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AXcoOmTr_74Iv8IkuugtdBy8HQ15nzESwEpKZMbounHGMe62HrfQvZ5FF3K5ozFFRIc32FwlZMMp3Py-E09CZYXK-b7_gian5UfPH76Lf3idrBWS9x-4GDWn72xM1yO0JiTX5sbuFYW4OuERFFz4iecAs3Fm&google_hm=w9epRHll4_xt_Z4WPMAW6w

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AXcoOmTr_74Iv8IkuugtdBy8HQ15nzESwEpKZMbounHGMe62HrfQvZ5FF3K5ozFFRIc32FwlZMMp3Py-E09CZYXK-b7_gian5UfPH76Lf3idrBWS9x-4GDWn72xM1yO0JiTX5sbuFYW4OuERFFz4iecAs3Fm&google_hm=w9epRHll4_xt_Z4WPMAW6w
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET ecmg
px.owneriq.net/ Frame 4139 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4139
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESECYuFMF-bACv2svUsbDzfsc&google_cver=1&google_push=AXcoOmQ_PGL9dCLb0i0mNdckVCH6lPf4g6-jpeAkOrnGF7LyMHabm4J...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=632079a88936066b&is_secure=true&networkId=14000&version=1&google_gid=CAESECYuFMF-bACv2svUsbDzfsc&google_cver=1&google_push=AXcoOmQ_PGL9...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACw18VPIWoDwNmlT6bAAAAAAA&expiration=1702752432&google_cver=1&is_secure=true&google_gid=CAESECYuFMF-bACv2svUsbDzf...

170 B
189 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACw18VPIWoDwNmlT6bAAAAAAA&expiration=1702752432&google_cver=1&is_secure=true&google_gid=CAESECYuFMF-bACv2svUsbDzfsc&google_push=AXcoOmQ_PGL9dCLb0i0mNdckVCH6lPf4g6-jpeAkOrnGF7LyMHabm4JDxz94lKoV3KrDgzIut-rfCzOCW_ZjnWECEJdC5QLLU82mJFtlXL1DnFRuNl0dDqOfGqPuMGdg7wzWzHSowM4ohU_FWww6oTbmUZFc4g

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACw18VPIWoDwNmlT6bAAAAAAA&expiration=1702752432&google_cver=1&is_secure=true&google_gid=CAESECYuFMF-bACv2svUsbDzfsc&google_push=AXcoOmQ_PGL9dCLb0i0mNdckVCH6lPf4g6-jpeAkOrnGF7LyMHabm4JDxz94lKoV3KrDgzIut-rfCzOCW_ZjnWECEJdC5QLLU82mJFtlXL1DnFRuNl0dDqOfGqPuMGdg7wzWzHSowM4ohU_FWww6oTbmUZFc4g
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4139
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENEaHS0TI32A9Z6IB_cRswg&google_cver=1&google_push=AXcoOmSoJHaCvaiIX-u-0jX8lPPz8mMmxQox3hzPVKNU-vnCw8XhZ7oXHH4_FalT0Mjxbt_ICALMLQGDPrRL3HS-lCcpsUd...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSoJHaCvaiIX-u-0jX8lPPz8mMmxQox3hzPVKNU-vnCw8XhZ7oXHH4_FalT0Mjxbt_ICALMLQGDPrRL3HS-lCcpsUdHZtvRGwNxGcIijwnD2aqnZEMlBYnEf4plL-yTv...

170 B
189 B

47ms
47ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSoJHaCvaiIX-u-0jX8lPPz8mMmxQox3hzPVKNU-vnCw8XhZ7oXHH4_FalT0Mjxbt_ICALMLQGDPrRL3HS-lCcpsUdHZtvRGwNxGcIijwnD2aqnZEMlBYnEf4plL-yTvhZh6GxXAw62iSq2qChCzF79UA&google_hm=eS10aFBuLnoxRTJwRW5BMmR6LmNFLl9zVU9hTUpmQ0lRcX5B

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSoJHaCvaiIX-u-0jX8lPPz8mMmxQox3hzPVKNU-vnCw8XhZ7oXHH4_FalT0Mjxbt_ICALMLQGDPrRL3HS-lCcpsUdHZtvRGwNxGcIijwnD2aqnZEMlBYnEf4plL-yTvhZh6GxXAw62iSq2qChCzF79UA&google_hm=eS10aFBuLnoxRTJwRW5BMmR6LmNFLl9zVU9hTUpmQ0lRcX5B
content-length: 0

GET sync
sync.srv.stackadapt.com/ Frame 4139 0
0

GET
H/1.1 200
OK sync
dsp.adkernel.com/ Frame 4139 42 B
233 B 1156ms
35ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEO4RywLWKkS4PAQRwivD2So&google_cver=1&google_push=AXcoOmQo2eATO_3NLxWcpFCEQTXisULwPNWikGQfIOxd-wqXEKBfnkU_bAvEJsKYqFYB7CUZk2joZXmfCGJTWN0ItEi6U6apFfSawvtfH27XL53VUKfRM9P_QByNvlvpCgR4GTPBtZUxJXNmpLqZ29oJJT1wEA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&h=90&slotname=5659738177&adk=3491810937&adf=776186318&pi=t.ma~as.5659738177&w=970&lmt=1702666031&format=970x90&url=https%3A%2F%2Fexpress.ba%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666031693&bpp=1&bdt=197&idt=154&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&prev_fmts=0x0&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666032&ga_hid=1364588476&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=3645&biw=1600&bih=1200&isw=970&ish=90&ifk=3414372573&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079265%2C31079979%2C44807405%2C95320884&oid=2&pvsid=1027397839121383&tmod=1769381464&uas=0&nvt=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=2.o9vu01xoanmv&btvi=2&fsb=1&dtd=176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:13 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4139
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEGNpKoBXewHW0FIrRGGqVtw&google_cver=1&google_push=AXcoOmRC79Ay_oo69w_lOaqAdyE58YCqVOBe66x7St66H65gztfF4clssp6giHzLEyQ...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC79Ay_oo69w_lOaqAdyE58YCqVOBe66x7St66H65gztfF4clssp6giHzLEyQIDPQqGeLWRN2AWrdW7qTOVfD9F7HY467dn2XvKdgX8vHgP1XIFJdORcTnfxi...

170 B
189 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC79Ay_oo69w_lOaqAdyE58YCqVOBe66x7St66H65gztfF4clssp6giHzLEyQIDPQqGeLWRN2AWrdW7qTOVfD9F7HY467dn2XvKdgX8vHgP1XIFJdORcTnfxigVQXoWyEP0GpNoOi57JoQXMO3HG-5pXM

Requested by

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 792e90e4
date: Fri, 15 Dec 2023 18:47:12 GMT
x-bytefaas-request-id: 202312151847121E796A17C9DFE76895F2
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2312151847121E796A17C9DFE76895F2-630DDA1C96432749-00
x-cache: TCP_MISS from a23-209-100-91.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
server-timing: inner; dur=5, cdn-cache; desc=MISS, edge; dur=1, origin; dur=7
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202312151847121E796A17C9DFE76895F2
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRC79Ay_oo69w_lOaqAdyE58YCqVOBe66x7St66H65gztfF4clssp6giHzLEyQIDPQqGeLWRN2AWrdW7qTOVfD9F7HY467dn2XvKdgX8vHgP1XIFJdORcTnfxigVQXoWyEP0GpNoOi57JoQXMO3HG-5pXM
x-bytefaas-execution-duration: 3.46
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 01f6d5656f7931b184b9cd42676ccc501752ffed1c61765b77db62352636db82d9d4a6f5efb27c8d789b67eb9c0f745214c8850c0c52837044632aeb0119b87407e55a78f6e07b43c893fe93a787f1e0c056475e765ef9735b6ba770b1994a34d8
x-origin-response-time: 7,23.209.100.91
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Fri, 15 Dec 2023 18:47:12 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4139 0
12 B 46ms
45ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lhlh38b3C-7jBOO6FL-8-HyuzEDochMLFm0D3OYTpYugNW6zhu9yjk1SRaL6MG7HDU283Smg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3682 0
10 B 35ms
35ms Image
text/plain 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?8opBww
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.122.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4D32 0
22 B 60ms
59ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CTXK6L598ZbqKOb7C998P6OuQoAycge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQmoAwHIAwKqBOkBT9BEbJ85lwhJKy689HEYk_Sazh2XOMwilQE6VA4wogvw3-LPQFAv_0B3d_e_5-PCFXx_lYYPmCXt51jgVE4RbkfiqTYqGMpzjKbmBGJcYi7mtJ9Dv9s4jFO9aterdCG3rHgTr8pz2o36PTIS64LJXaeG_MUiyVCAb8Gp0_yIIYCIllS3KSC_acJB20xG2LoaOsXYjaXUgmDNTCGqKP6XVC32jERyfyb1o5-4xabwXoDGNgVwkq5iNXfTbmlb0DkII1S46qCT0gWzymCbNj9Aux7s4nPDCczV9WdwEfsiPvkf-oM9b7JPwZeABrTpi6362IDTrgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIBhEAEyAooCOgSAQIBASL39wTpYktyCoI2SgwOACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItOTkyMzIzODUzMjc4MTg4NBgA&sigh=phfv5vc-ArM&uach_m=%5BUACH%5D&cid=CAQSPAAvHhf_gMcETpandJQkziSlD3I1TRBcdulIMEK-68b7QdXuNo0jQbdBln69lMnyRjAlT0kJ1rSxyU-ZvxgB&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-9923238532781884&output=html&h=90&slotname=5659738177&adk=3491810937&adf=776186318&pi=t.ma~as.5659738177&w=970&lmt=1702666031&format=970x90&url=https%3A%2F%2Fexpress.ba%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702666031693&bpp=1&bdt=197&idt=154&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&prev_fmts=0x0&nras=1&correlator=8298522585755&frm=23&ife=4&pv=1&ga_vid=891998810.1702666029&ga_sid=1702666032&ga_hid=1364588476&ga_fc=1&nhd=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=3645&biw=1600&bih=1200&isw=970&ish=90&ifk=3414372573&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079265%2C31079979%2C44807405%2C95320884&oid=2&pvsid=1027397839121383&tmod=1769381464&uas=0&nvt=1&fc=1664&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=2.o9vu01xoanmv&btvi=2&fsb=1&dtd=176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 15 Dec 2023 18:47:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.da.us.criteo.com/google/auction/ Frame 4D32 0
126 B 1175ms
50ms Image
text/plain 74.119.118.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=kOyxGOXCMMoHWuIinRcCAAAAEmTfVKf3XQ4QL598ZVQBRx6yCw3WUyMAABIAAAoKQVFVRERBRUJEQQ&wp=ZXyfLwAORToF_eE-AAQ16BeqeHmWfFJAqpheVQ&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.118.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 249782
server: Kestrel
content-length: 0

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame 20A6 630 B
1 KB 1479ms
119ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

06524fc7599f566af2a8f654e1c0bfee618342985463da7778a479c488aad8af

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 34ms
33ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fexpress.ba%2F&domain=express.ba&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://express.ba
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 15 Dec 2023 18:47:12 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 202291
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame C5CD 483 B
1003 B 28ms
28ms Script
application/javascript 104.26.9.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:12 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Mon, 27 Nov 2023 07:14:08 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 1506732
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hxAWAyjp%2BiWv4J044QBMKH%2FG73GVAUGfY22HJIViYs1KWGH0TGZ6ZrzgkR9G3At9OG7SLXGd3uSd7mFyZQd5s4UCbY8JMMdqqON0r0gu9GzJGCewFQBIvbNXeB5%2FqEDJ"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 8360da91ee427118-YYZ

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame C5CD 362 B
660 B 400ms
34ms XHR
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fexpress.ba%2F&domain=express.ba&cw=1&lsw=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

09633db2001358b795d60f8373aa354157203dd6c02a41e58b6e631c9aab0918

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 487698
expires: 0

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame C5CD 630 B
1 KB 1239ms
120ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7e2be5d383f03d6e44b601bf87c471029df8f7240330a52ac694f5b53838cf08

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame C5CD 90 KB
29 KB 79ms
79ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a4ddd3c5168a0f67ab8ecd32561fe7762b25e22fdeb410011e6840ac144bc3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29441
x-xss-protection: 0
server: cafe
etag: 133 / 19706 / m202312060101 / config-hash: 17400476758908410755
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:12 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 6BDD
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-setupad&endpoint=eu
https://eus.rubiconproject.com/usync.html?p=pbs-setupad&endpoint=eu

281 B
555 B

32ms
32ms

Document
text/html

23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-setupad&endpoint=eu
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 15 Dec 2023 18:47:13 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 15 Dec 2023 18:47:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-setupad&endpoint=eu
server: AkamaiGHost

GET
H2 200 b-935e2f1-22fd8186.js Show response
tagan.adlightning.com/setupad/ Frame 20A6 71 KB
28 KB 40ms
39ms Script
application/javascript 18.67.65.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-935e2f1-22fd8186.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-65-21.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2231903638371ed6f332ab6c4482f1b0716e4aabf55b98b3efef17e07e0fa22e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 06:55:50 GMT
content-encoding: gzip
via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
x-amz-version-id: TSM1sCYCFVBYqK8r2.wgiAybDtOWIo_C
x-amz-cf-pop: IAD89-P1
age: 3239483
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 27763
x-amz-meta-git_commit: 935e2f1
last-modified: Tue, 03 Oct 2023 14:25:23 GMT
server: AmazonS3
etag: "7164aeb4f3f79e485a778007d9bf2ade"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: K3Y4wWypJtB-yi_ju51Rq0EPQM4ytNy6A9vqaatLm69ysb10eBIN1g==

GET
H2 200 bl-d6435a4-471b02af.js Show response
tagan.adlightning.com/setupad/ Frame 20A6 65 KB
28 KB 54ms
54ms Script
application/javascript 18.67.65.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-d6435a4-471b02af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-65-21.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 69390edcd2ced27bf58f1d9db8dc310525d7ec19c99cbe7a0df4e72f155bfaec

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 15:17:51 GMT
content-encoding: gzip
via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
x-amz-version-id: 8jDA0d1zsMhOQrltM0uP_BkwiekrliF8
x-amz-cf-pop: IAD89-P1
age: 12562
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 27832
x-amz-meta-git_commit: d6435a4
last-modified: Fri, 15 Dec 2023 14:59:44 GMT
server: AmazonS3
etag: "192d805014952a97549e1226fe784eed"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: tPj_O84TjIM-RPIiSklLaOwMKxDVWkItMChYlFOgoPDdne9w-pboPg==

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame C5CD 540 B
522 B 133ms
132ms XHR
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a3bc98513d1c19d33b5a7a6bde3821381b868b590c20e9bc48bff0ebdf22fce

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FUpwqot30L0XA0zVH9U%2FuemTZlxz5lfRIh7Kr5JJfKUvRdrSXDPbgzlXbbjfZj9a5X46PeEmQjtyYaxEfUz1ywvUM3cEFibnbITdTDNkULRdEpOeY0%2FzqwGYdd9udClSWvnDX3n0hlRQ"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 8360da913a5139fa-YYZ
expires: 0

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame C5CD 255 B
502 B 1161ms
1160ms XHR
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac72092103350cc99cf0ccabca0428a4af1770dc16cbfa821fbf4b67f193d7d8

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-prebid: pbs-go/0.259.0
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sHOAW%2Bno9zv5tFeJMz2bOwQuL6sX2wzTyMTlK3rER90V1HESAP6HsuiAhkpubL5N4F1ouH5TybEYPAs%2B%2BCNYCE2%2FS89On3YtRP13QG3L9NQFIO%2FMJxQU02ULk6emoa6cmkMDE4iwuI%2Fq"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 8360da913a5839fa-YYZ
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame C5CD 8 KB
4 KB 227ms
226ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 54898d53d5f1639401ad5618285685a945392d2ae74207e30bf6cf4b25e770b6

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:12 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 193
content-length: 4373

GET
H2

400

adjson Show response
ads.betweendigital.com/ Frame C5CD
Redirect Chain

https://ads.betweendigital.com/adjson?sizes=300x250&jst=hb&ord=8824907802268793&tz=480&fl=0&rr=direct&s=4462436&bidid=88d07ad7874641&transactionid=8629b4a0-6868-4754-92f3-d95cfa8b81e0&auctionid=bbc...
https://ads.betweendigital.com/adjson?sizes=300x250&jst=hb&ord=8824907802268793&tz=480&fl=0&rr=direct&s=4462436&bidid=88d07ad7874641&transactionid=8629b4a0-6868-4754-92f3-d95cfa8b81e0&auctionid=bbc...

2 B
149 B

75ms
74ms

XHR
application/json

172.240.127.129
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?sizes=300x250&jst=hb&ord=8824907802268793&tz=480&fl=0&rr=direct&s=4462436&bidid=88d07ad7874641&transactionid=8629b4a0-6868-4754-92f3-d95cfa8b81e0&auctionid=bbc88ce0-a91f-4fae-8c15-e622ed4eeeb5&schain=eyJ2ZXIiOiIxLjAiLCJjb21wbGV0ZSI6MSwibm9kZXMiOlt7ImFzaSI6InNldHVwYWQuY29tIiwic2lkIjoiMTMwMCIsImhwIjoxfV19&ref=https%3A%2F%2Fexpress.ba%2F&gdprApplies=false&crf=1&rts=-7830095327781095688
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 172.240.127.129 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 2
content-type: application/json

Redirect headers

location: /adjson?sizes=300x250&jst=hb&ord=8824907802268793&tz=480&fl=0&rr=direct&s=4462436&bidid=88d07ad7874641&transactionid=8629b4a0-6868-4754-92f3-d95cfa8b81e0&auctionid=bbc88ce0-a91f-4fae-8c15-e622ed4eeeb5&schain=eyJ2ZXIiOiIxLjAiLCJjb21wbGV0ZSI6MSwibm9kZXMiOlt7ImFzaSI6InNldHVwYWQuY29tIiwic2lkIjoiMTMwMCIsImhwIjoxfV19&ref=https%3A%2F%2Fexpress.ba%2F&gdprApplies=false&crf=1&rts=-7830095327781095688
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 0

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame C5CD 0
172 B 110ms
110ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:12 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST cdb
bidder.criteo.com/ Frame C5CD 0
0

GET /
adx.adform.net/adx/ Frame C5CD 0
0

POST
H2 200 prebid Show response
mp.4dex.io/ Frame C5CD 1 KB
1 KB 2716ms
116ms XHR
application/json 172.64.153.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b3519af214aa426df606e162b4601e078dff573358134933af6cadc0483bdff

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
x-err: Shapings: no adunits with size and seat and mapping
x-version: 3.0.0-gcp-las
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 8360daa19a8b37d0-YYZ
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame C5CD 50 B
720 B 38ms
37ms XHR
application/json 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
an-x-request-uuid: 5f6059b6-cd4d-45c6-ab05-a41f3f8bcc56
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://express.ba
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3232 42 B
64 B 52ms
52ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvfnzisLYxlWp4V3NyBfZ08TMH_bG2z5Lj5UFP30vbriOKNeX7SwPMYEgJQwBH9ilqkaYe_6pNfvTPDC5WHu7vbvBpWYerfxF4Pj9_5Tsagx79ZgjxTIuw&sig=Cg0ArKJSzEYxnQ-FvNrOEAE&id=lidar2&mcvt=1022&p=150,436,240,1164&mtos=1022,1022,1022,1022,1022&tos=1022,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=729638986&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702666031484&rpt=311&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame 20A6 75 KB
24 KB 7292ms
29ms Fetch
application/javascript 104.26.9.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26305a08644b4f51b55812cf0ecf879c22da303a365b3d2769baa1b54c028c4d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:20 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 1501743
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 27 Nov 2023 07:14:07 GMT
Server: cloudflare
ETag: W/"6faf3acfde3bb82adada71be4fc1deb0"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xZzG%2Bl9xcyWI0V70IJuYDtqaHQks8ai%2Bs0Q5Ob%2BjDgg0ysy21r0awJ5isl91aKJteRFQv8hH%2Fobh4yux06j8%2FXsVjCcOYmzmBv0KRlo%2Bk9hypleax7caR2vSiiw8rimP"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 8360dabebe3136f9-YYZ

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ Frame C5CD 431 KB
135 KB 35ms
34ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

108cdb682e1d256ba58174d96775ec12fe2e9515ffa2ca7edfff49343a4d97ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 14:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16876
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 14 Dec 2024 14:05:56 GMT

GET
H2 200 cookie
cm.adform.net/ Frame C5CD 43 B
106 B 3396ms
126ms Image
image/gif 37.157.6.232
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.232 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2 200 publishertag.prebid.132.js Show response
static.criteo.net/js/ld/ Frame 20A6 89 KB
29 KB 44ms
44ms Script
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.132.js

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b651b84ce79307c301a1c828d60c08084924177f48eec4aad6df47ec714d9af1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:15:31 GMT
server: nginx
etag: W/"642e8db3-16298"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 16 Dec 2023 18:47:13 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 965C 0
0 52ms
51ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231207&jk=1027397839121383&bg=!ODulO3TNAAY3kmNgF5I7ADQBe5WfOCKjVP98XFqGbWz6Jt6Dbl0mCA3ifp2ylO-XcaErKqodm2bKfxwMZWPfANntMrBBAgAAAHtSAAAABGgBB5kC9RruTQ_zfr7QYmDTDyIGXJifbzrrebpFDuDQFK800jHNTNFLXsR0DEcOn5uKxHrHOqCVZfkM5YbJBy-UucwqDAIjiXn7LGVE8sKvo_-efFzc5HRmy00lfORzkOvJeZv7G1owYQF24pEGLoPaJE9KiXejhol4IaxDfImBKuhFgaYFXLshjQBpD3eFfVLf4lSbwepEUrRVGb0vQlmlwpFSW5gmQ6zwpYktLFJCipvErpI7m-NCLmPCgXA8YLyGtKPJposSL09OSaYSRxN1JXtDoj1fTk7o88yYsS8gsIRuyEb9hUYzRUxXCUJxGnouN3mpsQF2L6oTas3PNDPuexklZQb7cueFU5pbLK2zCz-iqWqaA_hNPEm0p50q7IXg7wPY6j8xa-kpiLbVzE8N4PVoQnIfxh5jS1AiwI0Go6zp-c5PUENk8wycv69I3b9XQfNb2kT1hAsSMrmi35fIXkwUF-dPycLsLP28s1fmwTUefWPMyuNNWQqOjFiZ9qnuh3FRSDSqibMwJND4K6U2zNXbiGPWdZbToSWXa0jxHSa__hnwnCDb3uQzI2rc7ktWrMhuq30irvdE02XRQzGDF6Rse-MDtdzTRLuiSozmep8XguVZ-HtjaL1aYZNH-CW3C9NT0HhWvVXPKEeYyGlr2KcXEuO9ojJi12XjV_x6A2dlom2arp7ISUISJKZrD6h_vnZ8gVnVFlM7Ho6utjlCOvf_zVNOtnOl917wncOBk2rCm_BgyU15YNcFvweI6qRJC7OhMKqpobfNxCpaMQKXuxzRX6BjIizaAhmpiCpTD0pcI41nT4IXYc1-A-Sk1b43neb7bzne_ift1s9Ron6BRsXoBNir8OYRSsiAbSY8cUK6YR5IHJecYIDXletWOQe24NzFKbuCjutfyJXq7W8oIEBoparzX2vj_4W_8eAB6RuGYR-sprR5hnF41fCeLPAwwjhTBI1DGterWUkZKEi4eunCmGcscrO95zbsIq6doKCAF8BVAjJMHMc
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ Frame 20A6 49 KB
17 KB 46ms
46ms Script
application/javascript 104.67.206.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.67.206.143 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-67-206-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "c4b6-5e920545406d3-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17042
expires: Fri, 15 Dec 2023 19:02:13 GMT

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame C5CD 75 KB
24 KB 7134ms
29ms Fetch
application/javascript 104.26.9.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26305a08644b4f51b55812cf0ecf879c22da303a365b3d2769baa1b54c028c4d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:20 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 1501743
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 27 Nov 2023 07:14:07 GMT
Server: cloudflare
ETag: W/"6faf3acfde3bb82adada71be4fc1deb0"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h0GIY4cuoiZbOhJU%2Fd0AI1UUiM9g9xxJQkiZ78fNX1qMyWxNvHmIVvohvRRI4n7Okgb2FEAsB%2BsS51JdcatCFF9JQeLUEc9Qa5ya9fU3x4k%2F%2BOgoKIWHpMII87Cc5%2BHL"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 8360dabf0eb036f9-YYZ

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 20A6 39 KB
16 KB 301ms
301ms Fetch
text/plain 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1326434718156843&correlator=4310342673436262&eid=31077976%2C44809527%2C31080078%2C31080121%2C31079525&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&iu_parts=147246189%3A21864506698%2Cexpress.ba_970x250_Leaderboard_Billboard_D&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250%7C728x90%7C970x90%7C1300x300%7C980x300%7C1200x200%7C1100x200%7C1000x200%7C1000x250%7C970x300%7C980x240%7C980x120%7C970x200%7C970x120%7C728x100%7C728x250&ifi=1&didk=1455737656&sfv=1-0-40&eri=1&sc=1&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&abxe=1&dt=1702666033055&lmt=1702666033&adxs=315&adys=2687&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=1&ucis=frf8cg6jopac&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=2&url=https%3A%2F%2Fexpress.ba%2F&ref=https%3A%2F%2Fexpress.ba%2F&top=https%3A%2F%2Fexpress.ba%2F&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&ea=0&ga_vid=891998810.1702666029&ga_sid=1702666033&ga_hid=1466373739&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRiNlrf2xjFIAFICCGQSGAoJeWFob28uY29tGL6Xt_bGMUgAUgIIbxIZCgp1aWRhcGkuY29tGI2Wt_bGMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yj5q39sYxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiMmbf2xjFIABIZCgpwdWJjaWQub3JnGN2Wt_bGMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiNlrf2xjFIAFICCGQSFwoIcnRiaG91c2UYxpe39sYxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVFtRlBjSFpUWW1wVE5WZExlWGxzYldsT01HNWpVVDA5SW4wPRjrl7f2xjFIAA..&dlt=1702666031730&idt=228&prev_scp=amznbid%3D2%26amznp%3D2&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=3321429539&frm=23

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0896a13559a2838fdc70aeb4a296bffcf38f7bdc027705f020433e146c2d4fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16613
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7744 6 KB
3 KB 49ms
44ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Sat, 14 Dec 2024 18:47:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ Frame 20A6 190 B
459 B 1163ms
32ms XHR
application/json 205.180.85.210
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 205.180.85.210 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS: iad06-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
server: nginx
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
vary: Origin
content-type: application/json
access-control-allow-origin: https://express.ba
cache-control: max-age=1800
access-control-allow-credentials: true
content-length: 190
expires: Fri, 15 Dec 2023 19:17:14 GMT

GET
H2 200 publishertag.prebid.132.js Show response
static.criteo.net/js/ld/ Frame 20A6 89 KB
29 KB 365ms
48ms XHR
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.132.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.132.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b651b84ce79307c301a1c828d60c08084924177f48eec4aad6df47ec714d9af1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:15:31 GMT
server: nginx
etag: W/"642e8db3-16298"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 16 Dec 2023 18:47:13 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 20A6 33 B
269 B 118ms
118ms Fetch
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

ca788d8b8cfc94e9e33d6e8d1379ce0127e921a00cbbd684c2e3579d555c55d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 pixel;r=2119570523;rf=0;a=p-Pz67dCqdsHfxh;url=https%3A%2F%2Fexpress.ba%2F;ref=https%3A%2F%2Fexpress.ba%2F;uht=2;fpan=1;fpa=P0-139436114-1702666031931;pbc=052a7ab2-1b60-4338-8c84-53ff18ee62cb;ns=1;c...
pixel.quantserve.com/ Frame 453A 35 B
210 B 46ms
40ms Image
image/gif 192.184.68.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2119570523;rf=0;a=p-Pz67dCqdsHfxh;url=https%3A%2F%2Fexpress.ba%2F;ref=https%3A%2F%2Fexpress.ba%2F;uht=2;fpan=1;fpa=P0-139436114-1702666031931;pbc=052a7ab2-1b60-4338-8c84-53ff18ee62cb;ns=1;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;d=express.ba;dst=1;et=1702666033264;tzo=480;ogl=;ses=e413a0c1-3c9b-4bd0-b797-187d12b827a9;mdl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.184.68.134 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 pixel;r=2103696406;labels=edge.1%2Csid.19311;rf=0;a=p-effSsmMYCbAck;url=https%3A%2F%2Fexpress.ba%2F;ref=https%3A%2F%2Fexpress.ba%2F;uht=2;fpan=1;fpa=P0-139436114-1702666031931;pbc=052a7ab2-1b60-433...
pixel.quantserve.com/ Frame 453A 35 B
210 B 46ms
41ms Image
image/gif 192.184.68.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2103696406;labels=edge.1%2Csid.19311;rf=0;a=p-effSsmMYCbAck;url=https%3A%2F%2Fexpress.ba%2F;ref=https%3A%2F%2Fexpress.ba%2F;uht=2;fpan=1;fpa=P0-139436114-1702666031931;pbc=052a7ab2-1b60-4338-8c84-53ff18ee62cb;ns=1;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;d=express.ba;dst=1;et=1702666033266;tzo=480;ogl=;ses=e413a0c1-3c9b-4bd0-b797-187d12b827a9;mdl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.184.68.134 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 200 v3 Show response
id5-sync.com/gm/ Frame 20A6 698 B
1 KB 655ms
119ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

59d5fe653f2073a9a39ba2785e2d050bdcd3521fe40f6e66ac041260401ddfd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://express.ba
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 200 container.html Show response
a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E95D 6 KB
3 KB 37ms
36ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Sat, 14 Dec 2024 18:47:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4B9F 2 KB
2 KB 3771ms
50ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=24480542&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 00d06ae7da4bdc6aebc714fb9c2ae34563be87591219748f67e5506c73af436f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 15 Dec 2023 18:47:16 GMT
content-length: 1731
content-type: text/html; charset=UTF-8

GET
H2 200 bl-d6435a4-471b02af.js Show response
tagan.adlightning.com/setupad/ Frame E95D 65 KB
28 KB 36ms
36ms Script
application/javascript 18.67.65.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-d6435a4-471b02af.js
Requested by: Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-65-21.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 69390edcd2ced27bf58f1d9db8dc310525d7ec19c99cbe7a0df4e72f155bfaec

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 15:17:51 GMT
content-encoding: gzip
via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
x-amz-version-id: 8jDA0d1zsMhOQrltM0uP_BkwiekrliF8
x-amz-cf-pop: IAD89-P1
age: 12563
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 27832
x-amz-meta-git_commit: d6435a4
last-modified: Fri, 15 Dec 2023 14:59:44 GMT
server: AmazonS3
etag: "192d805014952a97549e1226fe784eed"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: rViwFmCwTQMr6u0PsfTFJ__vYATZlsYLJZr6xmP4o9JhDjbv9u8Phw==

GET
H2 200 b-935e2f1-22fd8186.js Show response
tagan.adlightning.com/setupad/ Frame E95D 71 KB
28 KB 40ms
39ms Script
application/javascript 18.67.65.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-935e2f1-22fd8186.js
Requested by: Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-65-21.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2231903638371ed6f332ab6c4482f1b0716e4aabf55b98b3efef17e07e0fa22e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 06:55:50 GMT
content-encoding: gzip
via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront)
x-amz-version-id: TSM1sCYCFVBYqK8r2.wgiAybDtOWIo_C
x-amz-cf-pop: IAD89-P1
age: 3239484
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 27763
x-amz-meta-git_commit: 935e2f1
last-modified: Tue, 03 Oct 2023 14:25:23 GMT
server: AmazonS3
etag: "7164aeb4f3f79e485a778007d9bf2ade"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 9U96XmoUfsXEGzxO0snTzXUE1Dgf85CAqTSzUGJrnvZie9QGlJE65w==

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame E95D 3 KB
1 KB 36ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:08:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:08:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame E95D 20 KB
8 KB 37ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54375
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:40:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E95D 0
0 51ms
51ms Image
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTE5aVbdGLf0gyFUkCgA7hy2h4ZJhSqLR7uS9ISjdnsbBePEpa5iYWgBJ8AL__jnNv0bttW8zFRgFccv-HimeSkKzRqGg
Requested by: Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame E95D 24 KB
6 KB 39ms
38ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:07:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142756
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 13 Dec 2024 03:07:57 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E95D 203 KB
64 KB 331ms
331ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:13 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 421C 163 KB
52 KB 302ms
152ms Document
text/html 74.119.119.65
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfMQAB9q8E0a28AA2jzeNNxRvzCvnNvos4tQ&u=%7CZGo0cvxfv0AbQlt6kD10ua%2BfJkQzKS7CYfZn2Evjhug%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MTceYYGR9Jp5gwJSFuY1ZhNKFHqRIa1v5YAS4crvdxYSIhqm1U-LkG9HI4_Unhv5sD-zij4WMVTNgK11zAC-NSQvvPEALqU6euZTYqFAtTE9btXcGcU9pgyPERb93Qh4rfTbg6lS0NxdKZCv-fGRzCKt2UkDdON1yB6ue6mMGwkO8EpFKJnGj9B-d9AUIViiZRR_aPX008EzOwzw_Np2XU_PqD8EskhwVkGvftaUo4HMyGt-6QkYnjepTdU7NoRZX-mWDUmj74USCpVjAIB9JBezdwAn63XyE3Q4Cs9NL_Ux1o8JYreqlUTyGd4WUq4mNpKCFCP6xprYcG3BJr4bAfsigIbEURHNtuo6LAUvXp2QgFYALtcfce-FbLKoDMc8oZdgtNP_--wnndWcDN23oRNVNzutWi2NXIIFaXvkC1Pwac3FMDLpN2rqp_L_-MVP3AUl7xJiZ2ZIAz6c1B0HiLKvv0AHAK3LKJInOBu0DtpErk9K3tLf_7WmURU_RvehF7_6oqZLA5XL-TwdtWAjoDU6_mAtmDOq7dmgLqkZOCghoOLILt5CuFNoUHOLxkhGqLU6N4fEzOG6C67g4Ghdr-I&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCP_aAMZ98Za_tB7zbxtYPzce2oAWcge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTczODMxNzE4MzA2MTQyMTbIAQngAgCoAwHIAwKqBLUCT9CNTcCaVlNVzxy-s985-v4zRidss9boIZ2v-Mmy1K1ef-FjfAej-0W0aKTEdTBTQzQB8ugq1ef-u3M2k-vHyKyeSuE6kd2ylWYF0yw94hYN_aDzSuGN8l9vOVHI2_Lo7EPPwvFXOuk5YQXz5rTK_enAJ2yNw5cinxzLEg1rvXhMgZRioOMTX00yJ8Bmo6biyDmZlOArYsC3KGBeMf_foYQLY_3tAY11njievvYeHwRxWhzryJfegNlal96KIlHNZgvLQB_-BXKMjfseAvL4Ta8SVaidmxPd6qjbsjKQ_WPNwPtsTwfFDubqgu1qmuusCET4wYhWsR-zlaeKBflhZH8PjoDTSB1r6qom_izYTI3VzlbF83iiB-1JQBUoQX6FfpmvbVs1QvcI0NiWkw-h-_LwiMlg4AQBgAa06Yut-tiA064BoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiAYRABMgKKAjoEgECAQEi9_cE6WMrAy6CNkoMD-gsCCAGADAHiDRMI7eXLoI2SgwMVvK3RBB3Now1U0BUBgBcB%26num%3D1%26sig%3DAOD64_0v2cp2Ub8qmKJu5tWOr90Z9SbufA%26client%3Dca-pub-7383171830614216%26adurl%3D

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.65 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

cb2b6d4da5efc0434aa0145787a54506118d6adab782c917ea72916909f9dcd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=gdRcksMhtBx30VKqT-F-2Ds48nNfPzY6aPa0Uav8OwpQ4l5Z2nfxYHfuC_SXJugPLyzxeCwxpQPjpg3aSiDVKNJWnu-0layeSUBrBm_o7S-9CKOin6E4dJurLwPb_PK9JkxuAxyQ5u4DvzB4tqg0e4iXNsYTH9zWpNWzNSYaGu63GA0YRueFJq79eyV-TdSBRI3TcdRJwbQ3Az2YY_o0lNP17pmWnv8fgIZ3rMIQm8efYCUuye5HmCun5mfdMl2QQALgjQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 77197893
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C4E6 1 KB
643 B 36ms
36ms Document
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 66142
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 00:24:51 GMT
etag: 48472445140208031
expires: Sat, 16 Dec 2023 00:24:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame C5CD 46 KB
17 KB 318ms
318ms Fetch
text/plain 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=809570336139335&correlator=2246959617279844&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&gdpr=0&iu_parts=147246189%3A21864506698%2Cexpress.ba_300x250_MREC_R_Article_BTF_D&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&didk=3891188798&sfv=1-0-40&eri=1&sc=1&cookie=ID%3Dbe1059d1ea1dc164%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MaGWSW21c-GKOI1l9I_MeDuYgx2IA&gpic=UID%3D00000da9de3aed15%3AT%3D1702666029%3ART%3D1702666029%3AS%3DALNI_MZ59X5AZ7LiBrsRJA5x6ZqrvJFh8g&abxe=1&dt=1702666033839&lmt=1702666033&adxs=-12245933&adys=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=29fblr91jofw&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=2&url=https%3A%2F%2Fexpress.ba%2F&ref=https%3A%2F%2Fexpress.ba%2F&top=https%3A%2F%2Fexpress.ba%2F&vis=1&psz=0x0&msz=0x0&fws=256&ohw=0&ea=0&ga_vid=891998810.1702666029&ga_sid=1702666034&ga_hid=2065845315&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRiNlrf2xjFIAFICCGQSGAoJeWFob28uY29tGL6Xt_bGMUgAUgIIbxIZCgp1aWRhcGkuY29tGI2Wt_bGMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yj5q39sYxSABSAghqEhoKDWNyd2RjbnRybC5uZXQSABiMmbf2xjFIABIZCgpwdWJjaWQub3JnGN2Wt_bGMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRiNlrf2xjFIAFICCGQSFwoIcnRiaG91c2UYxpe39sYxSABSAghqEj4KBW9wZW54EixleUpwSWpvaVFtRlBjSFpUWW1wVE5WZExlWGxzYldsT01HNWpVVDA5SW4wPRjrl7f2xjFIAA..&dlt=1702666031471&idt=1608&cust_params=hb_rf%3D0%26hb_rf_ct%3D0&adks=779358592&frm=23

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5c3aff24df3844d913bcfd176746cb5ef26b13cc29e7c19f41b73a5c40d40d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17789
x-xss-protection: 0
google-lineitem-id: 6414731445
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138455454049
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://express.ba
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
5093fde56d8387850523488cefd87d96.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E9D3 6 KB
3 KB 58ms
46ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5093fde56d8387850523488cefd87d96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:13 GMT
expires: Sat, 14 Dec 2024 18:47:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E95D 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa0b2c0792bf58e2a600c021ff0c4c25e6150c113bd458ce9303284ce0fbe5c0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame C4E6
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEAHe2fY2lk4X5lTAjXrQCCw&google_cver=1&google_push=AXcoOmRI3kPsa3tZGqUWqoGziBoY05Jo6pC469YeCkNQSiK8R_oH9dXq1JiqkIpP367Eb6zmC2Zl0s5LU8JSdZYMzuTWFkEaaWFF&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAHe2fY2lk4X5lTAjXrQCCw&google_cver=1&google_push=AXcoOmRI3kPsa3tZGqUWqoGziBoY05Jo6pC469YeCkNQSiK8R_oH9dXq1JiqkIpP367Eb6zmC2Zl0s5LU8JSdZYMzuTWFkEaaWF...

43 B
434 B

96ms
95ms

Image
image/gif

104.18.25.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAHe2fY2lk4X5lTAjXrQCCw&google_cver=1&google_push=AXcoOmRI3kPsa3tZGqUWqoGziBoY05Jo6pC469YeCkNQSiK8R_oH9dXq1JiqkIpP367Eb6zmC2Zl0s5LU8JSdZYMzuTWFkEaaWFF&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRI3kPsa3tZGqUWqoGziBoY05Jo6pC469YeCkNQSiK8R_oH9dXq1JiqkIpP367Eb6zmC2Zl0s5LU8JSdZYMzuTWFkEaaWFF%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: H2
Server: 104.18.25.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8360da9efe5d39d5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 326
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAHe2fY2lk4X5lTAjXrQCCw&google_cver=1&google_push=AXcoOmRI3kPsa3tZGqUWqoGziBoY05Jo6pC469YeCkNQSiK8R_oH9dXq1JiqkIpP367Eb6zmC2Zl0s5LU8JSdZYMzuTWFkEaaWFF&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRI3kPsa3tZGqUWqoGziBoY05Jo6pC469YeCkNQSiK8R_oH9dXq1JiqkIpP367Eb6zmC2Zl0s5LU8JSdZYMzuTWFkEaaWFF%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8360da9e5d2139d5-YYZ
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sync
dsp.adkernel.com/ Frame C4E6 42 B
233 B 38ms
36ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEO4RywLWKkS4PAQRwivD2So&google_cver=1&google_push=AXcoOmQr5Hz8s3ec4emvgxjr6HDokeAd3oWus0RwJ_QLSP07wG8gXyJftWY-YONygPc_vIb8bv8gpJGfq8vI5FUlmCCovIwE9C3Q
Requested by: Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:13 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C4E6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFBOZxsZMfPYY3T_ETkZYlE&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEFBOZxsZMfPYY3T_ETkZYlE&google_hm=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB&google_nid=index&google_push=AXcoOmSUykH-Xa4ii-ljQm-3U0Yzp4_0aD7gS...

170 B
189 B

48ms
47ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEFBOZxsZMfPYY3T_ETkZYlE&google_hm=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB&google_nid=index&google_push=AXcoOmSUykH-Xa4ii-ljQm-3U0Yzp4_0aD7gSdH_vhj6Cw_5_qgSroJIX_J9V-Ii6e2ZjtW_KqnxWT4bmrEvOTA0zEI46Uh-qI5F

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2FdIwQXH7enL41JQOXylptDWMwtUoLlaz2hOgHhM6dvMYQgfS%2BpSeeaeiH3ZZPttdVZvBbcXbFVpV6660Zd1GB9Th8egifSrw0a6%2B4cDRx6xOs6HAAZD7kUcKfSwo%2FiauA65labDu%2FM%2BSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEFBOZxsZMfPYY3T_ETkZYlE&google_hm=ZXyfLgBuUMEGpHAFjn-29AAABRQAAAIB&google_nid=index&google_push=AXcoOmSUykH-Xa4ii-ljQm-3U0Yzp4_0aD7gSdH_vhj6Cw_5_qgSroJIX_J9V-Ii6e2ZjtW_KqnxWT4bmrEvOTA0zEI46Uh-qI5F
cache-control: no-cache
cf-ray: 8360da97ab4454b5-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C4E6
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEOSRJ_8Qk7Gj0Sb00fribQ0&google_cver=1&google_push=AXcoOmRa4XB8KBU_12Q03JZ9arhVKKcKuPOEUrBsMQqpkDUWOpbEfGFd71REYfiV6lokrqNrYO4EFM9dW3af1qzDh...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmRa4XB8KBU_12Q03JZ9arhVKKcKuPOEUrBsMQqpkDUWOpbEfGFd71REYfiV6lokrqNrYO4EFM9dW3af1qzDhFaPCwMrIlll&google_hm=H05njPZHz8om_qvaQHqYvv0S

170 B
189 B

47ms
47ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmRa4XB8KBU_12Q03JZ9arhVKKcKuPOEUrBsMQqpkDUWOpbEfGFd71REYfiV6lokrqNrYO4EFM9dW3af1qzDhFaPCwMrIlll&google_hm=H05njPZHz8om_qvaQHqYvv0S

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 15 Dec 2023 18:47:13 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmRa4XB8KBU_12Q03JZ9arhVKKcKuPOEUrBsMQqpkDUWOpbEfGFd71REYfiV6lokrqNrYO4EFM9dW3af1qzDhFaPCwMrIlll&google_hm=H05njPZHz8om_qvaQHqYvv0S
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C4E6
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEIgPXBbbd1RRwr5po0KtPn4&google_cver=1&google_push=AXcoOmRZu7YbRLKv3CKJYn88rIvLBiP20oJkao7X0COHwgIc82xFJ5dANPwAthwVFMKt4KloeDNRni3Qj28-h2XQf...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NzAzZTJmZjEtZjVlZC00NWMzLTgxZjItZDlhODI2MTllODcw&google_push=AXcoOmRZu7YbRLKv3CKJYn88rIvLBiP20oJkao7X0COHwgIc82xFJ5dANPwAthwV...

170 B
195 B

50ms
49ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NzAzZTJmZjEtZjVlZC00NWMzLTgxZjItZDlhODI2MTllODcw&google_push=AXcoOmRZu7YbRLKv3CKJYn88rIvLBiP20oJkao7X0COHwgIc82xFJ5dANPwAthwVFMKt4KloeDNRni3Qj28-h2XQf7nWjdWDHdyqdA

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=NzAzZTJmZjEtZjVlZC00NWMzLTgxZjItZDlhODI2MTllODcw&google_push=AXcoOmRZu7YbRLKv3CKJYn88rIvLBiP20oJkao7X0COHwgIc82xFJ5dANPwAthwVFMKt4KloeDNRni3Qj28-h2XQf7nWjdWDHdyqdA
date: Fri, 15 Dec 2023 18:47:16 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C4E6
Redirect Chain

https://gtrace.mediago.io/ju/cs/google?google_gid=CAESEK5gT_--YdukPzenMlczBdU&google_cver=1&google_push=AXcoOmTTlj_L4DTrBFiPluWR1gUQU_ZpdGZsQa-B3iKYwCetmNHNe6sa_4QbH_ciqik5V5w6PiPyNCvFCs-bsoQLEXYIT...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmTTlj_L4DTrBFiPluWR1gUQU_ZpdGZsQa-B3iKYwCetmNHNe6sa_4QbH_ciqik5V5w6PiPyNCvFCs-bsoQLEXYITOkskA3SHQ&google_hm=f5ef61ca1c5e...

170 B
189 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmTTlj_L4DTrBFiPluWR1gUQU_ZpdGZsQa-B3iKYwCetmNHNe6sa_4QbH_ciqik5V5w6PiPyNCvFCs-bsoQLEXYITOkskA3SHQ&google_hm=f5ef61ca1c5e52e12stycs00lq6ze55u

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:13 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmTTlj_L4DTrBFiPluWR1gUQU_ZpdGZsQa-B3iKYwCetmNHNe6sa_4QbH_ciqik5V5w6PiPyNCvFCs-bsoQLEXYITOkskA3SHQ&google_hm=f5ef61ca1c5e52e12stycs00lq6ze55u
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C4E6
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEGNpKoBXewHW0FIrRGGqVtw&google_cver=1&google_push=AXcoOmTIXxhNzeXY7IGRXyna-BoY88KzZK-6YA8G3mhG1EtPphjBYkRVVSGzU_eAif3...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTIXxhNzeXY7IGRXyna-BoY88KzZK-6YA8G3mhG1EtPphjBYkRVVSGzU_eAif3O70D5nrPGUY32YOyYuEF3U7oIZUcw-FHehw

170 B
189 B

45ms
44ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTIXxhNzeXY7IGRXyna-BoY88KzZK-6YA8G3mhG1EtPphjBYkRVVSGzU_eAif3O70D5nrPGUY32YOyYuEF3U7oIZUcw-FHehw

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 792eb929
date: Fri, 15 Dec 2023 18:47:13 GMT
x-bytefaas-request-id: 202312151847138BF9BB3209FB1BD1C9D1
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2312151847138BF9BB3209FB1BD1C9D1-586F77945FA2292E-00
x-cache: TCP_MISS from a23-209-100-91.deploy.akamaitechnologies.com (AkamaiGHost/11.3.3-52668873) (-)
server-timing: inner; dur=5, cdn-cache; desc=MISS, edge; dur=0, origin; dur=8
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202312151847138BF9BB3209FB1BD1C9D1
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTIXxhNzeXY7IGRXyna-BoY88KzZK-6YA8G3mhG1EtPphjBYkRVVSGzU_eAif3O70D5nrPGUY32YOyYuEF3U7oIZUcw-FHehw
x-bytefaas-execution-duration: 3.85
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 01f6d5656f7931b184b9cd42676ccc501752ffed1c61765b77db62352636db82d9c6d8344dd618b990ef09eef4f30bd38b90d5313f308dd168f3493a11ff8ff2ec94818991690d7f92a4353462221ed3e7a3d521a5932cfe65827b110958d5e8e5
x-origin-response-time: 8,23.209.100.91
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Fri, 15 Dec 2023 18:47:13 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C4E6 0
12 B 47ms
46ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KJ7epAw3DjhmHkqOkZ4NInqgRoEnV9ZtP74E8ymiybGuN9s-MoCZCsYmL-Jq-9z6SLvCxAwBWo

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 6BDD 45 KB
13 KB 37ms
36ms Script
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-setupad&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8209006f69e596bd225d1d307774d3b6123a1279c4353b61b022e14cd3251d4a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-setupad&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15 Dec 2023 09:30:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=53051
Connection: keep-alive
Content-Length: 13169
Expires: Sat, 16 Dec 2023 09:31:24 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E95D 0
0 58ms
57ms Image
text/html 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CLeCjMZ98Za_tB7zbxtYPzce2oAWcge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTczODMxNzE4MzA2MTQyMTbIAQngAgCoAwHIAwKqBLICT9CNTcCaVlNVzxy-s985-v4zRidss9boIZ2v-Mmy1K1ef-FjfAej-0W0aKTEdTBTQzQB8ugq1ef-u3M2k-vHyKyeSuE6kd2ylWYF0yw94hYN_aDzSuGN8l9vOVHI2_Lo7EPPwvFXOuk5YQXz5rTK_enAJ2yNw5cinxzLEg1rvXhMgZRioOMTX00yJ8Bmo6biyDmZlOArYsC3KGBeMf_foYQLY_3tAY11njievvYeHwRxWhzryJfegNlal96KIlHNZgvLQB_-BXKMjfseAvL4Ta8SVaidmxPd6qjbsjKQ_WPNwPtsTwfFDubqgu1qmuusCET4wYhWsR-zlaeKBflhZH8PjoDTSB1r6qom_iyaTq1HCOsuifFJODnFefKM8HGtd7e3qcDGOH7Bbsa6i45lb8sX4AQBgAa06Yut-tiA064BoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiAYRABMgKKAjoEgECAQEi9_cE6WMrAy6CNkoMDgAoD-gsCCAGADAHiDRMI7eXLoI2SgwMVvK3RBB3Now1U0BUBgBcBshccChoSFHB1Yi03MzgzMTcxODMwNjE0MjE2GJXiHw&sigh=-mvZbdugzkM&uach_m=%5BUACH%5D&cid=CAQSPAAvHhf_qBgYbQvIc213vVV4ADdaJK86colymS5rZLBegu5KBlLilfbw8JZwY7Hr8r7qTdnBvsN1I_Ae8hgB&cbvp=2&vis=1
Requested by: Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame E95D 0
125 B 34ms
33ms Image
text/plain 74.119.119.130
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=k-yxGOL_CsoH-gHiIp0XAgAAAHVRNESzDyhl4LMntwk5jtsQMJ98Zesew57Nl2wdFVUAABIAAAoKQVFVQkNnRUJDZw&wp=ZXyfMQAB9q8E0a28AA2jzeNNxRvzCvnNvos4tQ&cbvp=2

Requested by

Host: a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com
URL: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.130 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://a751bc61347071e72831781e715ee04f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 267192
server: Kestrel
content-length: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 2931 2 KB
1 KB 35ms
35ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfLwAAh7IITwr6AAgOri--l8x_rEZqrUyjSg&u=%7CQz6W3wT3zbnLzAY5lXa10cn0IYPub%2BsK30d9sxv0Yzc%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92JnU_9zagUY5e8WyNGK0N8eD1fsGFXj2-TtmuctVpKB_hK47gjvkCKfVxFB59H-PN9ivfW2oFpwG-ptVdc9vhznbcz5XNuTIYpKnL6hUjIZfxzrVa0VDkCbkSm9xEoYtWLgVwNtF9l4ia5w7Tq2T02eIKfM9LhXGXz8f04oElejNf5jkciEvo4a85X8irT9_HF544HOdm3UbXyDHIrCa4BsSDBdsYHk0ICFmaMORnHWyLWBMk3VMST2ugb2w0B5CF9fw2_Zji7T9gwha4mOSy7wb2nisy7pdwyCuSYW37IAozHa_8s4IV12BSN_u6xIIHfVDXxEgbzQFPoJCCCwYrpnkhwkqEKEwDQmwBKBKaAnekwKXP-GOv8bSAMFSipNhLkY89KK_c8pe0RTKCZ05SxDFg8R5yf00SCPeo3UP0qyD7GQnQr_NGpXNflmjMjeSV-n-8s8bBv1ZWfX3VtYlwL5yikaJ67i9ymLcvavCSTHss6nxA0y2yca2rTMa9bZuSMNVn3MTsS7gG6UhERSK5VoDqmrhjhM2dnprWbEAxu4cGiiSxIqZZkE&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC26qlL598ZbKPAvqVvPIPrp2gqAecge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQngAgCoAwHIAwKqBK4CT9BEwolt8V4nwp-F9WjBLq-Smo0fCnFIOPs9weG8LyLpDDHWzLH6EP3PjbIJxQb40StgQbokWeivPwmJCU7i3Zb4-UusRrH7zgugoaMOu4999YHiWHgk5yx0Xis5oLBOTfkoBPtS4Y9duV9sWAQA8TRcyOi8_oY69L8Id0se76UOMcA8hrW_MPAQZAgbUtkWDCc2rF5G1GWdPmxUkEthWcurTWlZClaAtMH1ZDoQZUyvIz5A-tj_Do3rebYZ6peqULD7Z0Xm9GW_HQu0fs8WEYeU-xRb2ENRK_pEw9MnD2ADZah8w9qMRbg22e0OoZmp9-sbdHrMaxIcmf_ddA0L4ocfYkfI4FRUKz7SuhwXlIr8u8RtjWZwbXgy1Rcb_LLFEkdxkX75fIMgHnJ7QR_gBAGABtHu-I3jj6msBaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgGEQATICigI6BIBAgEBIvf3BOlj_1cmfjZKDA_oLAggBgAwB4g0TCOLOyp-NkoMDFfoKTwgdrg4IddAVAYAXAQ%26num%3D1%26sig%3DAOD64_2vwBa-4jx1u6FNVkXHYsx56PRobg%26client%3Dca-pub-9923238532781884%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 2931 2 KB
1 KB 33ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 2931 308 B
636 B 43ms
41ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 2931 293 B
621 B 36ms
35ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 2931 43 B
347 B 106ms
36ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=dDA-TDRhPRW0lcKAHVCCWgWmTiuCeio5F8cd00buRYrtb1VmR43QORkhVDk_KSJZF0PxMl2tifKVEUU-CgHSO-X0PgwY0l-4N7VnsIru4HuzwVt8Kt-ty9G-Hvl9y0JEIBXZKUgwS7LNAEVbALuCjT2mtEJMcHUrtGd5StyGOcdzJ9HCm3ouWbicpHpM4ItlfgDlkKi6nzycAbv-VQm0yt-mK5mer4oD-Vg8ZHfTRHJefyEk77AUKDmlAbI4HgQkfmjBuXmLU0frpO4AN4ji-3xdtBtwSgbOzL3zFDqvcvBFO-axqfLcpEEL2Q5e1B6F571473DJUoq7icqfLVQ_E3pUoOkjq7k8Jme5FiYItaHjxQMB8np-BeEhmdK90cV2A4v5tDRWCxSKIIxM2VBSVdUFIj7NKjTrIpio7nxrZV3fmwuP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3295821
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 2931 18 KB
8 KB 37ms
36ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:28:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1100
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 15 Dec 2023 19:28:53 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame A9F8 2 KB
1 KB 33ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfLwAAh7QITwr6AAgOrvWK2ho-0iiFozkTmQ&u=%7CQz6W3wT3zbk9k8uCw7JrMG5aY6I1LlTnVH7D0X%2BoG2g%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92JnU_9zagUY5e8WyNGK0N8eD1fsGFXj2-edh7eOGOGiuSprOvMxSeF10iU0BuGFprvErR7xsWHr4YqOxrSKB2WVpB7fwxAnrtDqiweBp-pIlW2PVnFjj3EDcCZOSeTf8NVhA0IUsu1Ay67MzzQZWNKp9jIh_oaaXr0OQWY5ocYqbCtIVhBPpQe5aeYLKBqZ753w6bjThj_LPesbFttxoJAkLaDf7dAnp1HLjwnMSq71I3HLzf3QiTUKyekBer5JzNJFqTLUAGAQ9p6gE1lmX40mQhHIlWh6INIXnO3qo7-_JQ7zQKMLc29dDbJn9IXKmF7lj8yfQhEMcbK1XKBt63DCNKjPdJVC_fNYa1wU-JpODD3djlPboz6_zEhcwKstOGHqKAxbrWV4EaenUkdLxhvBlYzwfAbLYrBwlxAS9eLUCT6Z55OGWa4gMT52g_WhJCEd-i90wYe8TSG-P776mGpbcrXeXDjtWGh2GyXKvmMzCn9BJwCytATJGZ9BaeIG-vEJ0zZV2oLHfdMiBZ1zzHCi3y3Y7JMvp8REBzHythJUlBTvS5TgKAso&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCYCOZL598ZbSPAvqVvPIPrp2gqAecge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQngAgCoAwHIAwKqBLYCT9A9EixpBu8GRD27a3qEBfH-kW7Pa8BU7s-jmA_hdB-5L-yg5mJ8_2nfTcFVL9HjvddW8BhQqvN0ZGt3Vnv51SP4X4yRsCo0nYEPLAxS-OeR5Fd_H9fQksKj1x5b6T9w9Fb-4DYOxRE8XV7YivR_afUMqyA_CWR5WBIFtgW5uS_DNP3vO6H6kqrnkfYkytqx2zbU1dpvwdK5AictCu1W4FRt8Vt99vNbQ-r_rlo0BmGJvYnRwa97Oj5EItWD7vhK2JDDzGjL4KY6jL5seyKRp_8alBbxGgKqryeCJuHj20QRFcRqIfcBs_YbzIEnhrvkWzB10rbchlURGllb4SiWz2W9qH5uoxMzhxxVufcSkg6dHraYXB3cqg8aQXXA_RRcuZLt8CrWMmx7obZgPkFieNWceyKaC-AEAYAG0e74jeOPqawFoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiAYRABMgKKAjoEgECAQEi9_cE6WP_VyZ-NkoMD-gsCCAGADAHiDRMI5c7Kn42SgwMV-gpPCB2uDgh10BUBgBcB%26num%3D1%26sig%3DAOD64_2H7-cumn1AO2kAhZv0DZnN5iXgqg%26client%3Dca-pub-9923238532781884%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame A9F8 2 KB
1 KB 34ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame A9F8 308 B
636 B 35ms
34ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame A9F8 293 B
621 B 34ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 09 Dec 2024 18:47:13 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame A9F8 43 B
348 B 90ms
35ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=ANItuTRhPRW0lcKAHVCCWgWmTit185tDk1KsAMSc1wkdS6xRdmgXbk7kloHwEiLQrUhC0sBzgB9tjWDxnqEHKZCmoB4OK_0bl_Qll3LaPgaEPggJNfDBGdJEfyBgBTNgOEVRvvqkQekt0-k6xouneTuN9d-vELVK7itdPyrSNQBOzBaCXbrZ4-1P8NceydFyYGs36OyuCpbMlv-FFJlWdJDvS4N_Xn74q_KCDbBrILpAFRoyYIUTq5bdBR-UOd39qrvLFunLfnL8tWHNU9hrwBctaz7CMVB4x8t0p7i-KrU3IeILkrssNZ8I4zHSDfuHeKFWNZOxaXPZyTjEqvzWuxb76uhpyYxWMkZGxWyrZN1RyqI-5yRdrmmmLqpKmfwWbK2LqPIJCkS7H0wJ-Ix42uQRNNiDmF56TEscfOXGVze8K5Lp

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1837393
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame A9F8 18 KB
8 KB 37ms
36ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:28:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1100
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 15 Dec 2023 19:28:53 GMT

GET

generic
match.adsrvr.org/track/cmf/ Frame 20A6
Redirect Chain

https://id5-sync.com/i/481/8.gif?id5id=ID5*-0Q5NuICZ8Xt0rh43rc3kfS2Cx_382Jwd_5r2bEJeC91L-ueLtG3wnGVSBiBRfZfdTAK8tyH6XltcRMFjbCP9w&o=api&gdpr_consent=undefined&gdpr=false
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F429%2F7%2F2.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/481/429/7/2.gif?puid=2C7AB182-9863-4FFF-B278-E03B1388369C&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=45905e27-008c-4916-bdda-4ccdb7efc911&ttl=%%TTL%%
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gd...
https://id5-sync.com/c/481/108/5/4.gif?puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F441%2F4%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/481/441/4/5.gif?puid=u_73056dc2-e8df-42c7-aef5-b50e7926e562&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/481/2/3/6.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/481/2/3/6.gif?puid=5638150801812241363&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F112%2F2%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F112%2F2%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/481/112/2/7.gif?puid=12CB073A5BD12139&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F481%2F434%2F1%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/481/434/1/8.gif?puid=b3786afc-c6d9-4961-b1c3-da11bd202aa8&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=MTJDQjA3M0E1QkQxMjEzOQ%3D%3D&gdpr=0&gdpr_consent=&id5=ID5-6581_ZtfSiczt0tujsunJNNVo8VQrGovnlx0UlIAgg
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEDvtqzT3To82sSRzdwcMpJ4&sInitiator=internal&google_cver=1&gdpr=0&gdpr_consent=&id5=ID5-6581_ZtfSiczt0tujsunJNNVo8VQrGovnlx0UlIAgg&...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8

0
0

GET
H3 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 2931 59 KB
23 KB 36ms
36ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:27:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141558
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 13 Dec 2024 03:27:56 GMT

GET
H3 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame A9F8 59 KB
23 KB 36ms
35ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:27:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141558
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 13 Dec 2024 03:27:56 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 2B23 2 KB
1 KB 52ms
52ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfLwAORToF_eE-AAQ16BeqeHmWfFJAqpheVQ&u=%7C9QHVuHg3G3ymXLAwC239yHoTX94oL1OKSYGmwUiAbkI%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC780SdfuP4sG0R_tRwZ3ha5ZXtGwcc0zmrusvu8bfKQbYhNvXgU_9hRQyX-tOCFr0hslcM6sx7mIgRbnKZeRIlbSbPm4fD-hPjTyzW_xxooaYlNLDdXiHhZkThF8OSvzY-xiy1ioANm3LKGtQ0Oz7HmTzADGeAjDswjYlEHYJOcRMV7PSoh4bvlYw_MwzAbtt72zJ0ek-KcO0hX36a3lxOpZQ5fnj1WzPTdBkAyqOLe8V78aZh0M3uxO7MXjdQGuxrm-KaaH5dGIUoW_vU8-c-toLB_3eB1w6lQ-cOdTrf69DFeWS7QyhtYfm2oJ-lf8H_mkjO5BB6VoE_NEoP5VzYmH2JWXLwLo7jMQaJfX3H0LAwWgXOe263DRhGJ0mLWuSDBt-DZSB2tvUQcNxiiEXCC3vHHxOxnAF2hproqgl-zJz0RdRdigBTavkaeouO1pHvW-cUgO1yuHNTBx9u85I-qrYXZojIL5x-W2M7UF7pDQBB0XTD6lN8hyziDaVyzJzIYD4eP0GqfW9aoD-urLigDOGhSZgLWLz1pF706K1GlNlK0c5G4tgrbEEaXh7DXr28f&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJxcrL598ZbqKOb7C998P6OuQoAycge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTk5MjMyMzg1MzI3ODE4ODTIAQmoAwHIAwKqBOwBT9BEbJ85lwhJKy689HEYk_Sazh2XOMwilQE6VA4wogvw3-LPQFAv_0B3d_e_5-PCFXx_lYYPmCXt51jgVE4RbkfiqTYqGMpzjKbmBGJcYi7mtJ9Dv9s4jFO9aterdCG3rHgTr8pz2o36PTIS64LJXaeG_MUiyVCAb8Gp0_yIIYCIllS3KSC_acJB20xG2LoaOsXYjaXUgmDNTCGqKP6XVC32jERyfyb1o5-4xabwXoDGNgVwkq5iNXfTbmlb0DkII1S46uKR8pd1d4vhv9R_b5LVBddyBuTc23-0ighYtzCh5K8l7nbb-HCSB9uABrTpi6362IDTrgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIBhEAEyAooCOgSAQIBASL39wTpYktyCoI2SgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0E_v19Km7jmuFhXGzdYZj933Bn8g%26client%3Dca-pub-9923238532781884%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 2B23 2 KB
1 KB 33ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 2B23 308 B
636 B 37ms
36ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 2B23 293 B
621 B 34ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 2B23 43 B
347 B 37ms
37ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=l3xLXjcFXalPLVSgTUiElKe4oVlzKyWlLSbeR9Dy2Ss2Q641J8JDFr92dUnevH_AEVs5HzMPQ35f_9eK8Kt-0R1f1pHo4MB6rqY4MUsVlbPn_DJMex_FaXPCUz9qquRmUMIlzMGbyEQfMSOeZm9WVmwS1tjjfaU4TtJQv1hyiQ2-pP6bco9e8ubhp4p6tlJlhdks5em_sshygN2EeUhwj3ZJ6Xlqa85xSCfVXJeqWRb-R5eqi0npHhUhsY9n7Edh4HZV2egJGk0TCpYyAYDpK5Fb0EBZzwQOk6OVfKc4k2LM5nehTBgOtLSrRtdXZLmw-POL9kYzdPN6jysbnIeM0hqCCM7GqJ5HTalGyPYKmiQYocsKAoW3hgVakXSaiGUZyOnUQxmu77JnYFFJJBx1T7fwFa6cuX3rkh3ngdDIWHQ6lxZ_

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3452412
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 2B23 12 KB
6 KB 35ms
35ms Script
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
5 KB 3202ms
100ms Image
image/png 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=176&m=0&partner=78881&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F78881%2F230302%2F5ef0d2a6752244c392ec13506d8608f9_mk_logo_1800_black_%282%29.png&v=3&w=256&rid=4&s=9W_UPM4UElwgKIlYdb3vzMDv

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

babd8650a8cadcc75647b57b58e1ef1c695d8b12c68ea9bff01efe0952864cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4726
expires: Tue, 03 Dec 2024 02:17:35 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 10 KB
10 KB 3152ms
51ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35H3S4ML3I-0410_IS%3F%24productMain%24&v=3&w=400&rid=4&s=8XjwS33CVB-Ir01tD79ceVop&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c091ade709536f2d388d8c5035bfdcfdcf28134841241059080826286da5a57a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 10510
expires: Mon, 18 Nov 2024 18:28:00 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 12 KB
12 KB 3169ms
68ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35H3G4ML3I-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=Ix1gchvyHdoVZK5twUw2Q5I8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

146a9bbee8f833fceb2cc48feadf8fa278ae3ca908262652627006649ad120c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12130
expires: Thu, 07 Nov 2024 18:39:23 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 15 KB
15 KB 3200ms
100ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S1GTTC7L-2727_IS%3F%24productMain%24&v=3&w=400&rid=4&s=_jI8PvjehlKOOdk5aZbA29TI&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbfb42bbd959835533d239ef19310619a117d5a095541ba3f27aac66a2338b95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15112
expires: Wed, 06 Nov 2024 18:28:29 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 9 KB
9 KB 3172ms
72ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF320CP3X6-1211_IS%3F%24productMain%24&v=3&w=400&rid=4&s=mq1VyFPp3jHzze0aOv9LMRzM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

11922ffe5aab54bdba73ad8871610c6d0fececd907f10e13488e2218fb49923b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8796
expires: Sun, 03 Nov 2024 00:26:37 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 8 KB
9 KB 3179ms
79ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F49S0POFS2B-1717_IS%3F%24productMain%24&v=3&w=400&rid=4&s=6rz_Fxny5riIiKkmZN-J4HHf&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b3cbd7af67c3bed2a60eb4c082690a67c565f4d79e759fa742bd24c8f13079ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8680
expires: Thu, 07 Nov 2024 13:03:42 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 13 KB
13 KB 50ms
46ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S0GTVU6L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=0O9lSdVGPEHy2Hz8MkNfC71H&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d741d8096212c810a0bc4bb29d346e1935876b4e732cd673f62f422dcbbcb820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 13410
expires: Sun, 10 Nov 2024 12:38:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 7 KB
7 KB 49ms
46ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF320B23SB-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=coPU9lNHBkJA7olZSLfVizP5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

522c4bcc0a0fc0669b180faeed7968249a69a42786ae17afd16c44ee21e9b2d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7172
expires: Fri, 22 Nov 2024 02:51:44 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
6 KB 50ms
47ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T0STVL9L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=20gctjrhqnxLZprUXiqxJpOK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

975a84ca7d8d45e7dd62e2594d16f9f85e3ea5dec02b15284607e2672f1c725c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 5466
expires: Sun, 03 Nov 2024 00:42:08 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 11 KB
12 KB 50ms
47ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35R3GTTN5L-2610_IS%3F%24productMain%24&v=3&w=400&rid=4&s=jdEYiEU8Bl4_cmvZ-WcMqdQZ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e141fe2cbc31c3ab7bbbe688a6c0f400d9ce7bc8e582101cedddc436600ac710

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 11572
expires: Sat, 16 Nov 2024 18:54:58 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
5 KB 51ms
49ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F40F3NRFP1M-0705_IS%3F%24productMain%24&v=3&w=400&rid=4&s=tq_ELC8ZsvQSR6hfQFgMicsC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4bd934731476db33a22e41f5231fcedbbc1bbea15e98d2850bea0edf20967b38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4780
expires: Sat, 16 Nov 2024 03:09:20 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 23 KB
23 KB 52ms
49ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35F1GTVC2B-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=H8LsZDQYQzVtIZaSeZoW9hU9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f68feb7d2c422985b076933dc911e2733619224811e676fa7814cebbeb2d551a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 23254
expires: Tue, 19 Nov 2024 09:16:52 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 7 KB
7 KB 56ms
54ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F30F3G6LL1L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=6vtf9GjeieTk9V25oBsTfRo-&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f3c54aa7d215fcd207dd3b51711cdad400c5a3f692bf74430a42538d34559450

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 6714
expires: Sat, 09 Nov 2024 00:08:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 7 KB
7 KB 64ms
62ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F43F7SKFE5D-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=qRWxS0QeZbx9kQnILOtAFfgk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e698d29e537e67f92d8cf8565c382c607686f75a5a53cdd09675571287dcb51f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7322
expires: Thu, 28 Nov 2024 00:49:16 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 12 KB
12 KB 60ms
58ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T0GTVT3V-0150_IS%3F%24productMain%24&v=3&w=400&rid=4&s=MsuQfAWlEM8SnsFqT4G7TevT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5ec0ee7217c892fbda0e022df902fcbaa3d7c75b520eacba4bf35d2fffe3ebd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12504
expires: Sat, 30 Nov 2024 03:34:12 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 16 KB
16 KB 57ms
55ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S3G5GS5B-0200_IS%3F%24productMain%24&v=3&w=400&rid=4&s=KGqZrwtcc_LVKNyWTNGALvfE&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f46d9dd6abd9f05c4124b0b443e4bfedb4bcdd61cc60af814227cd904fcc0a94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15934
expires: Thu, 07 Nov 2024 02:35:05 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 8 KB
8 KB 59ms
57ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T9GTVT0L-6487_IS%3F%24productMain%24&v=3&w=400&rid=4&s=ZHHKxcxOdeHh-54srrrWJ91p&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fb99eff8eb3c2a1988444b9973ab465919eb71cdd1f3bbc955efc67766bfe4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7824
expires: Wed, 06 Nov 2024 05:54:58 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 4 KB
4 KB 56ms
54ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T6GTVE3L-7278_IS%3F%24productMain%24&v=3&w=400&rid=4&s=ay_sRZxNk5CLLAWivAgUqGb1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8587d0a809d63c84caf52ba2cc35d4786b4e4e30bc0b3387f615be1245fff036

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 3846
expires: Tue, 26 Nov 2024 01:27:50 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
6 KB 61ms
59ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35F0GTVT9L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=wgarpN4PJlOcOwBqgRiP2Um_&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

6de1bee6a82f761cea041a8d6e03e35ecebe493a804db8114ffaf6f988cbc76f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 5630
expires: Wed, 13 Nov 2024 02:24:50 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 2B23 0
127 B 1116ms
35ms Ping
text/plain 74.119.119.149
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=NbwI9MMhtBx30VKqvFFbq4cufvD-a17LMritGiuYNiZQDZmeB3U5jXe1xEKea0l0l7qHfgloH9s8w3jpb8-H8iL1nK28I9aW_9k-cBfvxI9vbf_kOxS8w8TBWPQuvNKRAVnbHTFZm-y-Dmi8BQzMp7wghlUMPfVfZ08OJaMrgfYdPu9ye1o848OUZ4Rss9ttBvAlgrRNMcegqyRhSqB5FJ-w4B4JBrfzRonSE9zbqayeLgBp5HaIZQMNbii9GByMlqQwizX180_I-zKY&sds=2&rev=89791&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.149 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 2B23 2 KB
1 KB 36ms
36ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 2B23 2 KB
1 KB 41ms
41ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 421C 2 KB
1 KB 33ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZXyfMQAB9q8E0a28AA2jzeNNxRvzCvnNvos4tQ&u=%7CZGo0cvxfv0AbQlt6kD10ua%2BfJkQzKS7CYfZn2Evjhug%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MTceYYGR9Jp5gwJSFuY1ZhNKFHqRIa1v5YAS4crvdxYSIhqm1U-LkG9HI4_Unhv5sD-zij4WMVTNgK11zAC-NSQvvPEALqU6euZTYqFAtTE9btXcGcU9pgyPERb93Qh4rfTbg6lS0NxdKZCv-fGRzCKt2UkDdON1yB6ue6mMGwkO8EpFKJnGj9B-d9AUIViiZRR_aPX008EzOwzw_Np2XU_PqD8EskhwVkGvftaUo4HMyGt-6QkYnjepTdU7NoRZX-mWDUmj74USCpVjAIB9JBezdwAn63XyE3Q4Cs9NL_Ux1o8JYreqlUTyGd4WUq4mNpKCFCP6xprYcG3BJr4bAfsigIbEURHNtuo6LAUvXp2QgFYALtcfce-FbLKoDMc8oZdgtNP_--wnndWcDN23oRNVNzutWi2NXIIFaXvkC1Pwac3FMDLpN2rqp_L_-MVP3AUl7xJiZ2ZIAz6c1B0HiLKvv0AHAK3LKJInOBu0DtpErk9K3tLf_7WmURU_RvehF7_6oqZLA5XL-TwdtWAjoDU6_mAtmDOq7dmgLqkZOCghoOLILt5CuFNoUHOLxkhGqLU6N4fEzOG6C67g4Ghdr-I&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCP_aAMZ98Za_tB7zbxtYPzce2oAWcge-wXKLKp6p0wI23ARABIABg_aiNgegDggEXY2EtcHViLTczODMxNzE4MzA2MTQyMTbIAQngAgCoAwHIAwKqBLUCT9CNTcCaVlNVzxy-s985-v4zRidss9boIZ2v-Mmy1K1ef-FjfAej-0W0aKTEdTBTQzQB8ugq1ef-u3M2k-vHyKyeSuE6kd2ylWYF0yw94hYN_aDzSuGN8l9vOVHI2_Lo7EPPwvFXOuk5YQXz5rTK_enAJ2yNw5cinxzLEg1rvXhMgZRioOMTX00yJ8Bmo6biyDmZlOArYsC3KGBeMf_foYQLY_3tAY11njievvYeHwRxWhzryJfegNlal96KIlHNZgvLQB_-BXKMjfseAvL4Ta8SVaidmxPd6qjbsjKQ_WPNwPtsTwfFDubqgu1qmuusCET4wYhWsR-zlaeKBflhZH8PjoDTSB1r6qom_izYTI3VzlbF83iiB-1JQBUoQX6FfpmvbVs1QvcI0NiWkw-h-_LwiMlg4AQBgAa06Yut-tiA064BoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHQiAYRABMgKKAjoEgECAQEi9_cE6WMrAy6CNkoMD-gsCCAGADAHiDRMI7eXLoI2SgwMVvK3RBB3Now1U0BUBgBcB%26num%3D1%26sig%3DAOD64_0v2cp2Ub8qmKJu5tWOr90Z9SbufA%26client%3Dca-pub-7383171830614216%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 421C 2 KB
1 KB 38ms
38ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 421C 308 B
636 B 36ms
35ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 421C 293 B
621 B 34ms
33ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 421C 43 B
347 B 37ms
37ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=mmgeqogInfsWXFalOWfF39aMdMMja28Iu1h0mN8NYnMjfJUX_wvkL5gAwT2EkbAlADnZXOfLJT0daWb_Sxr__-1CbG0DahDiOmqsDpBDDdtNU-Gvtcsfgu711FmdLehzis4hBAXrPldF2lHzyFEbL1oHu7RI8rbEvOXDvjvBIRYXTu74eJqPvnEh_AHoA1nZpxqAf0Y83arXFwJNnDfYNwK69Dm6cnwtS4wfYhp1SumOHth6bOWi850J-N5iexglJdWX8wnfdsJqIiK6N9t0qe_FnCtBrtibiyzM6e9VIjwyZaCgan2PQDUQMJlc7tlTE-PECzMMofAu-pBiWTp56bFuHjA7oy2MtJtspWM_JK38RX8MA3ZzH-tD37_6ZXdWZljYlQESUFyVSegtNoMMg4o4ctlltbfhUF9mQ7ELEMuGT1Gl

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:13 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3692078
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 B30948992.381133799;dc_ver=99.292;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;dc_adk=155289791;ord=hu151f;click=https%3A%2F%2Fcat.va.us.criteo.com%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3D0aV1VTRhPRW0lcK... Show response
ad.doubleclick.net/ddm/adi/N1100837.154378CRITEO/ Frame 8722 66 KB
30 KB 408ms
80ms Document
text/html 142.251.16.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1100837.154378CRITEO/B30948992.381133799;dc_ver=99.292;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;dc_adk=155289791;ord=hu151f;click=https%3A%2F%2Fcat.va.us.criteo.com%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3D0aV1VTRhPRW0lcKAHVCCWgWmTiuCeio5F8cd00buRYrtb1VmR43QORkhVDk_KSJZF0PxMl2tifKVEUU-CgHSO-X0PgwY0l-4N7VnsIru4HuzwVt8Kt-ty9G-Hvl9y0JEIBXZKUgwS7LNAEVbALuCjT2mtEKhszYUtXdwr4XO5VTvZbC6LQcecKTQJFt3r1CerLrQh5pFE1Mk1L7W-gVqWOcqir6Jg4ZkweRW8Qb-ps1SDWqIG5TqN8q-Xmi61O8fqTeEc5HEOU_FRyXzGlddlstQoLswSI8qz1vvNseAcFMhC3e3foAIrBZIBFikBbKVYjE7U2t3LaGS-b4It8JFEFcwU8isjYdVgsuCoIFiXyg-c5x975Bft9oQnUyQcU9F7k1aSnLudM9uNPCdJjD8jFQCfxMV2yUOkL0nfKYyEsmwUjwQ%26maxdest%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fexpress.ba$2,https%3A%2F%2Fb02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=QSNMNvfhL0;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=96;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

cafe /

Resource Hash

8d4eefc89db0e74fc722f3000a06d2a7466832518118acc13e10472aed0d5a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ads.us.criteo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 30620
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 421C 12 KB
6 KB 38ms
38ms Script
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 B30948992.381133799;dc_ver=99.292;dc_eid=40004000;sz=728x90;u_sd=1;gdpr=0;dc_adk=435816778;ord=uhv211;click=https%3A%2F%2Fcat.va.us.criteo.com%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3DtBk48TRhPRW0lcK... Show response
ad.doubleclick.net/ddm/adi/N1100837.154378CRITEO/ Frame D378 66 KB
30 KB 401ms
102ms Document
text/html 142.251.16.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1100837.154378CRITEO/B30948992.381133799;dc_ver=99.292;dc_eid=40004000;sz=728x90;u_sd=1;gdpr=0;dc_adk=435816778;ord=uhv211;click=https%3A%2F%2Fcat.va.us.criteo.com%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3DtBk48TRhPRW0lcKAHVCCWgWmTit185tDk1KsAMSc1wkdS6xRdmgXbk7kloHwEiLQrUhC0sBzgB9tjWDxnqEHKZCmoB4OK_0bl_Qll3LaPgaEPggJNfDBGdJEfyBgBTNgOEVRvvqkQekt0-k6xouneTuN9d90kI81VpkfOVFZ5Hha4CYNYKJVSc86S2qNSk2Un9Wp_CX97jr4hQixZzlNF4UMA1PQyna8uSBQiILyI2qSj8EgO-GNoQt_P8_qAZYcoovhtnCgQ78K07Pc7y5QdUgv61Es9W4Le400dkpqh55-F1RKBcH2p9w_yqldNxH9rdwPwVyWlnK0wetWhvGjMFaRrnUVl9-W6JdopTHgx0wD84fzLvxfsXgMOaSsOXmrwroxcH3REhvMPHqt0EALE7XCHuzRU0vDPuS1Tr4WwAo3wyXH%26maxdest%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fexpress.ba$2,https%3A%2F%2Fb02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=QSNMNvfhL0;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=118;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f149.1e100.net

Software

cafe /

Resource Hash

23da2fae8be18f9b05f54df78df4956c0e3c9edace510984d5fb19f958334daa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ads.us.criteo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 30687
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 7 KB
7 KB 3064ms
67ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F43F7SKFE5D-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=qRWxS0QeZbx9kQnILOtAFfgk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e698d29e537e67f92d8cf8565c382c607686f75a5a53cdd09675571287dcb51f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7322
expires: Thu, 28 Nov 2024 00:49:16 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 12 KB
12 KB 3078ms
81ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35H3G4ML3I-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=Ix1gchvyHdoVZK5twUw2Q5I8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

146a9bbee8f833fceb2cc48feadf8fa278ae3ca908262652627006649ad120c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12130
expires: Thu, 07 Nov 2024 18:39:23 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 15 KB
15 KB 3074ms
78ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S1GTTC7L-2727_IS%3F%24productMain%24&v=3&w=400&rid=4&s=_jI8PvjehlKOOdk5aZbA29TI&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbfb42bbd959835533d239ef19310619a117d5a095541ba3f27aac66a2338b95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15112
expires: Wed, 06 Nov 2024 18:28:29 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 5 KB
5 KB 3082ms
86ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F40F3NRFP1M-0705_IS%3F%24productMain%24&v=3&w=400&rid=4&s=tq_ELC8ZsvQSR6hfQFgMicsC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4bd934731476db33a22e41f5231fcedbbc1bbea15e98d2850bea0edf20967b38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4780
expires: Sat, 16 Nov 2024 03:09:20 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 9 KB
9 KB 3086ms
90ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF320CP3X6-1211_IS%3F%24productMain%24&v=3&w=400&rid=4&s=mq1VyFPp3jHzze0aOv9LMRzM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

11922ffe5aab54bdba73ad8871610c6d0fececd907f10e13488e2218fb49923b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8796
expires: Sun, 03 Nov 2024 00:26:37 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 16 KB
16 KB 3085ms
90ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S3G5GS5B-0200_IS%3F%24productMain%24&v=3&w=400&rid=4&s=KGqZrwtcc_LVKNyWTNGALvfE&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f46d9dd6abd9f05c4124b0b443e4bfedb4bcdd61cc60af814227cd904fcc0a94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15934
expires: Thu, 07 Nov 2024 02:35:05 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 23 KB
23 KB 50ms
49ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35F1GTVC2B-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=H8LsZDQYQzVtIZaSeZoW9hU9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f68feb7d2c422985b076933dc911e2733619224811e676fa7814cebbeb2d551a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 23254
expires: Tue, 19 Nov 2024 09:16:52 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 13 KB
13 KB 49ms
48ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S0GTVU6L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=0O9lSdVGPEHy2Hz8MkNfC71H&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d741d8096212c810a0bc4bb29d346e1935876b4e732cd673f62f422dcbbcb820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 13410
expires: Sun, 10 Nov 2024 12:38:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 7 KB
7 KB 48ms
47ms Image
image/png 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=496&m=0&partner=78881&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F78881%2F230302%2F5ef0d2a6752244c392ec13506d8608f9_mk_logo_1800_black_%282%29.png&v=3&w=356&rid=4&s=m7uck0IoF5a8DjKwGDmhkxMM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

49de2f52b6108cbfe2bc5941f3c022ccefc0441db507dce1ab3f22dc232a7d73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7176
expires: Tue, 03 Dec 2024 02:17:35 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 8 KB
8 KB 47ms
46ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F30H3SUSL6L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=iuxZttseBBAl_AF2bBgpLXO2&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

712aa9e4985b6621cd976b0b1a350e254ef08c073b9b0482ac0e85d0b91cc0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7872
expires: Sat, 30 Nov 2024 02:29:40 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 12 KB
12 KB 49ms
48ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F40H3RWFE6D-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=_4inuAy-ppuNfz-qCYncYjYd&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f65e02828b97a4eeca0158c111dc6248f1cfcf4c63e401a458e9542006cac349

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12396
expires: Thu, 21 Nov 2024 05:13:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 22 KB
23 KB 53ms
52ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F30F3GIMM1H-0005_IS%3F%24productMain%24&v=3&w=400&rid=4&s=ayv2N5j9yp2d3mF3GTrMqj1M&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1619c1b217e49982ddf7561b7a3dae46808ee435fa323aed321b02b00105391d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 22996
expires: Thu, 07 Nov 2024 03:39:31 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 8 KB
9 KB 52ms
51ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF330I4AR3-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=R8eI7gfg1ObDBhrbBBNkI8Vt&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

edaf499c564f453ea4161cf202d4cd2374552dca1880feca8eb0ae21dd51b839

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8690
expires: Fri, 08 Nov 2024 01:32:20 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 421C 0
127 B 1011ms
34ms Ping
text/plain 74.119.119.149
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=gdRcksMhtBx30VKqT-F-2Ds48nNfPzY6aPa0Uav8OwpQ4l5Z2nfxYHfuC_SXJugPLyzxeCwxpQPjpg3aSiDVKNJWnu-0layeSUBrBm_o7S-9CKOin6E4dJurLwPb_PK9JkxuAxyQ5u4DvzB4tqg0e4iXNsYTH9zWpNWzNSYaGu63GA0YRueFJq79eyV-TdSBRI3TcdRJwbQ3Az2YY_o0lNP17pmWnv8fgIZ3rMIQm8efYCUuye5HmCun5mfdMl2QQALgjQ&sds=2&rev=89791&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.149 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 421C 2 KB
1 KB 44ms
44ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 421C 2 KB
1 KB 51ms
50ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 2931 0
127 B 1005ms
35ms Ping
text/plain 74.119.119.149
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=6ZBisMMhtBx30VKq3l4uOBsp0R8pO26-2o1HAOA-neuas5mO6dpwOg1mES16v6gvu6L8xJw1z73lPao4udn-ZFzKsdc6bKOpftxsbLwcX_m81cyurZbJD9_yZ8y3I4f7Zd8VaxbKDkizCl4pjP7olugxSZVVfd-GigVvdgRr01p0lHj8xEuCkepn-2VGYFyVPzrZFC5zQc2SxgvRcuh77nSzopSUb9D9oigH3Vj-n2YPQ-HiJDGMkJWM4I3vCkrnXMrayPlkXIyPuWiQ&sds=2&rev=89791&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.149 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 2931 2 KB
1 KB 35ms
35ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 2931 2 KB
1 KB 50ms
50ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame A9F8 0
128 B 991ms
34ms Ping
text/plain 74.119.119.149
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=W6-GFsMhtBx30VKqzlpwylwJR4mRU0aW1YAtl48gL9MdrrwRgzOb7vKDzf2Zt6ol4K6VFPO8kmgSMW-FKcVp2pY1quLC6pOTV2xUhHMqnmw9R_6Ie2rFfIZjJYoTwzy2MXq-0Vi6ZKj7Pkmjvaw0eQ6zlwI0zVRSykdl3X3U8Ojk-641KHWcauqulKMPrUMDcWZrRZo2QFuzDBFOSdc82-Ozji6ARrvPl5AQro2WfDee1TsGMUfBsABglIkvjZe6fMabSxbsgFqiszaa&sds=2&rev=89791&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.149 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 15 Dec 2023 18:47:14 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame A9F8 2 KB
1 KB 41ms
41ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame A9F8 2 KB
1 KB 39ms
39ms Image
image/svg+xml 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 09 Dec 2024 18:47:14 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D968 0
0 56ms
55ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvKtTH3RB8YfpCuCD-DqsR2IhXYkD7vA_5KzfFqh46x3e8xy0w1bQGn8KWST39-SmtMvuYXtwnKIrK4-fMYr2fn2YsQVtEla8Pr8D4UzsMLv8RzlJj7lFUMO8hUzlXTWLDjAe5msnYjAajo0VodI4_LF2a4NcHHSCz4HzcYIVzCGhwJg4a9rvRHk_GvXIKAk-hpUgiy8O0DGOEo5EVPCtlvbFwb-lB9UXtbmNQW1Q8LFzFvNzddhPxDGbmlCL_H-PI88bKUAptuE_asjF4t9WA-F40tvHPs0oZAd-w8W8PLQLPsCYoHKTu920df1YLgoAR9J87yVZYL9HmDxJFYfmANDvv-hNzVrvA4HyGl444cqfX-IkZy2U88MFDCPtFVlv2DXcd_B-CXA3rrls_pSmxKfJ50gc__zheTwoq4QqMPa5u8rBfiCzGZPQj-HrT9xKkX-sJqJg&sai=AMfl-YRMc6qlsrin7AcsW0JGP7byt30P3XsIEAtEHDevzkdGj8S65A9X3DHVsHYNEovjeuAnlhgNa8EqJwJLAbAkHUVgNTNKPThDJz5K4aIz5G1uwTlr84HZs3pkAEQPwd0&sig=Cg0ArKJSzBIpA3cIFnBwEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D968 3 KB
1 KB 36ms
36ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 03:08:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56354
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 03:08:00 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D968 203 KB
64 KB 65ms
64ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:14 GMT

GET
H3 200 738365052977887967
tpc.googlesyndication.com/simgad/ Frame D968 101 KB
101 KB 37ms
36ms Image
image/png 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/738365052977887967

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fccdeefc0598e41074a1df84791fc4b819bf09b3f7a98d5945ec3390ce3519a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 14 Dec 2024 18:28:58 GMT
date: Fri, 15 Dec 2023 18:28:58 GMT
x-content-type-options: nosniff
age: 1096
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103076
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 09:51:13 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 204 l
www.google.com/ads/measurement/ Frame D968 0
0 51ms
50ms Image
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQd3kDMkLnUslALmqh-JCqIkMrUyQeqchIAxwVToXoEliCyYHHMUiOB63h6wZ3aI385Swl7J7BCBRP6x7vazq1AgsompA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

POST
H2 200 node.php Show response
node.setupad.com/node/ Frame C5CD 0
241 B 7495ms
130ms XHR
text/html 159.89.25.223

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:21 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: X-Requested-With

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ Frame 20A6 229 KB
66 KB 46ms
46ms Script
application/javascript 104.67.206.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.67.206.143 Marietta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-67-206-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
server: Apache
etag: "394d0-60864a57eaadc-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 67550
expires: Fri, 15 Dec 2023 19:02:14 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D968 0
0 53ms
53ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuG6Cjl8LBn2qo3a3HcziQ5_JKJGprqoVdB_KHEKwcyPJE0ezuBrr2fg12ZkRVBFxrMeyL7e9hG08GeovwHN2BNQtE8u8pedWNR0d6IoedXjqyo-hjozjizEv3VDiunzunCg7VM32st8A_0aPT83My6Yo1wuxkIDdTtVUKMYptsHDJPYlgYChiaHCsOSEcU46HFi6v3lDKH1ug1su-CCmRbmAwG3a1piibuq2koS3oMRtS3Sf7Qua7UPxgEFYJXv16l8JlS1UrDEMu6oKozp1sCZVsXVleLIrf_pZ6uC7-cXeWijIPzWrGupiR_gObshP9p7hcj0KN491IkRoymy4Ewm2sly3HXrw8icD8fJb2gl9uh31HYL13bqUBb8mO4R0iag_7foI0E2DPiQJlk&sai=AMfl-YT29XGHTdw97LCQmDt_OfRtMA-ySTF-lNs2O2ED91hQrEFO5xxipfiJEuW8OdQKB3OncUGufz5G3_uHgRpmM7R8-dI20HPETyuWHqqr7oWozrSnNbvUxWzjgXpMXhE&sig=Cg0ArKJSzByUwi6KTJTBEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:14 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 6BDD 7 B
777 B 37ms
37ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=LQ6ZE5RC-Q-8P8X
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
Expires: 0

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 6BDD
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=pbs-setupad&khaos=LQ6ZE5RC-Q-8P8X
https://prebid-stag.setupad.net/setuid?bidder=rubicon&uid=LQ6ZE5RC-Q-8P8X

86 B
555 B

132ms
131ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=rubicon&uid=LQ6ZE5RC-Q-8P8X
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VkJpMkugVy%2FujifEsGmHhim4h%2FaAeuLW8uXHmPmGusJdL422wggtzPQDLXBtwakw9XXcXkW1cZ5Xl12S3wNWL4bTtr%2FLz0ZY0UASJXCDl%2BATahhGFiR9n8q0XG9jtgl0cOrg5whks9WJ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
cf-ray: 8360da9e5bed39fa-YYZ
content-length: 86
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid-stag.setupad.net/setuid?bidder=rubicon&uid=LQ6ZE5RC-Q-8P8X
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 2eb7d209ab67664d6226c75331547ba1
Expires: 0

GET
H2 200 7340426987883107732
s0.2mdn.net/simgad/ Frame 8722 37 KB
38 KB 1134ms
36ms Image
image/jpeg 142.251.167.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7340426987883107732

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1100837.154378CRITEO/B30948992.381133799;dc_ver=99.292;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;dc_adk=155289791;ord=hu151f;click=https%3A%2F%2Fcat.va.us.criteo.com%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3D0aV1VTRhPRW0lcKAHVCCWgWmTiuCeio5F8cd00buRYrtb1VmR43QORkhVDk_KSJZF0PxMl2tifKVEUU-CgHSO-X0PgwY0l-4N7VnsIru4HuzwVt8Kt-ty9G-Hvl9y0JEIBXZKUgwS7LNAEVbALuCjT2mtEKhszYUtXdwr4XO5VTvZbC6LQcecKTQJFt3r1CerLrQh5pFE1Mk1L7W-gVqWOcqir6Jg4ZkweRW8Qb-ps1SDWqIG5TqN8q-Xmi61O8fqTeEc5HEOU_FRyXzGlddlstQoLswSI8qz1vvNseAcFMhC3e3foAIrBZIBFikBbKVYjE7U2t3LaGS-b4It8JFEFcwU8isjYdVgsuCoIFiXyg-c5x975Bft9oQnUyQcU9F7k1aSnLudM9uNPCdJjD8jFQCfxMV2yUOkL0nfKYyEsmwUjwQ%26maxdest%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fexpress.ba$2,https%3A%2F%2Fb02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=QSNMNvfhL0;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=96;prcl=s

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f149.1e100.net

Software

sffe /

Resource Hash

9b65183add8c113edcb77b313f4b338e4bb47f26ae0c6f7d754a056fbfab8f2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 14 Dec 2024 14:35:24 GMT
date: Fri, 15 Dec 2023 14:35:24 GMT
x-content-type-options: nosniff
age: 15111
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37881
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 19:04:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 sodar_loader.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/ Frame 8722 11 KB
4 KB 36ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/sodar_loader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

accd286d5615ed70f6e559aced46cd395dec1ef331923df53b38118908b763e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4295
x-xss-protection: 0
server: cafe
etag: 4396225862294152759
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 00:42:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 8722 11 KB
4 KB 36ms
36ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:45:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64888
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 00:45:46 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8722 203 KB
64 KB 49ms
49ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:14 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8722 0
0 127ms
53ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssByWRb3Lx4HaXg1EXUpnqnnDvDNiggQ_Em0fP87ioYPe6_rNKUNrFi_j05qoNl6cOfqgSIk8wUqpZ-2SHt8wvN8A3fYPRIS9LqsC35fhheol91TEmotD6uwLwdCi89I2qdfhL2fV-U_p1MMaF7ZnxZkJRCnhsmQXTMhTH9kCsdaJ8Nal0URn52A-eaYL0&sai=AMfl-YSrzg19D1pDHRa89vO3y2c-jK7F1OcflgPhXf1WBT2iEcrFWxK5qnYxLMQgtEhGXVjGi5YYb9Nk8TG51ViTNxkKQRF_Uu5zZe9u-A&sig=Cg0ArKJSzE0aMRWeRNPCEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231207.10235&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 7340426987883107732
s0.2mdn.net/simgad/ Frame D378 37 KB
37 KB 1139ms
60ms Image
image/jpeg 142.251.167.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7340426987883107732

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1100837.154378CRITEO/B30948992.381133799;dc_ver=99.292;dc_eid=40004000;sz=728x90;u_sd=1;gdpr=0;dc_adk=435816778;ord=uhv211;click=https%3A%2F%2Fcat.va.us.criteo.com%2Fdelivery%2Fck.php%3Fcppv%3D3%26cpp%3DtBk48TRhPRW0lcKAHVCCWgWmTit185tDk1KsAMSc1wkdS6xRdmgXbk7kloHwEiLQrUhC0sBzgB9tjWDxnqEHKZCmoB4OK_0bl_Qll3LaPgaEPggJNfDBGdJEfyBgBTNgOEVRvvqkQekt0-k6xouneTuN9d90kI81VpkfOVFZ5Hha4CYNYKJVSc86S2qNSk2Un9Wp_CX97jr4hQixZzlNF4UMA1PQyna8uSBQiILyI2qSj8EgO-GNoQt_P8_qAZYcoovhtnCgQ78K07Pc7y5QdUgv61Es9W4Le400dkpqh55-F1RKBcH2p9w_yqldNxH9rdwPwVyWlnK0wetWhvGjMFaRrnUVl9-W6JdopTHgx0wD84fzLvxfsXgMOaSsOXmrwroxcH3REhvMPHqt0EALE7XCHuzRU0vDPuS1Tr4WwAo3wyXH%26maxdest%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fexpress.ba$2,https%3A%2F%2Fb02e8a2fde16729f138bb359c5e233ab.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=QSNMNvfhL0;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=118;prcl=s

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f149.1e100.net

Software

sffe /

Resource Hash

9b65183add8c113edcb77b313f4b338e4bb47f26ae0c6f7d754a056fbfab8f2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 14 Dec 2024 14:35:24 GMT
date: Fri, 15 Dec 2023 14:35:24 GMT
x-content-type-options: nosniff
age: 15111
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37881
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 19:04:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 sodar_loader.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/ Frame D378 11 KB
4 KB 39ms
38ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/sodar_loader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

accd286d5615ed70f6e559aced46cd395dec1ef331923df53b38118908b763e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4295
x-xss-protection: 0
server: cafe
etag: 4396225862294152759
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 00:42:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame D378 11 KB
4 KB 37ms
36ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 00:45:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64888
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 00:45:46 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 8722 41 KB
14 KB 38ms
37ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:25:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 141720
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Dec 2024 03:25:14 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D378 203 KB
64 KB 42ms
42ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 18:47:14 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D378 0
0 99ms
54ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXOrV2rVNQ1BsXr3LxpuLW9-jp81a1Vb3CWauCkqXgsnXaowAbvKbf2z5uZokqghA3c9KHatC4ml9MlYyBEZ_tWOu433lPvwWiClAyiHrS6Mhyq4wqLDvZV1lgBTdbq8Yqn9DT9cvjNjtPIhFhQvLNa0w8zx0mR3rhEYm-s9RqtZvZYauWivh5VUipSu0&sai=AMfl-YStlNEQBEGCjgDb-WnoTmDXIYPM6mXRqtfSPnplWRwMn9_WbFfZmKuoQgMSo0W_yrfR6s7vxNcVsy-zMjKnZOKUatbuxjKgKnn0gg&sig=Cg0ArKJSzN9k1sSLo2YrEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231207.76914&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D378 41 KB
14 KB 42ms
40ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:25:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 141720
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Dec 2024 03:25:14 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 8722 8 KB
6 KB 57ms
54ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=r20100101&st=int

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/sodar_loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2e85f87f79d08a8db21af5ab468125b6d288f3ae188503f447d4e021b58107c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6003
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D378 8 KB
6 KB 60ms
60ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=r20100101&st=int

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/sodar_loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e6ddbe2182532b5c4d1f4d6f80c6de5ba42a097d45f6137255271f1565bf456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5927
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame DE5E 38 KB
13 KB 40ms
37ms Document
text/html 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 142904
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Dec 2023 03:05:30 GMT
expires: Fri, 13 Dec 2024 03:05:30 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 4F41 38 KB
13 KB 36ms
36ms Document
text/html 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 142904
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Dec 2023 03:05:30 GMT
expires: Fri, 13 Dec 2024 03:05:30 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame DE5E 39 KB
15 KB 36ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 07:42:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39878
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 07:42:36 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 4F41 39 KB
15 KB 36ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 07:42:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39878
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 07:42:36 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE5E 0
20 B 52ms
51ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BGkyYMp98ZbDbHMmUoPMP79CYoAEAAAAAOAHgBAI&bg=!k5ClkN_NAAY3kmNgF5I7ADQBe5WfOPulR-MjQmLRLm6Eo4oevjwnJzvBhChUOnGZlekinr81dEs_0Pa9DS4jDxqleagBAgAAAJRSAAAABGgBB5kDc2QvVt_ROi5xqGG2w9tTJa_J8s0S8M_6dX14Er62wD4CojMzygGMKpnORzqCKQRYM5I5J1-y_3jH1-RShxX3Sgp40OdSXofe6ja29AgjuLWR1Hk1NjXGYTuj-vYwaEg48HJQTOo_PXo6w4iUtCpV-ssvv3XHH5jF5p63fkl_TGaQRAPGKiLMqbMpoaAmKAd2nYYL0A9crzWg38cRSofmWj8MKHK_bw_hJpyJvOBu6mjwmjaEqr49dilJY0FJzEo0iDj-fqV62GKNSSDNHeniY0tEJOuhvIH3yLcROshnsZtWXhxl1T1IhLV33Gp3CkD_KXRuqXcAGM-n0LYlhqXu1jwHS2TNXSoVV8jmm_MaLlcNFwNxpx8BoxqHSk_hZVIw01yF1VTqHr499oEW3jCQzlaGLPg2zLEWprJQiMZDgvTu2WmYHD7qyotfC6kJLuqnoiG_dzXXrnNgYMMm0Tsoztz92hltYRa4vsDxA00_P_LPs_IsRRN8soLMopPzPXiqC0fOOtIF89PzDjIF4ak8OvLN62SJZxIuD_Owm6pLGxlVDjjOQIoZQgy3PNG7eoJVSeoPDrt4BYIOnqOfPdSKCqwXYqeR9YhSMVxIygZyn4Fwg1TF1amI_wEZHasFkNqmg5CjM2f4PqZsW29vEOY_nlNGtKXx6J4MF75_WB0I34jrhZ8oiZoxtnI9O8Vo5U2LPB_8SZXkxwNNRUy7G5BaAfbLk6J_kZkp6Sm36KE2n6CoWc1GXFV7BWTdl62XkmTpmxoZm-GumY5nJ5uxEb7vd9H0UyTt6I6NSsV0AWxwLfvhzCJhbwwSZhvH_FicGobbKRZa3D_bbUctzAmQqMdH0rBwFWZvHXL5zbe5XtvzV-9ekuq3Gz9wj9rURA2QXBDEpegVfpkQdiTsGw-4ytTUG3EAZu5AnIgkYelLqhka6q7tykbmV7TH622GJjSObJaVSsDpkewsFXtLEJLkYiwhFH_3NOen7QzXDcohFk0JMp0H-7qTdyWAKPNFed8iwrzHklL2hh-ybizes4WSY21McmD3BPR1u9oShudaXT7lXueV6bYucjO0c56RUfwHT05rb4gCZD4GptxYalle19c74vAnoLzCE572zeYnm0dXf7sC1IcJm67MilUG0oCxYlsx6dcY94h4adj7zj1ShGvhNaG-F9c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4F41 0
20 B 52ms
52ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BxuMyMp98Za_bHKS0oPMPlpao8AYAAAAAOAHgBAI&bg=!WVqlWhXNAAY3kmNgF5I7ADQBe5WfOIDbmArsdh-BGScyY5khboUOTIfvvm52KTJtYSLelQzw_nH5k3ocXvpv4wW1tle-AgAAAIVSAAAAA2gBB5kDji1Gb7pfZSnUml51dqPgKzcA_4-63favdqfvTEJ0DptopRh0Z90605LPqtXPiI-a3VEmLYzQkq6cu3nu70xUuP-usD7uKXEoaaVhI2D6IlEvw_8ee9HXB3cyMX9sKpLGlWSip4uuiCigYHgnf1viAjo5-ELHQWgQBr_k3MsEmqhIKG_nGyLcEzbfSOsrblu2adzge6uGM1UxE7ZXsHZ_jMBG2u9I-lxU_Yzz_Jpk9vRPQVvrqYijeGZq9mPGrpQhQ7kTditQvdbO51SVl9eS3O52IlfiB67X7nEiRXAKfgxzY-7jxxX6vffMAVz5yhutmknBE5qPIhLkBHO7lttbo3dM7Bc7hidYntsNTbjrRCQkw0zJZnktYi59n-wQ0M-sL1behL13HIflu9-_5blFPgz5uXZBc_6FbGM_bqZXMrxDogyiXMWAiiO1QU2aA6JYvY7okeKdK1-QMt1ZoIo10seMbj_wo2u3_tobSWJ3H1c8sEhgTXO9u0DbJzOgWPI91AtlIu3xwKFj1t5qVcj0dkZo1SpkECdHXejE8-YMAH04pLUmfR4iJ5eUc0OX0-pT-gdcDT8-Vo0grmuoKkp8wT5QVyE9YudKbvVTT9fGYicq5-RlfcUuIFh9id5BcAB3bXCfLRDXRs1Ndr28PC4KczB5b7_OGRr3bvdeBdyDoseQoxBaCZUl6aUGoBLvYlu4L4myBs28aOZ9dzQRyNRUh1ZiqsDAJ4vIrtA6lcbg8J4RDqzZThvzAGw1eXII_M0TY2BR0h20ppkKpdhZKbWmF0sS-wP7qtkaccHuhJNEAdXxlc4uKxGhCp7VGiwzfD9IbdVHgwkdoY9la0qcChjigbjU3hv31PDwyB32cQA-DghyLZrbNCO00qgEGNtIQC8PVf55hOvTh_Vuw65OrLS2D_Zqvc3myuJtxDzNMGpe8YYG_3jeNVCX9vMCyRLVQxd-wEiW1OK4zkegYfcDlx3gHztQr46jehmC1oWzo50BXx1XHbzw7Id8nivAh4zZO7SG5WIkfcL3XGIOe6U4oHr-9NYBNPcNxf-YeOha78ovqfXJ9LiTlS322KVFHGptICIxcker6RWUtio2Jg5-R87FZZipYz2qA6G_klnFnvykxP-_LYHTWIsYLR4Gx_YHgW2ExAxxn-muXEQ8cEAwl9OPO4-OUn7X3glG1A2P3xSC74rr9VU0FoxX3f0bRkWY600

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame A9F8 0
127 B 33ms
33ms Ping
text/plain 74.119.119.149
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.149 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 15 Dec 2023 18:47:15 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

POST
H2 204 collect
analytics.google.com/g/ 0
54 B 41ms
40ms Ping
text/plain 216.239.36.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-NH50T43DVN&gtm=45je3bt0v9105423624&_p=1702666028988&gcd=11l1l1l1l1&dma=0&tcfd=10000&gdid=dZGIzZG&cid=891998810.1702666029&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1702666029&sct=1&seg=0&dl=https%3A%2F%2Fexpress.ba%2F&dt=Express%20Tabloid%20-%20Od%20nas%20ne%20mo%C5%BEete%20pobje%C4%87i&_s=2&tfd=7397
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NH50T43DVN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://express.ba
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8722 0
0 53ms
52ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssByWRb3Lx4HaXg1EXUpnqnnDvDNiggQ_Em0fP87ioYPe6_rNKUNrFi_j05qoNl6cOfqgSIk8wUqpZ-2SHt8wvN8A3fYPRIS9LqsC35fhheol91TEmotD6uwLwdCi89I2qdfhL2fV-U_p1MMaF7ZnxZkJRCnhsmQXTMhTH9kCsdaJ8Nal0URn52A-eaYL0&sai=AMfl-YSrzg19D1pDHRa89vO3y2c-jK7F1OcflgPhXf1WBT2iEcrFWxK5qnYxLMQgtEhGXVjGi5YYb9Nk8TG51ViTNxkKQRF_Uu5zZe9u-A&sig=Cg0ArKJSzE0aMRWeRNPCEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1145&vt=11&dtpt=1143&dett=2&cstd=0&cisv=r20231207.10235&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 8722 17 KB
6 KB 38ms
37ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/sodar_loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Dec 2023 18:47:15 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D378 0
0 53ms
52ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXOrV2rVNQ1BsXr3LxpuLW9-jp81a1Vb3CWauCkqXgsnXaowAbvKbf2z5uZokqghA3c9KHatC4ml9MlYyBEZ_tWOu433lPvwWiClAyiHrS6Mhyq4wqLDvZV1lgBTdbq8Yqn9DT9cvjNjtPIhFhQvLNa0w8zx0mR3rhEYm-s9RqtZvZYauWivh5VUipSu0&sai=AMfl-YStlNEQBEGCjgDb-WnoTmDXIYPM6mXRqtfSPnplWRwMn9_WbFfZmKuoQgMSo0W_yrfR6s7vxNcVsy-zMjKnZOKUatbuxjKgKnn0gg&sig=Cg0ArKJSzN9k1sSLo2YrEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1134&vt=11&dtpt=1132&dett=2&cstd=0&cisv=r20231207.76914&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D378 17 KB
6 KB 38ms
38ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/xfa/sodar_loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Dec 2023 18:47:15 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 79DE 39 KB
15 KB 36ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 07:42:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39879
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 07:42:36 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame AA69 39 KB
15 KB 35ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 07:42:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39879
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 07:42:36 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ Frame C5CD 98 KB
32 KB 39ms
39ms Script
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

adecd0c47125731bc832bfdc4f2363be43c211abead936eb0c39e47e7105018c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-18615"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 16 Dec 2023 18:47:15 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ Frame 20A6 102 B
314 B 52ms
51ms XHR
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=express.ba&url=https://express.ba/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fexpress.ba%2F&ref=https%3A%2F%2Fexpress.ba%2F&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61971a34377efde79f71cf50b51963cc46c009f6b28d24d9dd9e993258ca1256

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 8360daa51c4c36be-YYZ

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 89ms
41ms Preflight
application/json 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=express.ba&url=https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://express.ba
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8360daa4cbb336be-YYZ
content-length: 0
content-type: application/json
date: Fri, 15 Dec 2023 18:47:15 GMT
debug: OPTIONS block
expires: Sat, 14 Dec 2024 18:47:15 GMT
server: cloudflare

GET
H2 200 pd Show response
us-u.openx.net/w/1.0/ Frame D20E 653 B
708 B 108ms
106ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=c59af140-ab96-4258-9229-9ffb6f7bc370&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e513aa1fb5f3d903e629a71e3502e771434ff5f02eacfdd6adf49aa44d845789

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 413
content-type: text/html
date: Fri, 15 Dec 2023 18:47:16 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 isyn Show response
prebid.a-mo.net/ Frame CDFB 2 KB
688 B 34ms
33ms Document
text/html 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=CrEBSgpleHByZXNzLmJhUgthYXMtMWFjMDlhOFoIcGJhMS4zLjJqCmV4cHJlc3MuYmH6AQY3LjI3LjDoAgGIA7C-8qsGqAMW6gMkNDI4NmY1NGQtZjMwNy00YzM4LWFmNWUtMGE3ZGY3YmQ1ZDFjqgQDRENIsgUDVVNE0gUJMTA1MTk5NDIx2AUB4AUB6gUHZGVza3RvcPoFBGRjMTOqBwN3ZWLKBwpleHByZXNzLmJh4AcB
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: a1e27aea2d4506e3444dc5b1f03eb09dada11d9185c45ad90119650a8f8aa57b

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 599
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:15 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 84E0 16 KB
6 KB 38ms
38ms Document
text/html 23.220.136.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.220.136.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-136-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=55294
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Fri, 15 Dec 2023 18:47:16 GMT
expires: Sat, 16 Dec 2023 10:08:50 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200
OK

beacon Show response
ce.lijit.com/ Frame 9D79
Redirect Chain

https://ap.lijit.com/beacon?informer=13401985
https://ce.lijit.com/beacon?informer=13401985

4 KB
2 KB

49ms
48ms

Document
text/html

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?informer=13401985
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: f92b7e84dbc5f94eb6064c1f2131b5e0752a0a7ab38edc5d88ab0aff4b4a1bd7

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding: gzip
Content-Length: 1068
Content-Type: text/html
Date: Fri, 15 Dec 2023 18:47:16 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Vary: Accept-Encoding, User-Agent
X-Sovrn-Pod: ad_ap3dca1

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?informer=13401985

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame AF65 281 B
555 B 32ms
32ms Document
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 15 Dec 2023 18:47:16 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame CDFB 13 KB
6 KB 204ms
31ms Script
text/javascript 104.19.158.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=CrEBSgpleHByZXNzLmJhUgthYXMtMWFjMDlhOFoIcGJhMS4zLjJqCmV4cHJlc3MuYmH6AQY3LjI3LjDoAgGIA7C-8qsGqAMW6gMkNDI4NmY1NGQtZjMwNy00YzM4LWFmNWUtMGE3ZGY3YmQ1ZDFjqgQDRENIsgUDVVNE0gUJMTA1MTk5NDIx2AUB4AUB6gUHZGVza3RvcPoFBGRjMTOqBwN3ZWLKBwpleHByZXNzLmJh4AcB
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.19.158.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 1df98836515ac348d12c9af86e1ecc48.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: YUL62-C1
age: 142
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 8360daa66a6439f5-YYZ
x-amz-cf-id: Y6nq402-I27k2gEMhKBNm8fa5Z_LygcrPXCD6HMKGizE9Pi2HNcubA==
expires: Fri, 15 Dec 2023 19:47:16 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame AF65 45 KB
13 KB 37ms
37ms Script
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8209006f69e596bd225d1d307774d3b6123a1279c4353b61b022e14cd3251d4a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 15 Dec 2023 18:47:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15 Dec 2023 09:30:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=53048
Connection: keep-alive
Content-Length: 13169
Expires: Sat, 16 Dec 2023 09:31:24 GMT

GET
H2 200 533 Show response
a.ad.gt/api/v1/u/matches/ Frame 20A6 12 KB
4 KB 1110ms
45ms Script
application/javascript 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/533?_it=amazon
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dbb71899b11b5be0fa0126aa6904c878ff801251d3ada696fd4d59fb443318d6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 15 Dec 2023 18:42:46 GMT
server: cloudflare
age: 271
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 8360daac1d24a253-YYZ

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=83&3pid=LQ6ZE5RC-Q-8P8X&gdpr=0

43 B
1 KB

72ms
54ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=83&3pid=LQ6ZE5RC-Q-8P8X&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=83&3pid=LQ6ZE5RC-Q-8P8X&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 2eb7d209ab67664d6226c75331547ba1
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://ce.lijit.com/merge?3pid=AABjrU7K-T4AABLrmgLqjQ&pid=85&gdpr=0

43 B
2 KB

101ms
38ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?3pid=AABjrU7K-T4AABLrmgLqjQ&pid=85&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?3pid=AABjrU7K-T4AABLrmgLqjQ&pid=85&gdpr=0
Date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET sync
rtb.mfadsrvr.com/ Frame 9D79 0
0

GET 77781087eb9a0621642f9ebec6beb8d1.gif
cs.krushmedia.com/ Frame 9D79 0
0

GET
H2

503

cs
ad.turn.com/r/ Frame 9D79
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent=
https://ad.turn.com/r/cs?pid=45&rndcb=4026595748

0
0

4555ms
3046ms

Image
text/html

69.194.242.12

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.turn.com/r/cs?pid=45&rndcb=4026595748
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: H2
Server: 69.194.242.12 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
etag: RX76c6158e892a4b5d8768fcb7ed849c5f005
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://ad.turn.com/r/cs?pid=45&rndcb=4026595748
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET sovrn
tr.blismedia.com/v1/api/sync/ Frame 9D79 0
0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://um.simpli.fi/lj_match?r=1702666036060&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=D0812E5B1E9348BAA3CDA37D98868D87

43 B
1 KB

36ms
35ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=D0812E5B1E9348BAA3CDA37D98868D87
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=D0812E5B1E9348BAA3CDA37D98868D87
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 14 Dec 2023 18:47:16 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&us_privacy=&gdpr=0&gdpr_consent=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=fmx&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=968062844627624655&expires=30&ssp=fmx
https://ce.lijit.com/merge?pid=26&3pid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&us_privacy=

43 B
2 KB

1205ms
38ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:18 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&us_privacy=
Date: Fri, 15 Dec 2023 18:47:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=sovrn&gdpr=0&gdpr_consent=&tc=1

43 B
2 KB

207ms
58ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT, Fri, 15 Dec 2023 18:47:16 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9D79
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=SDA1bmpQWkh6OG9tX3F2YVFIcVl2djBT&gdpr=0

170 B
194 B

45ms
45ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=SDA1bmpQWkh6OG9tX3F2YVFIcVl2djBT&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 15 Dec 2023 18:47:16 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=SDA1bmpQWkh6OG9tX3F2YVFIcVl2djBT&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub10014056052800&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?3pid=OPU49915493a48840cb8ff4546dc65bdbed&gdpr=0&gdpr_consent=&pid=103

43 B
2 KB

1171ms
38ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?3pid=OPU49915493a48840cb8ff4546dc65bdbed&gdpr=0&gdpr_consent=&pid=103
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:18 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: nginx
access-control-allow-methods: POST, GET
content-type: text/html; charset=utf-8
access-control-allow-origin: *
location: https://ce.lijit.com/merge?3pid=OPU49915493a48840cb8ff4546dc65bdbed&gdpr=0&gdpr_consent=&pid=103
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 131
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame 9D79 0
0 54ms
49ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2

200

dot.gif
s0.2mdn.net/ Frame 9D79
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=SDA1bmpQWkh6OG9tX3F2YVFIcVl2djBT&gdpr=0
https://s0.2mdn.net/dot.gif?gdpr=0

43 B
181 B

37ms
36ms

Image
image/gif

142.251.167.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985

Protocol

Server

142.251.167.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f149.1e100.net

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 10:21:14 GMT
x-content-type-options: nosniff
age: 30362
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Dec 2023 10:21:14 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://s0.2mdn.net/dot.gif?gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 231
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 9D79 0
187 B 38ms
32ms Image
text/plain 207.198.113.204
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.204 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:15 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=80&3pid=LQ6ZE5RC-Q-8P8X&gdpr=0

43 B
1 KB

99ms
44ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LQ6ZE5RC-Q-8P8X&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LQ6ZE5RC-Q-8P8X&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 1537ef2fe96d186f089f142283d9817a
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=vTLniRPpEkdn&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
3 KB

36ms
36ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=vTLniRPpEkdn&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:18 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://ce.lijit.com/merge?pid=49&3pid=vTLniRPpEkdn&ev=1&pid=558511&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-db744d8c7-vnt57
expires: -1

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=H05njPZHz8om_qvaQHqYvv0S&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:982ca56719e48314c7729702bc3417fb

43 B
3 KB

53ms
36ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:982ca56719e48314c7729702bc3417fb
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:18 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Fri, 15 Dec 2023 18:47:18 GMT
server: Aorta/20231215.627d1920a
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
location: https://ce.lijit.com/merge?pid=84&3pid=c:982ca56719e48314c7729702bc3417fb
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: b4e2fd54cdc7
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&gdpr=0&gdpr_consent=

43 B
2 KB

192ms
41ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=27&3pid=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&gdpr=0&gdpr_consent=
date: Fri, 15 Dec 2023 18:47:16 GMT
server: Kestrel
content-length: 223

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 9D79
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D92%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=92&3pid=5638150801812241363&gdpr=0&gdpr_consent=

43 B
1 KB

79ms
43ms

Image
image/gif

63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=92&3pid=5638150801812241363&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: HTTP/1.1
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
an-x-request-uuid: 51c6a031-84c9-4eca-8951-72accd13533e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ce.lijit.com/merge?pid=92&3pid=5638150801812241363&gdpr=0&gdpr_consent=
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D20E
Redirect Chain

https://cms.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=mBqpO5dJrD6DTPttlhyzbM9Kpm-DS_g9zx-qG7oJ

43 B
61 B

105ms
105ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=mBqpO5dJrD6DTPttlhyzbM9Kpm-DS_g9zx-qG7oJ
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=c59af140-ab96-4258-9229-9ffb6f7bc370&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=mBqpO5dJrD6DTPttlhyzbM9Kpm-DS_g9zx-qG7oJ
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame D20E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6357297787875203079

43 B
264 B

396ms
105ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6357297787875203079
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=c59af140-ab96-4258-9229-9ffb6f7bc370&gdpr=0
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:20 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6357297787875203079
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame D20E 0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D20E
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d60f96e4-8f64-7462-d01d-e18eecfa148c&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&ttd_puid=d60f96e4-8f64-7462-d01d-e18eecfa148c&gdpr=0&gdpr_consent=

43 B
62 B

110ms
109ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&ttd_puid=d60f96e4-8f64-7462-d01d-e18eecfa148c&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=c59af140-ab96-4258-9229-9ffb6f7bc370&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=2b9bbefe-7c17-405c-81fe-f4cdcb50c53a&ttd_puid=d60f96e4-8f64-7462-d01d-e18eecfa148c&gdpr=0&gdpr_consent=
date: Fri, 15 Dec 2023 18:47:16 GMT
server: Kestrel
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame D20E 170 B
194 B 46ms
45ms Image
image/png 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmE2MDQ1MmUtNDYxMy0yYWM2LWM1ZmQtYmIzNzI2MThkYWVj

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=c59af140-ab96-4258-9229-9ffb6f7bc370&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D20E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC-Eh1pi4oDhesjDUe1fs2A&google_cver=1

43 B
61 B

103ms
103ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC-Eh1pi4oDhesjDUe1fs2A&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=6&ph=c59af140-ab96-4258-9229-9ffb6f7bc370&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC-Eh1pi4oDhesjDUe1fs2A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm Show response
us-u.openx.net/w/1.0/ Frame C0C0 594 B
671 B 111ms
105ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 63da4870c2205cad99d8a4be63cbb484a9e409ebc7b751d02aaa61840bb0262c

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 366
content-type: text/html
date: Fri, 15 Dec 2023 18:47:16 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4FA3 16 KB
6 KB 65ms
60ms Document
text/html 23.220.136.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.220.136.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-136-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=55294
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Fri, 15 Dec 2023 18:47:16 GMT
expires: Sat, 16 Dec 2023 10:08:50 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C559 16 KB
6 KB 67ms
63ms Document
text/html 23.220.136.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.220.136.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-136-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=55294
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Fri, 15 Dec 2023 18:47:16 GMT
expires: Sat, 16 Dec 2023 10:08:50 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 idl.js Show response
assets.a-mo.net/js/ Frame CDFB 3 KB
2 KB 27ms
27ms Script
application/javascript 104.19.158.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=express.ba&e=27&uid=07160776-0d07-4aa5-9070-0a5e544b9382
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.19.158.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8c49bc14e5b5041853d619fe2dc1b01b28bfd4974b8e732f13fa4943efaada3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 890304274d84dce52c3c8a65cb402758.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: YTO50-P2
age: 535
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 02 Nov 2023 21:08:31 GMT
server: cloudflare
etag: W/"771a6a92588a8fb45e42a04fa3fe9ddd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 8360daa76c2c39f5-YYZ
x-amz-cf-id: nra-bBaHS3fna9yjJs6qrbT29bxmvaYeT_wq7LvHTdWdHzS8Ed82cQ==
expires: Fri, 15 Dec 2023 19:47:16 GMT

GET

b
c3.a-mo.net/ Frame CDFB
Redirect Chain

https://id.a-mx.com/sync?tao=1&&do=express.ba
https://c3.a-mo.net/b?uid=d345d744-6e6b-4601-aeff-df84c1cb44be&sh=id.a-mx.com&

0
0

GET
H2

204

setuid
prebid.a-mo.net/ Frame CDFB
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=07160776-0d07-4aa5-9070-0a5e544b9382&gdpr=0&us_privacy=1---
https://sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=1---&ssp=adaptmx&bsw=9c86f74d-193d-41d2-be03-eed49aa43cfa
https://sync-dmp.mobtrakk.com/match/bidswitch?id=%24%7Buser_id%7D&gdpr=0&consent=&usp=1---&ssp=adaptmx&bsw=9c86f74d-193d-41d2-be03-eed49aa43cfa&chk=1
https://x.bidswitch.net/sync?dsp_id=457&user_id=NjVhMTE3ZGU5ODc3MjdjZQ&gdpr=0&gdpr_consent=&us_privacy=1---&ssp=adaptmx&bsw_param=9c86f74d-193d-41d2-be03-eed49aa43cfa
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=&us_privacy=1---

0
113 B

35ms
35ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=&us_privacy=1---
Date: Fri, 15 Dec 2023 18:47:16 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame CDFB
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?uid=07160776-0d07-4aa5-9070-0a5e544b9382
https://prebid.a-mo.net/setuid/yahoo?uid=y-tGvHidlE2uHNEZ9Q8ocEwHtBRG5dz.OlfMZPRJI-~A

0
135 B

35ms
34ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-tGvHidlE2uHNEZ9Q8ocEwHtBRG5dz.OlfMZPRJI-~A
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-tGvHidlE2uHNEZ9Q8ocEwHtBRG5dz.OlfMZPRJI-~A
date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
prebid.a-mo.net/ Frame CDFB
Redirect Chain

https://id.a-mx.com/u?&gdpr=0&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Damx_com%26uid%3D
https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=amx_com&uid=07160776-0d07-4aa5-9070-0a5e544b9382

0
113 B

34ms
34ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=amx_com&uid=07160776-0d07-4aa5-9070-0a5e544b9382
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=amx_com&uid=07160776-0d07-4aa5-9070-0a5e544b9382
date: Fri, 15 Dec 2023 18:47:16 GMT
content-length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame CDFB
Redirect Chain

https://rtb.openx.net/sync/prebid?&gdpr=0&us_privacy=1---&r=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Dopenx%26uid%3D%24%7BUID%7D
https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=openx&uid=efd1192b-36fb-478b-bb91-219b6da1d601

0
113 B

35ms
34ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=openx&uid=efd1192b-36fb-478b-bb91-219b6da1d601
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=openx&uid=efd1192b-36fb-478b-bb91-219b6da1d601
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 154

GET
H2 200 cookie
cm.adform.net/ Frame CDFB 43 B
105 B 112ms
110ms Image
image/gif 37.157.6.232
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?&gdpr=0&us_privacy=1---&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Dadform%26uid%3D%24UID
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.232 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame CDFB
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&us_privacy=1---&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-m...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBJDJKRB6QEGfz8M9Ett24s&google_cver=1

0
74 B

102ms
34ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBJDJKRB6QEGfz8M9Ett24s&google_cver=1
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 08:36:53 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBJDJKRB6QEGfz8M9Ett24s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

setuid
prebid.a-mo.net/ Frame CDFB
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Dindex_rtb%26uid%3D
https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=index_rtb&uid=ZXyfLgBuUMEGpHAFjn.29AAA%261300

0
112 B

34ms
34ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=index_rtb&uid=ZXyfLgBuUMEGpHAFjn.29AAA%261300
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F5bok3iZ2K9w429MpFHkjuvaLwd0m6VEzR6zLNL63550Fy6jGKiZ1epPZnHOgQiaKC8rVagtoy%2BOIul5k02pJNTCR0vYwrHs%2BSNkCHXV8lPckE%2F4qlPecTKwQZ7MSpZIuvJgllaW"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=index_rtb&uid=ZXyfLgBuUMEGpHAFjn.29AAA%261300
cache-control: no-cache
cf-ray: 8360daa77f8b3a0b-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame CDFB
Redirect Chain

https://ap.lijit.com/pixel?&gdpr=0&us_privacy=1---&redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=sovrn&uid=H05njPZHz8om_qvaQHqYvv0S

0
115 B

37ms
36ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=sovrn&uid=H05njPZHz8om_qvaQHqYvv0S
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:15 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 4
server: envoy
vary: Accept-Encoding

Redirect headers

Date: Fri, 15 Dec 2023 18:47:16 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=sovrn&uid=H05njPZHz8om_qvaQHqYvv0S
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame CDFB
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Dappnexus%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=appnexus&uid=5638150801812241363

0
112 B

35ms
35ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=appnexus&uid=5638150801812241363
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
an-x-request-uuid: 66e584e8-bbda-4e59-a1c8-3f2565c5383d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://prebid.a-mo.net/setuid?A=07160776-0d07-4aa5-9070-0a5e544b9382&bidder=appnexus&uid=5638150801812241363
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ow.pubmatic.com/ Frame CDFB 0
248 B 3405ms
43ms Image
text/html 104.36.115.123
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=07160776-0d07-4aa5-9070-0a5e544b9382&do=express.ba
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.123 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:19 GMT
content-length: 0
content-type: text/html

GET
H/1.1 200
OK setuid
prebid-server.rubiconproject.com/ Frame CDFB 0
560 B 685ms
38ms Image
text/html 69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=amx&uid=07160776-0d07-4aa5-9070-0a5e544b9382&do=express.ba
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame CDFB 43 B
1 KB 69ms
68ms Image
image/gif 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=07160776-0d07-4aa5-9070-0a5e544b9382&do=express.ba

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-34-199-214-171.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
an-x-request-uuid: 3b41efed-a3ac-430f-b60a-4edbe2286dc2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame C5CD
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid-stag.setupad.net/setuid?bidder=adnxs&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=5638150801812241363

86 B
637 B

135ms
135ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=adnxs&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=5638150801812241363
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OjhMvPee2JPWgBQFd7WCjOubMNxceZmofqaOAF7cJVUhtEXgR%2F7Ss3i1afS%2F%2FlpVEhKdgHBJxuTPEBMqmIO9casG%2BFL%2Bk%2F36aZqGGeJl9ntttX1%2BXfIWlWu5AGDpCUnIemhtgQSBV9m8"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
cf-ray: 8360daa7bdc139fa-YYZ
content-length: 86
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
an-x-request-uuid: aabc1ebd-9df5-41cb-b184-d9b8b56b9dc9
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://prebid-stag.setupad.net/setuid?bidder=adnxs&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=5638150801812241363
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
BLOB 200
OK 9e1ac4ef-13c4-4157-8f24-b9fc0e6ce04d
https://prebid.a-mo.net/ Frame CDFB 171 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prebid.a-mo.net/9e1ac4ef-13c4-4157-8f24-b9fc0e6ce04d
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6073abe3afb3e8fcc7f1643d46aae57620510040ee2ad755269b7b126ee0633f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Length: 171
Content-Type

GET
H/1.1 200
OK merge
ce.lijit.com/ Frame C0C0 43 B
2 KB 88ms
54ms Image
image/gif 63.251.86.51
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=76&3pid=bae14824-65d0-4e6f-97a1-5728944b2bde&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.86.51 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Dec 2023 18:47:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3dca1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C0C0
Redirect Chain

https://openx2-match.dotomi.com/match/bounce/current?networkId=15900&version=1&nuid={OX_USER_ID}
https://openx2-match.dotomi.com/match/bounce/current?DotomiTest=6eab3a03b394070a&is_secure=true&networkId=15900&version=1&nuid=%7BOX_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537072954&val=AAACR7yq1G7xTgMNpHJEAAAAAAA&expiration=1702752436&nuid={OX_USER_ID}&is_secure=true

43 B
61 B

102ms
101ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072954&val=AAACR7yq1G7xTgMNpHJEAAAAAAA&expiration=1702752436&nuid={OX_USER_ID}&is_secure=true
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://us-u.openx.net/w/1.0/sd?id=537072954&val=AAACR7yq1G7xTgMNpHJEAAAAAAA&expiration=1702752436&nuid={OX_USER_ID}&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET sync
sync.srv.stackadapt.com/ Frame C0C0 0
0

GET
H2

200

dds
rtb.openx.net/sync/ Frame C0C0
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=CVkc2CbizUw2aa05P-MuNg==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
105 B

27ms
26ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 42c8f0a0-1fc8-e62b-e1ca-f77b13add9c5
pr-bh.ybp.yahoo.com/sync/openx/ Frame C0C0 43 B
602 B 51ms
49ms Image
image/gif 34.199.214.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/42c8f0a0-1fc8-e62b-e1ca-f77b13add9c5?gdpr=0

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.199.214.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C0C0
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://rtb.adstanding.com/ssp/bidswitch/cookie?bidswitch_ssp_id=openx&bidswitch_custom_parameter=9c86f74d-193d-41d2-be03-eed49aa43cfa
https://x.bidswitch.net/sync?dsp_id=317&user_id=279894bfc0e27aafbcf156f72728d496&expires=30&ssp=openx&bsw_param=9c86f74d-193d-41d2-be03-eed49aa43cfa
https://us-u.openx.net/w/1.0/sd?id=537072968&val=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&us_privacy=

43 B
61 B

106ms
105ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: //us-u.openx.net/w/1.0/sd?id=537072968&val=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&us_privacy=
Date: Fri, 15 Dec 2023 18:47:21 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C0C0
Redirect Chain

https://creativecdn.com/cm-notify?pi=openx&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073053&val=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=openx&gdpr=0

43 B
61 B

103ms
102ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073053&val=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=openx&gdpr=0
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073053&val=AcVNOTqsGhhLu2BhXLbN9pAXxE-9z6A2tpiUxHRg8gk&pi=openx&gdpr=0
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT, Fri, 15 Dec 2023 18:47:16 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58771/ Frame CDFB 316 B
408 B 40ms
39ms XHR
application/json 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58771/fed?1p=0&gdpr=0&gdpr_consent=&us_privacy=&pixelId=58771&puid=07160776-0d07-4aa5-9070-0a5e544b9382

Requested by

Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=express.ba&e=27&uid=07160776-0d07-4aa5-9070-0a5e544b9382

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

6e0e13e630bb52a516765314a058d1047c220046fa513db1e2e64a35bc98cb8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://prebid.a-mo.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://prebid.a-mo.net
content-type: application/json
access-control-allow-credentials: true

POST
H/1.1 204
No Content rum
id.rtb.mx/ Frame CDFB 0
478 B 110ms
34ms Ping
text/plain 131.153.242.59
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://id.rtb.mx/rum?
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 131.153.242.59 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://prebid.a-mo.net/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://prebid.a-mo.net
date: Fri, 15 Dec 2023 18:47:16 GMT
access-control-allow-credentials: true

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C5CD 16 KB
12 KB 55ms
54ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202312060101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7dd29b256fe032b6401217b17e7c0eba7835d0f5a00f6f404cf389e71b1ebb66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12061
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 453A 0
0 53ms
52ms Fetch
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst7-Zm6eLO2MuROx-D2YbJS8FjAJpCFKT4MXmAf3aDvQHhlfTJU3145QBNW8UKH975mkZiYr8_NC8oSmFtugASsZO9mUsvsU8TZF9kc8MXz46ZVJXQLukZPBjrTnWraP-SJD8268VGv7iurAKTyskCVFIphrBaoONU5174C7qLZfUi5-P8ljSlROsBJZwgWayzk24Aen9wVROMNxkcTaLyHop77TWVdaYsg50OXtUJPRa7RNITGjdW5zYW6C2P17KrZrs2Hjeh5uvCm-Qo6x9zmcv6RH6cdnqaRyY_J0104shPswQO_wP-T1IrFa5CBJTtDYRs6KZn0SZSBya7efs58LwiODF0tRJXxuuWHaMUrqqAUufQ&sai=AMfl-YRHS4wIOytqRqTLkB63HS6g2-GJZYVPihMzk-52RYulE2e94wBEDpgcuYGHizSLhFXPmHiLbm1qUodI-PR2nEB5ycDwePAgzHGY_BQG_quv97czsT1Vu20pq5Ko32w&sig=Cg0ArKJSzLpQnskkardhEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 15 Dec 2023 18:47:16 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C5CD 17 KB
6 KB 38ms
37ms Script
text/javascript 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Dec 2023 18:47:16 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1B31 13 KB
5 KB 38ms
37ms Document
text/html 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 17779
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 13:50:57 GMT
expires: Sat, 14 Dec 2024 13:50:57 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8EAE 829 B
559 B 55ms
54ms Document
text/html 142.251.163.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f103.1e100.net

Software

GSE /

Resource Hash

8fe54b89b8efd1c4738d6e9bca6ca9a5fe3ee6d9696436325bb69541fbd605a5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1bH9XPCTzg_uTeaPbeXKPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-1bH9XPCTzg_uTeaPbeXKPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:16 GMT
expires: Fri, 15 Dec 2023 18:47:16 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 1B31 39 KB
15 KB 36ms
36ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 07:42:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39880
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 14 Dec 2024 07:42:36 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D378 42 B
64 B 52ms
51ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsss9A7BIMpcgbrlXk5lMZiUFurdSzanCo8c3EYZlseVCCS8q4L9iDu_qSvAod4TvE-YuEGsKypM8KYo5Aq-weUdZhBrqr1zvtBohJ4Bm2LhXTiFyGIniBlpi447GwA&sig=Cg0ArKJSzG3XTlSVhoeMEAE&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=33&adk=435816778&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702666034139&rpt=1567&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8EAE 0
0 50ms
50ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202312060101&jk=809570336139335&rc=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1B31 0
11 B 35ms
35ms Image
text/plain 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?OuxzZg
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.122.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ Frame 20A6 55 KB
10 KB 30ms
29ms Script
application/javascript 104.22.52.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?partner_id=533&sync=1&url=https%3A%2F%2Fexpress.ba%2F
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/533?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.52.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 29 Nov 2023 15:31:45 GMT
server: cloudflare
x-amz-request-id: 01CC8G5F16RM7B26
age: 6291
etag: W/"13043c1bbaf21ccc6e8ed474a744d3f2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 8360daac681c7115-YYZ
x-amz-id-2: HXRUR8HjAo6USwQLdtHY+PYQf8tGuqDCh/+7XnINsX6lV9HyCEeo0/fdHmm/D8O2xprGCoT8y84=

GET
H2 200 533 Show response
p.ad.gt/api/v1/p/ Frame 20A6 47 KB
15 KB 1078ms
31ms Script
application/javascript 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/p/533
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/533?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41e201fd91d89ceca74cf4e91ae2ace4ad3a87e4c0983ef88c1e0800ffc10bea

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 15 Dec 2023 18:45:47 GMT
server: cloudflare
age: 91
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8360dab2f93736b0-YYZ

GET
H2

200

match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&adnxs_id=5638150801812241363&gdpr=0

43 B
94 B

1130ms
100ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&adnxs_id=5638150801812241363&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab32b04369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
an-x-request-uuid: 90bfdb99-4ad9-4232-9d71-bb64e0df86fb
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&adnxs_id=5638150801812241363&gdpr=0
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

t_match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001702666037-NMMJI2G5-9WFU&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=45905e27-008c-4916-bdda-4ccdb7efc911&id=AU1D-0100-001702666037-NMMJI2G5-9WFU

43 B
95 B

1130ms
104ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=45905e27-008c-4916-bdda-4ccdb7efc911&id=AU1D-0100-001702666037-NMMJI2G5-9WFU
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab32b03369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=45905e27-008c-4916-bdda-4ccdb7efc911&id=AU1D-0100-001702666037-NMMJI2G5-9WFU
date: Fri, 15 Dec 2023 18:47:17 GMT
server: Kestrel
content-length: 259

GET
H2 200 UCookieSetPug
image2.pubmatic.com/AdServer/ Frame 20A6 0
74 B 36ms
33ms Image
text/html 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001702666037-NMMJI2G5-9WFU
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:16 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

rub_match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001702666037-NMMJI2G5-9WFU&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&rub=LQ6ZE5RC-Q-8P8X&gdpr=0

43 B
95 B

1132ms
103ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&rub=LQ6ZE5RC-Q-8P8X&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab31b00369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&rub=LQ6ZE5RC-Q-8P8X&gdpr=0
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

tapad_match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001702666037-NMMJI2G5-9WFU&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001702666037...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001702666037-NMMJI2G5-9WFU&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001702...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&tapad_id=0433d3ad-107d-4647-8d7c-b67b2dbd45a6

43 B
95 B

538ms
114ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&tapad_id=0433d3ad-107d-4647-8d7c-b67b2dbd45a6
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab32b07369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&tapad_id=0433d3ad-107d-4647-8d7c-b67b2dbd45a6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

g_match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001702666037-NMMJI2G5-9WFU
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&google_gid=CAESEMKaEQPEQEKAIVp60B1bz2g&google_cver=1&google_ula=450542624,0

43 B
170 B

1022ms
99ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&google_gid=CAESEMKaEQPEQEKAIVp60B1bz2g&google_cver=1&google_ula=450542624,0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab31afe369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&google_gid=CAESEMKaEQPEQEKAIVp60B1bz2g&google_cver=1&google_ula=450542624,0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 357
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 20A6
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001702666037-NMMJI2G5-9WFU
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcwMjY2NjAzNy1OTU1KSTJHNS05V0ZV

170 B
195 B

45ms
44ms

Image
image/png

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcwMjY2NjAzNy1OTU1KSTJHNS05V0ZV

Requested by

Host: express.ba
URL: https://express.ba/

Protocol

Server

142.251.163.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTcwMjY2NjAzNy1OTU1KSTJHNS05V0ZV
date: Fri, 15 Dec 2023 18:47:18 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab31afd369c-YYZ
content-type: text/html; charset=utf-8

GET
H2 200 ip_match
ids.ad.gt/api/v1/ Frame 20A6 0
203 B 1169ms
103ms Image
text/html 104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/ip_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab31af6369c-YYZ
content-type: text/html; charset=utf-8

GET
H2

200

son_match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&uid=b3786afc-c6d9-4961-b1c3-da11bd202aa8&gdpr=0

43 B
118 B

99ms
98ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&uid=b3786afc-c6d9-4961-b1c3-da11bd202aa8&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:19 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab90e03369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-123
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001702666037-NMMJI2G5-9WFU&uid=b3786afc-c6d9-4961-b1c3-da11bd202aa8&gdpr=0
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

adb_match
ids.ad.gt/api/v1/ Frame 20A6
Redirect Chain

https://dpm.demdex.net/ibs:dpid=348447&dpuuid=AU1D-0100-001702666037-NMMJI2G5-9WFU&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fadb_match%3Fadb%3D%24%7BDD_UUID%7D%26id%3DAU1D-0100-001702666037-NMMJI2...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=348447&dpuuid=AU1D-0100-001702666037-NMMJI2G5-9WFU&redir=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fadb_match%3Fadb%3D%24%7BDD_UUID%7D%26id%3DAU1D-01...
https://ids.ad.gt/api/v1/adb_match?adb=04772667596683531553794342835321865364&id=AU1D-0100-001702666037-NMMJI2G5-9WFU

43 B
95 B

282ms
115ms

Image
image/gif

104.22.4.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/adb_match?adb=04772667596683531553794342835321865364&id=AU1D-0100-001702666037-NMMJI2G5-9WFU
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 104.22.4.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dab32b05369c-YYZ
content-length: 43
content-type: image/gif

Redirect headers

dcs: dcs-prod-va6-1-v053-0153aa08c.edge-va6.demdex.com 2 ms
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: 6rUa833tQGQ=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://ids.ad.gt/api/v1/adb_match?adb=04772667596683531553794342835321865364&id=AU1D-0100-001702666037-NMMJI2G5-9WFU
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 10 KB
10 KB 60ms
60ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c091ade709536f2d388d8c5035bfdcfdcf28134841241059080826286da5a57a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 10510
expires: Mon, 18 Nov 2024 18:28:00 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 7 KB
7 KB 51ms
50ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F43F7SKFE5D-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=qRWxS0QeZbx9kQnILOtAFfgk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e698d29e537e67f92d8cf8565c382c607686f75a5a53cdd09675571287dcb51f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7322
expires: Thu, 28 Nov 2024 00:49:16 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 9 KB
9 KB 48ms
48ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF320CP3X6-1211_IS%3F%24productMain%24&v=3&w=400&rid=4&s=mq1VyFPp3jHzze0aOv9LMRzM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

11922ffe5aab54bdba73ad8871610c6d0fececd907f10e13488e2218fb49923b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8796
expires: Sun, 03 Nov 2024 00:26:37 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 15 KB
15 KB 43ms
43ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S1GTTC7L-2727_IS%3F%24productMain%24&v=3&w=400&rid=4&s=_jI8PvjehlKOOdk5aZbA29TI&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbfb42bbd959835533d239ef19310619a117d5a095541ba3f27aac66a2338b95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15112
expires: Wed, 06 Nov 2024 18:28:29 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 8 KB
9 KB 41ms
40ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F49S0POFS2B-1717_IS%3F%24productMain%24&v=3&w=400&rid=4&s=6rz_Fxny5riIiKkmZN-J4HHf&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b3cbd7af67c3bed2a60eb4c082690a67c565f4d79e759fa742bd24c8f13079ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8680
expires: Thu, 07 Nov 2024 13:03:42 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 12 KB
12 KB 37ms
36ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35H3G4ML3I-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=Ix1gchvyHdoVZK5twUw2Q5I8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

146a9bbee8f833fceb2cc48feadf8fa278ae3ca908262652627006649ad120c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12130
expires: Thu, 07 Nov 2024 18:39:23 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 12 KB
12 KB 35ms
34ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35H3G4ML3I-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=Ix1gchvyHdoVZK5twUw2Q5I8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

146a9bbee8f833fceb2cc48feadf8fa278ae3ca908262652627006649ad120c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12130
expires: Thu, 07 Nov 2024 18:39:23 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 5 KB
5 KB 38ms
38ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F40F3NRFP1M-0705_IS%3F%24productMain%24&v=3&w=400&rid=4&s=tq_ELC8ZsvQSR6hfQFgMicsC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4bd934731476db33a22e41f5231fcedbbc1bbea15e98d2850bea0edf20967b38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4780
expires: Sat, 16 Nov 2024 03:09:20 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 16 KB
16 KB 38ms
37ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S3G5GS5B-0200_IS%3F%24productMain%24&v=3&w=400&rid=4&s=KGqZrwtcc_LVKNyWTNGALvfE&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f46d9dd6abd9f05c4124b0b443e4bfedb4bcdd61cc60af814227cd904fcc0a94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15934
expires: Thu, 07 Nov 2024 02:35:05 GMT

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 3CCC 43 B
855 B 43ms
42ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=2C7AB182-9863-4FFF-B278-E03B1388369C&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:17 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 3KFSF7FCFXBA2R8XCBYV

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame F290 43 B
479 B 94ms
54ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID41CE66C8-318C-4EBB-B3C2-3961E31F5C37

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:17 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: DYA6BTW6RN0TYQJC35E3

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4B9F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=LHqxgphjT_-yeOA7E4g2nA%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

45ms
44ms

Image
text/html

23.220.136.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 23.220.136.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-136-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=55293
accept-ranges: bytes
content-length: 5622
expires: Sat, 16 Dec 2023 10:08:50 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 4B9F
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=2C7AB182-9863-4FFF-B278-E03B1388369C
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=2C7AB182-9863-4FFF-B278-E03B1388369C
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2C%2C

95 B
124 B

56ms
56ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-34-199-214-171.compute-1.amazonaws.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2C%2C
date: Fri, 15 Dec 2023 18:47:17 GMT
server: Kestrel
content-length: 359

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame 4B9F 0
0 3535ms
39ms Image
text/html 40.76.134.238

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%202C7AB182-9863-4FFF-B278-E03B1388369C&rnd=RND
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame 4B9F
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=2C7AB182-9863-4FFF-B278-E03B1388369C&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=2C7AB182-9863-4FFF-B278-E03B1388369C&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
355 B

40ms
40ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=2C7AB182-9863-4FFF-B278-E03B1388369C&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=2C7AB182-9863-4FFF-B278-E03B1388369C&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4B9F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBJDJKRB6QEGfz8M9Ett24s&google_cver=1

0
74 B

46ms
45ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBJDJKRB6QEGfz8M9Ett24s&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 09:05:46 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBJDJKRB6QEGfz8M9Ett24s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4B9F
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:D0812E5B1E9348BAA3CDA37D98868D87

0
74 B

38ms
37ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:D0812E5B1E9348BAA3CDA37D98868D87
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:17 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:D0812E5B1E9348BAA3CDA37D98868D87
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 14 Dec 2023 18:47:17 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4B9F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=45905e27-008c-4916-bdda-4ccdb7efc911&gdpr=0&gdpr_consent=

0
74 B

47ms
45ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=45905e27-008c-4916-bdda-4ccdb7efc911&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 08:53:46 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=45905e27-008c-4916-bdda-4ccdb7efc911&gdpr=0&gdpr_consent=
date: Fri, 15 Dec 2023 18:47:17 GMT
server: Kestrel
content-length: 355

GET
H2 200 2C7AB182-9863-4FFF-B278-E03B1388369C
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 4B9F 43 B
602 B 41ms
40ms Image
image/gif 34.199.214.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/2C7AB182-9863-4FFF-B278-E03B1388369C?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.199.214.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 4B9F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=2C7AB182-9863-4FFF-B278-E03B1388369C&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-xus92SZE2uUfqlzpkA4sRR75heAk27A-~A&gdpr=0

0
179 B

384ms
28ms

Image
text/plain

162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-xus92SZE2uUfqlzpkA4sRR75heAk27A-~A&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-xus92SZE2uUfqlzpkA4sRR75heAk27A-~A&gdpr=0
date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
5 KB 34ms
34ms Image
image/png 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

babd8650a8cadcc75647b57b58e1ef1c695d8b12c68ea9bff01efe0952864cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4726
expires: Tue, 03 Dec 2024 02:17:35 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 7 KB
7 KB 34ms
34ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF320B23SB-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=coPU9lNHBkJA7olZSLfVizP5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

522c4bcc0a0fc0669b180faeed7968249a69a42786ae17afd16c44ee21e9b2d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7172
expires: Fri, 22 Nov 2024 02:51:44 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 13 KB
13 KB 35ms
35ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S0GTVU6L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=0O9lSdVGPEHy2Hz8MkNfC71H&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d741d8096212c810a0bc4bb29d346e1935876b4e732cd673f62f422dcbbcb820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 13410
expires: Sun, 10 Nov 2024 12:38:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
6 KB 35ms
35ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T0STVL9L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=20gctjrhqnxLZprUXiqxJpOK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

975a84ca7d8d45e7dd62e2594d16f9f85e3ea5dec02b15284607e2672f1c725c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 5466
expires: Sun, 03 Nov 2024 00:42:08 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 11 KB
12 KB 35ms
35ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35R3GTTN5L-2610_IS%3F%24productMain%24&v=3&w=400&rid=4&s=jdEYiEU8Bl4_cmvZ-WcMqdQZ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e141fe2cbc31c3ab7bbbe688a6c0f400d9ce7bc8e582101cedddc436600ac710

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 11572
expires: Sat, 16 Nov 2024 18:54:58 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 23 KB
23 KB 37ms
36ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35F1GTVC2B-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=H8LsZDQYQzVtIZaSeZoW9hU9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f68feb7d2c422985b076933dc911e2733619224811e676fa7814cebbeb2d551a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 23254
expires: Tue, 19 Nov 2024 09:16:52 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 7 KB
7 KB 37ms
36ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F30F3G6LL1L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=6vtf9GjeieTk9V25oBsTfRo-&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f3c54aa7d215fcd207dd3b51711cdad400c5a3f692bf74430a42538d34559450

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 6714
expires: Sat, 09 Nov 2024 00:08:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 4 KB
4 KB 37ms
37ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T6GTVE3L-7278_IS%3F%24productMain%24&v=3&w=400&rid=4&s=ay_sRZxNk5CLLAWivAgUqGb1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8587d0a809d63c84caf52ba2cc35d4786b4e4e30bc0b3387f615be1245fff036

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 3846
expires: Tue, 26 Nov 2024 01:27:50 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 8 KB
8 KB 37ms
37ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T9GTVT0L-6487_IS%3F%24productMain%24&v=3&w=400&rid=4&s=ZHHKxcxOdeHh-54srrrWJ91p&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fb99eff8eb3c2a1988444b9973ab465919eb71cdd1f3bbc955efc67766bfe4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7824
expires: Wed, 06 Nov 2024 05:54:58 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 12 KB
12 KB 41ms
39ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35T0GTVT3V-0150_IS%3F%24productMain%24&v=3&w=400&rid=4&s=MsuQfAWlEM8SnsFqT4G7TevT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5ec0ee7217c892fbda0e022df902fcbaa3d7c75b520eacba4bf35d2fffe3ebd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12504
expires: Sat, 30 Nov 2024 03:34:12 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2B23 5 KB
6 KB 43ms
42ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35F0GTVT9L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=wgarpN4PJlOcOwBqgRiP2Um_&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

6de1bee6a82f761cea041a8d6e03e35ecebe493a804db8114ffaf6f988cbc76f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 5630
expires: Wed, 13 Nov 2024 02:24:50 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 8 KB
8 KB 44ms
42ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F30H3SUSL6L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=iuxZttseBBAl_AF2bBgpLXO2&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

712aa9e4985b6621cd976b0b1a350e254ef08c073b9b0482ac0e85d0b91cc0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7872
expires: Sat, 30 Nov 2024 02:29:40 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 7 KB
7 KB 42ms
41ms Image
image/png 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

49de2f52b6108cbfe2bc5941f3c022ccefc0441db507dce1ab3f22dc232a7d73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 7176
expires: Tue, 03 Dec 2024 02:17:35 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 13 KB
13 KB 41ms
40ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35S0GTVU6L-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=0O9lSdVGPEHy2Hz8MkNfC71H&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d741d8096212c810a0bc4bb29d346e1935876b4e732cd673f62f422dcbbcb820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 13410
expires: Sun, 10 Nov 2024 12:38:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 12 KB
12 KB 106ms
105ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F40H3RWFE6D-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=_4inuAy-ppuNfz-qCYncYjYd&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f65e02828b97a4eeca0158c111dc6248f1cfcf4c63e401a458e9542006cac349

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12396
expires: Thu, 21 Nov 2024 05:13:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 23 KB
23 KB 46ms
46ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F35F1GTVC2B-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=H8LsZDQYQzVtIZaSeZoW9hU9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f68feb7d2c422985b076933dc911e2733619224811e676fa7814cebbeb2d551a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 23254
expires: Tue, 19 Nov 2024 09:16:52 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 8 KB
9 KB 45ms
45ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2FMF330I4AR3-0001_IS%3F%24productMain%24&v=3&w=400&rid=4&s=R8eI7gfg1ObDBhrbBBNkI8Vt&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

edaf499c564f453ea4161cf202d4cd2374552dca1880feca8eb0ae21dd51b839

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8690
expires: Fri, 08 Nov 2024 01:32:20 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 421C 22 KB
23 KB 44ms
43ms Image
image/webp 74.119.119.80
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=78881&q=80&r=0&u=https%3A%2F%2Fmichaelkors.scene7.com%2Fis%2Fimage%2FMichaelKors%2F30F3GIMM1H-0005_IS%3F%24productMain%24&v=3&w=400&rid=4&s=ayv2N5j9yp2d3mF3GTrMqj1M&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.80 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1619c1b217e49982ddf7561b7a3dae46808ee435fa323aed321b02b00105391d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:16 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 22996
expires: Thu, 07 Nov 2024 03:39:31 GMT

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame E441 43 B
855 B 85ms
42ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:17 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 1M3NW5CQ26KAEYVHA9WB

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame EA7F 43 B
479 B 112ms
41ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID41CE66C8-318C-4EBB-B3C2-3961E31F5C37

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 15 Dec 2023 18:47:17 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 29MJNC76MMMRC9BSVACE

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4B9F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Qc5myDGMTruzwjlh4x9cNw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

33ms
33ms

Image
text/html

23.220.136.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 23.220.136.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-220-136-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=55293
accept-ranges: bytes
content-length: 5622
expires: Sat, 16 Dec 2023 10:08:50 GMT

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 4B9F
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=41CE66C8-318C-4EBB-B3C2-3961E31F5C37
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=41CE66C8-318C-4EBB-B3C2-3961E31F5C37
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2C%2C

95 B
124 B

54ms
53ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-34-199-214-171.compute-1.amazonaws.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=45905e27-008c-4916-bdda-4ccdb7efc911&ttd_puid=0433d3ad-107d-4647-8d7c-b67b2dbd45a6%2C%2C
date: Fri, 15 Dec 2023 18:47:17 GMT
server: Kestrel
content-length: 359

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%2041CE66C8-318C-4EBB-B3C2-3961E31F5C37&rnd=RND
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame 4B9F
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
355 B

40ms
39ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4B9F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDFDRTY2QzgtMzE4Qy00RUJCLUIzQzItMzk2MUUzMUY1QzM3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

0
74 B

33ms
33ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-mediagrid_n-index_n-LoopMe_n-MediaNet_ox-db5_smrt_cnv_pm-db5_n-simpli.fi_rbd_n-vmg_n-baidu_sovrn_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:17 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 41CE66C8-318C-4EBB-B3C2-3961E31F5C37
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 4B9F 43 B
602 B 47ms
21ms Image
image/gif 34.199.214.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/41CE66C8-318C-4EBB-B3C2-3961E31F5C37?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.199.214.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:17 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C5CD 0
0 54ms
52ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202312060101&jk=809570336139335&bg=!19Sl1JvNAAY3kmNgF5I7ADQBe5WfOFo0YT8mziVbIAMBDtYUTwpGZIC4wpl6y_QI1H_aV68kpimqhhVQsADLt_5IQNf1AgAAAFJSAAAACWgBB5kDAYxk9fBnWB_m6jf3IIbJrbxRbUjm_AOSVHiozRnhaYy2Ka6EtkrR_JVzcAk9WFsDrUqiC3Oze0-DU6rjcC7tQoxPhnoJBR932BO4ifygQld3Yy-MMJqz6iAisWbrCp9HL2YKJpbbNPrNYezbVimeQGhQ6tGBR5aHB2n_VGBiOUo9awDDSpYO6fSkRBGXTbKXyyHGqozDuBiITF89irZz7tHul98011Zl5XvKQ5GK_Go06ZArL2FzW1TIQXcWq-A1etwBbXf9EocX3U0fdAiBfwug1mTZ5YsukzAqaLAC8YJOYrwzkL9FFDFgja7X8jAuT9atBdtHUG_B-Nk_2diwwy0BvWaTmeWoWEDn8rXqJ3AufbSxnyseUHJ6BFrZaT2bVBX9QVyJSiRB2sTuseOIXdXbZ9WlaVWlIgVOc3HtQgABKjXAv_5qzJ4ZzqpfCU5v6R-_A3BzIGBFzTVhFi9R84U5zWn0twrquY7_OUgqB7f6TR7AMblQCP49MDVqR4Roy6NXvShrajG6nqpWP5RURMX7nbhs0EZEvucq1g9EjCI-NlyjFJjwI1eF8f7Kjfu6QSWNCGf4fSSKmKqwyL3uSxpZbhRHN0-a0A7WhyQ4mSmQHd8KZVoMgck9Wz-euaRk5SZfBcp8moWJj59VeZK-IhFH-_G9ZuCpcIEKIM69KkYMqIungYJiV5Tw8FtVyvPhtmNFfmdBagwNvj8gYm3F0jLsyUtWLV8ItbR7Vayg8TgBr8Jj959rDUbGq7_5L958PoyzYy4UoyOw_DyQFvBeLx_t_Xh6URIzWizROzwpY4-dhW3lJjvYx0gU4c5TBuX51_ZM0jLBatXSwonHly0_At4QYZfS6L8WfWKJAfmCOE_uzngpAlBlRk86veza-Dka-XFJ_MZ0oa41v1Sy-Lp4XhCp8HGMiLM4TLqYYSbAiGIW2x6BPa_SBSIsb2QB7KWz4g6Da5Fgdvmz9O4ZktpS-IaAQ0EKLyMBInNVVR6vubKx-VCOitnGCjSbfl4eX31Adcs
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

POST
H2 200 node.php Show response
node.setupad.com/node/ Frame 20A6 0
240 B 4251ms
130ms XHR
text/html 159.89.25.223

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:21 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: X-Requested-With

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 20A6 52 KB
21 KB 37ms
36ms Script
text/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/533

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 15 Dec 2023 18:25:19 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1319
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 15 Dec 2023 20:25:19 GMT

POST
H2 204 collect Show response
a.ad.gt/api/v1/ Frame 20A6 0
158 B 140ms
103ms XHR
text/html 104.22.5.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.5.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://express.ba/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://express.ba
access-control-allow-credentials: true
cf-ray: 8360dab38f7836c1-YYZ

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ Frame 20A6 0
109 B 1413ms
110ms Script
text/html 172.67.23.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=e26433f7a5bc33ce3b7378380dab733f&url=https%3A%2F%2Fexpress.ba%2F&code=%27none%27
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.23.234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:19 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8360dabb7ad339db-YYZ
content-type: text/html; charset=utf-8

GET
H3 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ Frame 20A6 1 KB
655 B 36ms
36ms Script
text/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:24:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1344
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 630
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 15 Dec 2023 19:24:54 GMT

GET
H3 200 ec.js Show response
www.google-analytics.com/plugins/ua/ Frame 20A6 3 KB
1 KB 36ms
36ms Script
text/javascript 172.253.63.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:29:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1080
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1129
x-xss-protection: 0
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 15 Dec 2023 19:29:18 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame CF2E 52 KB
17 KB 62ms
20ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 47752
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 15 Dec 2023 18:47:18 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 432, 241008
X-Served-By: cache-lga13626-LGA, cache-yyz4535-YYZ
X-Timer: S1702666039.896355,VS0,VE0

GET
H2 200 sspmatch-iframe Show response
ads.betweendigital.com/ Frame 1376 739 B
822 B 38ms
36ms Document
text/html 172.240.127.129
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/sspmatch-iframe
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.240.127.129 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 182a797aeaa7d05d72fcfa59b9671749fb51f2c02194aaec7f17a05946bd8cf9

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 739
content-type: text/html

GET
H2 200 isyn Show response
prebid.a-mo.net/ Frame 3A67 692 B
450 B 34ms
33ms Document
text/html 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=CrUBSgpleHByZXNzLmJhUgthYXMtMWFjMDlhOFoIcGJhMS4yLjFqCmV4cHJlc3MuYmH6AQo0LjIxLjAtcHJl6AIBiAOwvvKrBqgDFuoDJGJiYzg4Y2UwLWE5MWYtNGZhZS04YzE1LWU2MjJlZDRlZWViNaoEA0RDSLIFA1VTRNIFCTEwNTE5OTQyMdgFAeAFAeoFB2Rlc2t0b3D6BQRkYzEzqgcDd2ViygcKZXhwcmVzcy5iYeAHAQ
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/postbid/stpd201221.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: a79148d54f2086f3227128d4fa74caae4b100dfbdc1e05c394fdd18533682b77

Request headers

Referer: https://express.ba/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 395
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:18 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame C5CD
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?uid=07160776-0d07-4aa5-9070-0a5e544b9382
https://prebid.a-mo.net/setuid/yahoo?uid=y-tGvHidlE2uHNEZ9Q8ocEwHtBRG5dz.OlfMZPRJI-~A

0
112 B

35ms
35ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-tGvHidlE2uHNEZ9Q8ocEwHtBRG5dz.OlfMZPRJI-~A
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-tGvHidlE2uHNEZ9Q8ocEwHtBRG5dz.OlfMZPRJI-~A
date: Fri, 15 Dec 2023 18:47:18 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
prebid.a-mo.net/ Frame C5CD
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=07160776-0d07-4aa5-9070-0a5e544b9382&gdpr=0&us_privacy=1---
https://dis.criteo.com/dis/usersync.aspx?r=25&p=52&dis=0&gdpr=0&gdpr_consent=&url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D462%26ssp%3Dadaptmx%26user_id%3D%40%40CRITEO_USERID%40%40
https://x.bidswitch.net/sync?dsp_id=462&ssp=adaptmx&user_id=k-1CpeBj-ETjojdFBLwV0vsokddBAx4D_UcodSew&gdpr=0&gdpr_consent=
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=&us_privacy=

0
113 B

35ms
35ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://express.ba/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=&us_privacy=
Date: Fri, 15 Dec 2023 18:47:18 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 3A67 13 KB
6 KB 34ms
32ms Script
text/javascript 104.19.158.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=CrUBSgpleHByZXNzLmJhUgthYXMtMWFjMDlhOFoIcGJhMS4yLjFqCmV4cHJlc3MuYmH6AQo0LjIxLjAtcHJl6AIBiAOwvvKrBqgDFuoDJGJiYzg4Y2UwLWE5MWYtNGZhZS04YzE1LWU2MjJlZDRlZWViNaoEA0RDSLIFA1VTRNIFCTEwNTE5OTQyMdgFAeAFAeoFB2Rlc2t0b3D6BQRkYzEzqgcDd2ViygcKZXhwcmVzcy5iYeAHAQ
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.19.158.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ab92351c5b74146b13c457ed9bea87ccf1185338bf2a1b9583194ffad7a224

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
via: 1.1 1df98836515ac348d12c9af86e1ecc48.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: YUL62-C1
age: 144
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 17 Nov 2023 21:37:06 GMT
server: cloudflare
etag: W/"e3fef3a35c249816d0d7aa58df5e6bf4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 8360dab71ac139f5-YYZ
x-amz-cf-id: Y6nq402-I27k2gEMhKBNm8fa5Z_LygcrPXCD6HMKGizE9Pi2HNcubA==
expires: Fri, 15 Dec 2023 19:47:18 GMT

GET

sync
pool.admedo.com/ Frame 1376
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=9c86f74d-193d-41d2-be03-eed49aa43cfa

0
0

GET
H2

200

match
ads.betweendigital.com/ Frame 1376
Redirect Chain

https://ads.adlook.me/csync?pid=btw&uid=e2e97247-c0f7-535d-a46d-f0fec1116fce&url=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D128%26external_user_id%3D%7BuserId%7D
https://ads.betweendigital.com/match?bidder_id=128&external_user_id=d90a572138bb4f72ba761a87dae65f10

68 B
599 B

359ms
37ms

Image
image/png

172.240.127.129
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=128&external_user_id=d90a572138bb4f72ba761a87dae65f10
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 172.240.127.129 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

location: https://ads.betweendigital.com/match?bidder_id=128&external_user_id=d90a572138bb4f72ba761a87dae65f10
date: Fri, 15 Dec 2023 18:47:19 GMT
server: Microsoft-IIS/10.0

GET
H2

200

match
ads.betweendigital.com/ Frame 1376
Redirect Chain

https://px.adhigh.net/p/cm/btw
https://px.adhigh.net/p/cm/btw?bounced=1
https://ads.betweendigital.com/match?bidder_id=37&external_user_id=L9h7RJE31ll.AikABlGMbs3wgA

68 B
598 B

271ms
38ms

Image
image/png

172.240.127.129
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=L9h7RJE31ll.AikABlGMbs3wgA
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 172.240.127.129 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
server: nginx
x-backend-id: f7-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: *
location: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=L9h7RJE31ll.AikABlGMbs3wgA
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

match
ads.betweendigital.com/ Frame 1376
Redirect Chain

https://ups.analytics.yahoo.com/ups/58665/occ?gdpr=0&gdpr_consent=
https://ads.betweendigital.com/match?bidder_id=251&external_user_id=eS10R3ZIaWRsRTJ1SE5FWjlROG9jRXdIdEJSRzVkei5PbGZNWlBSSkktfkE%3D&gdpr=0

68 B
598 B

37ms
36ms

Image
image/png

172.240.127.129
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=251&external_user_id=eS10R3ZIaWRsRTJ1SE5FWjlROG9jRXdIdEJSRzVkei5PbGZNWlBSSkktfkE%3D&gdpr=0
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 172.240.127.129 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

location: https://ads.betweendigital.com/match?bidder_id=251&external_user_id=eS10R3ZIaWRsRTJ1SE5FWjlROG9jRXdIdEJSRzVkei5PbGZNWlBSSkktfkE%3D&gdpr=0
date: Fri, 15 Dec 2023 18:47:18 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sync Show response
vid.vidoomy.com/ Frame 7211 49 KB
19 KB 1274ms
52ms Document
text/html 37.19.206.5
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.vidoomy.com/sync?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D261%26external_user_id%3D{{VID}}
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.19.206.5 Ashburn, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: 476000398.ash.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 4cd9d7fe6bef9e82616b20d2c4a7a9842652ed469b704922e4c682f209754768

Request headers

Referer: https://ads.betweendigital.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
content-encoding: gzip
content-type: text/html
date: Fri, 15 Dec 2023 18:47:20 GMT
etag: W/"64abbb76-c2af"
last-modified: Mon, 10 Jul 2023 08:04:06 GMT
server: CDN77-Turbo
vary: Accept-Encoding
x-77-age: 924412
x-77-cache: HIT
x-77-nzt: EgwBJRPOBAH3/BoOAAgBnJI73wFB
x-77-nzt-ray: 8e305f1cd3422af0389f7c65d8170a08
x-77-pop: ashburnUSVA
x-accel-date: 1701741628
x-accel-expires: @1702778428
x-age-lb: 924412
x-cache-lb: HIT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame CF2E 0
593 B 35ms
35ms Script
text/html 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:18 GMT
an-x-request-uuid: da5c7dbc-2d0a-4115-8ff2-d5f79bfd0286
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 84E0 5 KB
5 KB 28ms
28ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=772637&p=156191&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 15181661074d9d4be7f6380de653aef446d3b31558c42f1bcce169d6e57e45cb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 15 Dec 2023 18:47:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET

pixel
cm.g.doubleclick.net/ Frame F8D1
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCanJVN0stVDRBQUJMcm1nTHFqUQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&b...

0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 343D
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5638150801812241363&gdpr=0&gdpr_consent=

0
74 B

34ms
34ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5638150801812241363&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 09:04:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: e5c2fa52-d973-4792-8cb5-e8537edb0528
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:19 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5638150801812241363&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 86.48.14.74; 86.48.14.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET 141
match.deepintent.com/usersync/ Frame 759C 0
0

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 01A3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
236 B

42ms
41ms

Document
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZXyfNwAHKmh_ZwBd
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Fri, 15 Dec 2023 18:47:19 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4551-YYZ
x-timer: S1702666040.701718,VS0,VE21

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Fri, 15 Dec 2023 18:47:19 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZXyfNwAHKmh_ZwBd
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4551-YYZ
x-timer: S1702666040.659694,VS0,VE21

GET

Pug
simage2.pubmatic.com/AdServer/ Frame 1CCE
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=64a28da8-cd01-4ab1-8d69-a28b2fccc291&ssp=pubmatic&expires=30&user_group=5&bsw_param=9c86f74d-193d-41d2-be03-eed49aa43cfa
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=9c86f74d-193d-41d2-be03-eed49aa43cfa&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 48F9
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zBPdWsNA2F_XRY8MwhXHDZtD0g7XQoxcmxZm12UK

0
74 B

34ms
33ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zBPdWsNA2F_XRY8MwhXHDZtD0g7XQoxcmxZm12UK
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 09:05:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Fri, 15 Dec 2023 18:47:19 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zBPdWsNA2F_XRY8MwhXHDZtD0g7XQoxcmxZm12UK
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2 200 i.match Show response
a.tribalfusion.com/ Frame E676 43 B
489 B 93ms
92ms Document
image/gif 104.18.25.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 8360dab88f5939d5-YYZ
content-length: 43
content-type: image/gif; charset=utf-8
date: Fri, 15 Dec 2023 18:47:19 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

GET bridge
cm.adgrx.com/ Frame CAB8 0
0

GET ping_match.gif
pm.w55c.net/ Frame 1CBA 0
0

GET sync
sync.srv.stackadapt.com/ Frame F794 0
0

GET pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame A309 0
0

GET cm
p.rfihub.com/ Frame BC2D 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 198C
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

0
74 B

34ms
33ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 09:05:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Fri, 15 Dec 2023 18:47:18 GMT
expires: Fri, 15 Dec 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 1372215
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 3A85 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 1E97
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUd2f65326516842f6ada3c74adda61946

0
74 B

34ms
33ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUd2f65326516842f6ada3c74adda61946
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUd2f65326516842f6ada3c74adda61946
pragma: no-cache
server: nginx

GET tum
ums.acuityplatform.com/ Frame 96C6 0
0

GET /
csync.loopme.me/ Frame 415D 0
0

GET img
sync.mathtag.com/sync/ Frame 5242 0
0

GET pubmatic
gocm.c.appier.net/ Frame 1E01 0
0

GET
H2

503

cs Show response
ad.turn.com/r/ Frame 098A
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://ad.turn.com/r/cs?pid=45&rndcb=1274808849

107 B
156 B

3030ms
3030ms

Document
text/html

69.194.242.12

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.turn.com/r/cs?pid=45&rndcb=1274808849
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.194.242.12 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache
content-length: 107
content-type: text/html

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html
date: Fri, 15 Dec 2023 18:47:19 GMT
etag: RX76c6158e892a4b5d8768fcb7ed849c5f005
expires: 0
location: https://ad.turn.com/r/cs?pid=45&rndcb=1274808849
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
pragma: no-cache

GET cm
ipac.ctnsnet.com/int/ Frame D9AD 0
0

GET cookiesync
core.iprom.net/ Frame 063A 0
0

GET insync
thrtle.com/ Frame 84E0 0
0

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame 84E0 43 B
61 B 110ms
103ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&gdpr=0&gdpr_consent=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET Martin
crb.kargo.com/api/v1/dsync/ Frame 84E0 0
0

GET sync
sync.bfmio.com/ Frame 84E0 0
0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 84E0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-xus92SZE2uUfqlzpkA4sRR75heAk27A-~A&gdpr=0

0
47 B

28ms
27ms

Image
text/plain

162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-xus92SZE2uUfqlzpkA4sRR75heAk27A-~A&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-xus92SZE2uUfqlzpkA4sRR75heAk27A-~A&gdpr=0
date: Fri, 15 Dec 2023 18:47:19 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 84E0
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=55e8b4961504070a&is_secure=true&networkId=17100&version=1&nuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACpNFtsmHL2wNlSJuHAAAAAAA&expiration=1702752439&nuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&...

0
74 B

35ms
34ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACpNFtsmHL2wNlSJuHAAAAAAA&expiration=1702752439&nuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 18:47:17 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACpNFtsmHL2wNlSJuHAAAAAAA&expiration=1702752439&nuid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame 84E0 0
0

GET sn.ashx
pmp.mxptint.net/ Frame 84E0 0
0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 84E0
Redirect Chain

https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_5d5549d5-9b7a-11ee-8863-125335d52042&gdpr=0

0
74 B

34ms
33ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_5d5549d5-9b7a-11ee-8863-125335d52042&gdpr=0
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 15 Dec 2023 09:03:36 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMTUmdGw9MTI5NjAw&piggybackCookie=cuid_5d5549d5-9b7a-11ee-8863-125335d52042&gdpr=0
date: Fri, 15 Dec 2023 18:47:19 GMT
content-type: text/plain

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 84E0 0
187 B 39ms
33ms Image
text/plain 207.198.113.204
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.198.113.204 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 503 cs
ad.turn.com/r/ Frame 84E0 0
0 3036ms
3030ms Image
text/html 69.194.242.12

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
Requested by: Host: express.ba
URL: https://express.ba/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.194.242.12 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET

Pug
simage2.pubmatic.com/AdServer/ Frame 84E0
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7267268095155049244

0
0

GET
H2 200 cookie
cm.adform.net/ Frame 3A67 43 B
105 B 111ms
110ms Image
image/gif 37.157.6.232
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?&gdpr=0&us_privacy=1---&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D07160776-0d07-4aa5-9070-0a5e544b9382%26bidder%3Dadform%26uid%3D%24UID
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.232 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:19 GMT
server: nginx
content-length: 43
content-type: image/gif

GET

Pug
simage2.pubmatic.com/AdServer/ Frame 3A67
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&us_privacy=1---&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-m...
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:43094732-4a3c-4f37-809c-ee7c9c7cd6df&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

0
0

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 4B9F 0
47 B 33ms
27ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:18 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4FA3 1 KB
2 KB 28ms
28ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=37719655&p=156212&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: db9197f6426021b1dd15ead5049fe2ccc7541f9d39b7db8cca9f2cb4ec71f11d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 15 Dec 2023 18:47:19 GMT
content-length: 1262
content-type: text/html; charset=UTF-8

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C559 1 KB
2 KB 28ms
28ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=36576017&p=137711&s=137812&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 02e7f656fccb9c7ac019374425ba4f780cda34fd89d49cb4b1ca887dd6cf19aa

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 15 Dec 2023 18:47:19 GMT
content-length: 1261
content-type: text/html; charset=UTF-8

GET pub
matching.truffle.bid/sync/ Frame DD90 0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame 8584
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7559524352113615429P

0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame 1F80
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:D0812E5B1E9348BAA3CDA37D98868D87&gdpr=0&gdpr_consent=

0
0

GET merge
ce.lijit.com/ Frame A299 0
0

GET syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 4FA3 0
0

GET 712188.gif
idsync.rlcdn.com/ Frame 4FA3 0
0

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37/gdpr=0/ Frame 4FA3 49 B
263 B 43ms
41ms Image
image/gif 54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37/gdpr=0/gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.0.25
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 4FA3 95 B
124 B 55ms
53ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&gdpr=0&gdpr_consent=

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401985

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:47:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET syncMe
synchroscript.deliveryengine.adswizz.com/ Frame C559 0
0

GET 712188.gif
idsync.rlcdn.com/ Frame C559 0
0

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37/gdpr=0/ Frame C559 49 B
264 B 51ms
45ms Image
image/gif 54.209.94.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=41CE66C8-318C-4EBB-B3C2-3961E31F5C37/gdpr=0/gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.94.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-94-68.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Dec 2023 18:47:19 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.6.96
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame C559 95 B
124 B 58ms
53ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=41CE66C8-318C-4EBB-B3C2-3961E31F5C37&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS