freedomheadlines.com Open in urlscan Pro
2606:4700:3031::ac43:a0b9 Public Scan

URL: https://smeagol.revcontent.com/cv/v3/G57jROZIc-dVrXFnDrGCgdflYCFPHBQ5t4gfixk04PSrWNB99irTl5XqWSD8ucdVbeDnzGlJP1Q3ocENX2h35Q_EFSIE6rEdZv31K-WJCICZTg9V2bNTCtrausr2zNMxJ20WqYkWJmln56Hh0ZsYEtEEpEtVFV8cE1cx2egurui6liXYwUskEyxroYzyBUlI2gmyWmy-1EXYgsSHUiUfVRHOjtNZIVzUB3yDJ32DQAE_7eQaRkzNZR8TFpGy-oR3ziRGomM18ToO_sLH_Sx-BEGLGF1nmY39MOQAAqOEvyjPsO1uolzBwBZlga_y8wMGzWdAUGyOK1vrRaCTtOGejV9pD6wr4OUlLK-oZ9griYSMXce9B5IuIkL7bLsw-0gt1jjt0x-oqbVtfCRQ0AfIBhPKDk6O4zf0Nz54QYDDfRmFU3iMK1oLb1tENiSybP0SuMsP7NqTbecr-_dKE8Rt6Gi1oAcU5cdh4b0EuCLFXZUu7W25WTEytPq1vJeD0s50585ZqnTmQcZ-DW47PesEvMnqTBh1gtWkXtjbmiJxK2AikFHfg8h2k5SJ2nbNzcYYPxWMnW5NMFpHH04ce3-2yc6G7GYHv_nnO-17X1HgQraGUj0cAkP6OWX1Zw?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQHYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: The Horrifying Truth About CBDTommy Chong

URL: https://smeagol.revcontent.com/cv/v3/Jf5iUkwY2ymZWYioc3acqf30arHcIUzAYnFEYWcSUhVGvPPBvftSSV_JYCHTy8J8iCP3FtYW3jhIanU-DaQQbdT1bpg-IhU-iIutj81AkYRfFwEZmiidWRDXxWkyXdPYKhbupGyNtVeCEiqj6tg5hvatZccq2DOgYrzEsxvnVMCh2OL4SI5iqDgA66AZYJ55Rt7xFiEm63bzmbene4C4mIsANq50GcIso3CEgzEscMIDoXt00JLiQs6gxiGD-0B5ZvsWph0EbMT7qJucy8a-8xeKex5Gv_tJoaCj2c1mnpvDuXl0GbLqZZq03hB6k6Jgd-3VcPMSe1ffQP3-EE1YTtfFA5wIMNvLhHL6CHw1lkBaUnLFIqpmGJZZ7ChFrZinHzBqBVLaSjFkIzrvrniaBCSTjFw7c3vuIO38nH-4P9-IrUC4W-XCXRv33K6bmU1wbpy1btOi5ZzflyFt6DWM_rjZa4hTOXRjIsakdU2F50UOo7lAa75xfx2X6hdET35sUm6cYqt9R6LXL3pwJCQE6NyPqGuwrk8mBq8h3A6Dj0PTJE69nz2m7fXH?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQLYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: (Watch) Out-of-the-box ''Rice Trick'' Elevates Calorie Burning by 326%Fitter For Free

URL: https://smeagol.revcontent.com/cv/v3/YWcYuJIcSuqv0SKYu_cckjK48gMQMR-NzWODEpMT3jsqj68iKw9slvMEhZnEUXkg5-3fkq52TNwDPTdUhbhIwClnWaXjRzdbYIC5tK-Su3eYsDQIYqsarlZzs779Vmu1QbqtMnsOsn2uYbpXUO3fltuYVJ_taty9YeObue2gXoSvONKDc9HiUkNev7wvPEmXAird2v1K3-ZvZ7G2I0QcgDKyXoYkI6MlEZh9vW5c6KCQwP6zTW6WIu5kZzz4KjoERbPuUZp3yWqEQSDdGXkWbeB9gU4ccob5YP3h1ZV0a3w5OKelhXIswTaF7vxwqKJekORWVSF5zcA74AOhX95MF-8NS5av40OgQ_njso6kFprCEEVk4frrQZ1gfThgolil9nRLbHF0TjDQglak6Hs6Wn-2p_cW3H24ksdN234AVm4LJ0wmHrBdv72GR1_ESx1DvguECK4-oWD143GSxANG0FDJ_smDDIxM8C9n1e_pxOPDybBCf1pPC1Y5jG43lVCcLipdvQfe5z15vXhl3xuymQjlHhZPGby1BIW_-a4w6Y1_q12SsNCbjHLk-CQrrNqUUdfY8qDZJG4kRyw9KsStoL2BWGiKFD7-J1NQQeQV5ToCBZw7nrv2aEkHjb-iHBSw8hglhii0NGOmst-Jy5arpoLYYSqdPwhSGZkA9wWp9DAL5hFmvhhSedNa8Y8no_SZNVObWKCccMrvbO_CHcgEaQwqxhJ1KmRpCFz8h35o3gg_wzJIxX1FjFlBRG5LFJ8R3SHT0iV_CJb1k0FEcdxGaUcArNXtH7vyw1fgdjerolU4ugSFztBeBHIGzQye6XV8e4NMGMGYzjdjUB5I10ovIPzZoONU782s_8kd5feNRreDawSsj0JsirWvhZOXYocPc-2XLacbnjhwy5vvNFZQjBySodJ8Ed9YTx6sZgRLX0ZdR6AZ-S-1yhFFsrFR4uiNNjA3fhECI5N5_UK7-BQ2gtXGD39UixBURQjZ2jel9FJIx81LXpEfVCqnMdjsuTVmxUzQsshUd7uxXo8_2ecOjFjH7FtokcibMw8Rjbq_B62el_TeqJAJYPI2twAEBWKabf58i5_bE3bbpSBXKfdL1usFmyJQ_Cq1fcgPgi_nuw2OgiyInACcKVWRe45UCf8aDC5jiVl9prK6vYk19Vo?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQPYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: 4 Foods Linked to Memory Loss (Avoid)Primal Health

URL: https://smeagol.revcontent.com/v3/Ds4TLq7iBl3dTUxwMVqnsIkR7cJC3TmUBOnaYq1dcrur-zrG2os403PgHiYUB-OCPMw1O95A6zIBt5rG3wHySDBnZM_6LHeljC6DePxMspQXPkUt9g9ihcm9kL_aX3-skztwuojerCWBbWErHnQr6XVabXz6Y0NcBjQeAdZ2PaQoIZ0c3aTu-9hvKjHXL21MvMIXRe6o3d0HQJ9NXl6zI4-ydgMpGXIptHUE7N-w-UhK0Bd1jr_vERf5orUEmQvIrAyMfSv-VcWZ7yLYty3exNzhuXD51FgqFn5D68i8zZ8UqP_YjZee26s-Gtv-otF1MSdkHceBb_Yh-CL3mLStWfyyxqJ1Bb9bZJ69YUIw_w3kciycJpEkWhmEIzycT7lJ7c-lfn08e2_ncL4QkvsCx8tziXNVnZMYRHVCE-RdjufHt3okVCv1h_TlRCwbqy_nxBCZz7EWjrvhmls7N3Uc0EDpbtSjRg47aubyuUjv1xu498pWDROcl9wZNArRwzg8yUTU7yzKpZ5zhgfB90KBodHyJ0MJKIgMTZRDMIrVzASjKVQbdlaj07Lc63-ExhPd--kKOdpnDQftSkmm1z5jXweiq0DLSd5duJeake0_x4vSC_4ToIQgQo_20SPCER-DTutntvr5IZC7pVFaGOhn8uR8NeBCbHdGi4tOfUDWJthI?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQTYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: This Weird Trick Can Restore Your Vision Naturally (Watch)Vision Insights

URL: https://smeagol.revcontent.com/cv/v3/suha6DmTijFYzQyw2FNrTtXtxriFjv9InMxyi1548AdEQ36Q4QxKq_H9l5daW3Vaj_VK9WJ-wU8kgp2sa7hHkHrszIQQGo5V0hTGotw8H6OsuOgekOojUcO-anafR5yzrsFUijmx8WluDNfzxFtm5YP_ekWRZ05sy2w_j5GIkGoPRh9Aojbzz4s2o6C4MGdVblv_iNTCyYtw1Qeb5bb2KafoD95Sut019xUsyitFBccqjtxpgVa0EbLyy7QAj31pPqJygktT-gxk05bPmDMuGE3xih3tpVkpj9yenQss7_Wi7Risn9hpMAAdv67-KsBWrCLi9znQdxMg33RspEAxTKB7HT1nTzM11e2ofe1n5MNa4kIj2M4XvnGmHt92RsUjqJpCIPHksma6r5Gmux8QdIS1UMZHsiIo0sKlGgSp4JW7Px9-9Ly70KJsD_ce09-Xasr2e3unYQ-kWRQPlnqIdsosxGlIsYTeHjCuskuWc5JkLVPxCrVwkE-HaYjwLhD5bL2TAkeA6yb1nHDieScPdttpzE3RdBPa-HL0ung6dGZoGN_DEUSrrubqt4CtP3u9ypofpg?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQXYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: This 3-minute Shower Hack 'Flushes Away' Eliminate Instantly Nail Fungus (Watch)Expert Doctor

URL: https://smeagol.revcontent.com/cv/v3/O9el1CVX4HYkC6a5bCiu542M3rksb3XePovVziNIsKemhGkmUrs5Rx3ND_RY6YCcmQDft-yHcDZO_paQqXhv2K_sySomVQKX8eDkD8WCuubu7LkvCfqpSNtoC50zzvgmvpY0YHXw89kXGhOdOfvZgUHFVZVTClg9Pe1EdwFHMpz1jKMXwidTH-xyHZ6zNlWxef9eLP9--78cKs_e_I3tqtIyPwdajGn9KVi6rKa0LLPwAAwmVsdugRjkitCMmaALOY35GyKUZyS8Cb9RMQ2Zgk885xGs0VPHN6DlhYjqyVpM6SdDEx8epKsVFHsvWIQbQhCyAAT6wepCyLAJO7JS60t5TuU_mcYMlU3lVRmv6FfjvltqCcX95nV3k0NaMJ5UgkMx0eeAjO4esNeuBlKVCftAXPjuFHSkhFIpT-XuCmyDuVLci5tCs2URdH_iC7xmcSGeX3OfgDHoPWa4kIgYgpwMiTniOQhF7TyTfWhDtgsxYH4goO_QhR0YgmB82WczjUC7GNsQYxedAfWaaQnbontSQ4AfFw70IdiKGePjpGcRupkzwGKeG_zfJ2BpDg?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQbYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: I Discovered This Little-known Bathroom Sink Prostate Relief MethodThe Healthy Life

URL: https://smeagol.revcontent.com/cv/v3/enQpyWGh2iNrQsJcJQg7KsDJ2vs6K1NCXGq-DhnT4ExID_cqfaSbmtFRPaBuHYSk8erc9vIdcjbQEddgYP30SUHI_uGq36y0HofPBrvriUUHy3Ef3vUmDAEiI05vtNXlUZYXzcbLmYtgtUDcktsceTZpvlTsBkvWyEcMHOBKmfHOVX9-3LTKnvGrZxL8gta1N1h1bdK2R6JSB8WjwP73Il_teROS4h4cwRJLoHcCShiLJEqwtjv4xBn0pUCp3noC6e9usPJLOawLZNwKFmJMJPaiuELwW_pZ7g1b4Jn7L8N2K6IpqmBqeEThv7AuLS81i-JiFqix4Il65lcDf8kzpgAa5czCyW_c50MmFEEl9Wgs9dcm6Zo8_wz18cwFobZX8PGGANstpiT2YehFZNC-735MuPIDq0Sr1yvutp3TlC_SSWcrQ7xJTJW2MooJ3tvZkVZkOTJBOhMUEVS_6e6UVU1Pyq_sB-t73VYhdwpNKjR1sqLh959dYxJDHMNOh6NHzUxIh4BYeMbj_VnZ_Asc4m-IrcmIkUxtcjEhr5Ojc4N9GMLOW_V3XjY?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQfYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Restore Perfect 20/20 Vision Without Glasses, Surgerie or Lens (Watch)20/20 Vision Expert

URL: https://smeagol.revcontent.com/v3/3ZbHllfMx4OVqpWLjyYWq8vU8J1EWPPlABoSlgIMZsPq_n9A14yGPj2AjsG64DPNvAsyECknr-EgeGXlD9P-UuW57I3aekSy16tlDbGqsc6niUyvJ-jFfsX-vl0PapoTtrB6Br0s0sn9GBfzIFV8zUZ-_HQFW4qQ4FTaNYJNBF0jDgV_JCO6eN7fOKUv8PFXolYx-S7KP4jyYQz3YVcI0ZnFcMvC5_4epvI2MUKOEuCHVmfRUwm9mlkCSgbdyqIG0I8JqwygUHb-nXk57h9rIbLf05G5u_vtv2YFqeyXDwjOS6Fzf-mz0P1yZ9Odc0es7BRpC8FjtWNBQU7vYAeT0nNRLloACtW2kVwAVHiMe_Z7ysYxqm-xyJJ88El_lV3IF3tnb-f3ZgL8NsAAHqR82-izCoGdaQPmqOjeBGU83KsDPvBuI2VnZqIui0RuAP7rmPwXmA56zGaD5SgHNY-uyjqJKfBU5jJ4WQxIQ2g43WORwWTJU1w4O3GNKHO6YHQn6L4I0XxeVyT_iJ11eEIcmHEXpwZOgtez8gNFnzTFMm2JSNpLkbEHIlV0--q1OSzAp2ajotgYjMKWASuBkw219Sh1zHgP2ThVuhsbVSIj8MUv6WMWBGwKxy2XyQQzYE2-nUC1u0K7T19jPmn8d8h-E4Oeqp0jHFeG-6J4Um1IHpUwKqAW0LaIIZ8PvYEA5ZIudsNCvT6ngxNBlvXsE5M641H9w_dZ_slzbJeiISeaID26w05Yml7zQzUjjP0EZchJ6G9kEGUOKyEM69lKPkTsNqfUjpc?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQjYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Shed Pounds in Record Time! Drink Your Way to a Slimmer You With Amazing Elixir!Life News Wellness

URL: https://smeagol.revcontent.com/v3/7ZzsFsR4Mp9a20Of871Gzx2geBABjNKF-w974asvDrIOM3zZSynnbO-_bO3SDVQymWmNAsd45x0_4dqxkIk9amb75IrzBPJNuiE3N6N12MYLv6rPADRKREPgxslPLkseeHa0u5kl-goafYG5lUupZa-lKjR5mtWrxVD3jfd7DvHVNrnYhWZn3Yb5hRFBAidsB772S-Lr2UWbBn7TRS8pAUUDqXJSzRR24F9yuprtQB2g_tofyRqs9JBcyJjHOHjTwyWjwTmnENG3sSvvpXfFPGKqTbCgrU4re5GJxEkYTIlrFVr3H5UrGiuBVeyJv3QdVoEWEU41HGYtDehNaG7nf8vnFScqvDElazWG4uxb0ahKHhc9P7jMUEtlJtgpIwMS8eK6Zs-ZMimn322HA5aFMJKrCe-CqHDU4Msdz90v43KCr-Tseo1go0d_KhQ4yOEIwdTXVuq3g2w3TDgpmwU_SxoKgu4tno_pR8eIhP03eQC5tvi0XpNnHF8mhEWX701rzMZdlgyxHgmHTaQMMA9kHeBx77WSAPjPGf_ynqbcslyNEOO3tGxvUiMovMjKYy3yuJkgHnj825_1D0GL-j0DkI-1Jfg4ha172Zf7Y2wRgRF8luovjEUQictAj6_2kKLjsO7qJ1I_xM_OegybHbBeUius4fhIB2KfTQKTn6iMP_dNQpcmbfJ8XDCOCLnui2oOLyNI8KY8RBuxlrBfISPSpvhUtwweVvBFPoc3qdGvXrN8Wtz8jcr-_c3oYF5v8g5Zl3DsbZtV?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQnYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: [Watch Now] Bizarre Experiment Reveals the Solution to Your Ringing Ears Simply Health Solutions

URL: https://smeagol.revcontent.com/cv/v3/yyUotuyVCM4lF3DtHb0bKQtiAd8V3T6-uS-uAYwCLD3snCDBQD8WGBBfBxpt9bBMeeubyf2884B4MtC8nhyqSIr2XWD6H52RQEI02EJh7x-lTmDWM94IbLGJWBo513HbvsPPXr2Xy8Xi9oLBpD1009MW81BsSbARqW0pNia1ihj7fhNJ3E4ssWqPWbAYE95uCXyRUHlwOuWxaIcjjExf7vxYnIp90Kg2qGPTHE8xd0ChsZOLMN-on3vMGRWfLG93qSAzajJppxBaAPYEQ2EzRYLDPHM_H0hJJZTnfBsoc3Cw6Nwyb4fs2WqWtyiv0Y6LysRzFIhPuH-3vXmYTBYW-kpavENvJ2Yl464GUrxpGy3C8HgglGe4eKTpAicdz2O_oZCUqgRrKH9uRvcPn5UGuPsQWhlOvVvEt72c51TewQtYmpDsPP2YB2i21ZF4wW4SRuwGJ5DTYV4p5FzOlWtA-6lfBPL3am7s0BGkWVwRk-BAft3PBt6FR7EvX3mN8vMXNzEoQ4SXc9BDA8yWv0RWGqmyuyMjOBOV40ZtzB7SAk3UUgXy_09-_Jz6xb20nenngcSeLerPmtuRcOHJmWa3GzqVzJ_3Ll8IP_44qpWXur6kRuQVcPCgqX7_wpkM7JwETf77z8h79kxRLDiYkXC9G8Ok3MuKlQBSTo-SQGEcmj6m-te1B59upjOR1fjjPAlcVShn_KOrCtYBhXJiJIpd2qsBSeSw49VnlQMWYjk0n6VBCrHt1GUcYDxe8PLUN8FUvvl-rVYNmXObPldx5slqrOfwkw2qsEPc94RBm0loow?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQrYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: This Headlight Glasses That's Making Nighttime Driving As Daytime DrivingDotmalls

URL: https://smeagol.revcontent.com/cv/v3/oYJ02BTAljBaHMmpy1LK88c-Y--4MY8TALyEx9FNi1eomkr4-b_GRrsBdzjSsHU8LYPoPXawITm6dwNz0XG_gP24_TuttSw01lW6rTU_yLZEFMQUomlmMPwdzyAv47Bxt3GwwLC1TKzUauYYLkmjNdqRSVTz1jMMMCeGMD7xfbFRrHcpgEQb3zIquxF-caw7kbCoMQpXG_lofpdQjJtc9QcUSL7l19W6v9ZKDJ_oqqNH0UNhmqdqrNiIIwYs2wjSJQ_0_MWB5R7ee6cIeYYVM-FRNWHPJn0umpdvlXFwJxtBwu9hvr4nPCDYAoGa0msxZyfHDivYE7PLBcJzPgqEYz7fPPKwZm91rPFcq0VVH_84fWweSSKbLCZRfPK3SAv9ufWAq9YpM2sWXxuIIzYZJEna9clD0O8bwC2cflsjB6hGFLt5QTq9_7O0muC-6iuuHPoU?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQvYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: 1 Simple Trick To Cut Your Electrical BillTrends Consumer Club

URL: https://smeagol.revcontent.com/cv/v3/UI3Oa-bNUjlESMjjax3njGQhJVN0FVxYzdFBlfxHSq9ByoDOK2h19ftqgO-O69N3KjjD-GGKyUiP2nJLqhwt4DfFBC_TjvjgTMLiK5UtYwyjMjrHpL9PrGpotYkjIrBvY5ySACU0ZWIvuWRbVhTlxMqsszhEEKCSOu5GgYis6aOCgm5ZZw1vW_MLcIEDHdIUxFHc8rhVQyXjZoKC-V9BJCh-NfDSBjUniVIZp5as5tOqHNhdSKP6Sb7MTMRXV5kN5h1Z9mVJWx_n1OxwcYTRN9Iz3VX1ff2dKs2BqgmYlWfTLuOjBI2YrAbXE2HnKfkw6aETYClX3Q7cCpAuBizTDsdSZK1aSSiVCeJ_kfDAU6ulAh0zrL9t2w_45wKPakw0Omu2xtkH81dXLPyMiPpWtLGMz9iEDXGI9qCkbxUDS90ShcOsUebUnVas9S9quLl7feicUF7tHxNnzzvzJiADNP0PvBilMwvRYef7z35kgDMpY30Bohw9pXkx6q4G6d7mMPner4f1GaU43MLJTxehGo-MbCnbixTZ5ocGIOkIbID-FLUiu9RDOAbRflar0G9m0rkwqS3o_RSgxZmrbOMEjP-c-d1H6hUPGXKhoHmAaMYT2hiSSd5p10ptj59sXJodzBat0iC6DpiAMiEigTA6-iX6Caw?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQzYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Early Signals of AML Leukemia You Should Definitely Know About (Take a Look)Leukemia Treatment

URL: https://smeagol.revcontent.com/cv/v3/Z9GTirv6ygXWDcPp1EsgLJwX5QCNssYtAgrzTfftrA7Tfe43dYPp1XLRuDvhMH9Ia56MmV_W7uy4crLAs46580yEQSvhhkGK0VGa8U-iRYYLKe28ZP23jGddXv6r6_zC1Bh6LKkCMdbmiWyEqr0ryrQcDUuEatoty9LaK7S93ziJOxPcujpauXXACw5l_0xg_5mSTL5RF_lE5l29myPMaEqguKcjN0PWCIR3q7xChox1r7RXdG4h3Tz31tYaO10RAs8cRMAe48NkFEOBd3TMrS6xdmVJ1sY9NBmnJh7JRAfKtNsdFnAbNlIn-dsBQ3sBD-Jl9f2iLxWChUW_hFGOo8lbZ9R43TY7HEQZuaCW-qvreL87xzmdqlleb-f18YCNA44pJEVwLWUlI0U0uyIDbei4r00pOTjh80i8DImGuR7NShNKvQFr2FF0ikjp3_zmk1USAhph2OKAl0i7neuxw4-GIIQi6oXb08agbNDRR4IP3Ro565a9Zi4kZ2c?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQ3YAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Do This Coffee Trick and Watch Your Bellyfat MeltHealth Gazette

URL: https://smeagol.revcontent.com/cv/v3/cMVsNb3D6EkUgP8Qjm3FIM6trekCzQCL6mvT9okfRM90o-hKlONw8jwl0TvKnQuhvZHY1dMi-CSB0K_IyJJnQKgGPVYhVhCqkjGUk63XZFCmSDaqdQ5MIjfVYJpqdMW26dbM_i3Shourl3cN1K6X5fsDNfOZ6na0Qiyal5YDaHVV5JDNLL0mnNJdhg4oVo7T6Zwtj4QOJSdKBeUjsqV8mRAzXoZGZdfwJ2A8WlivX0Tux-BvoBh0i4INVyq3_6mQGt0h4VHZO4EKEmY2io3R7q0IHd71-t8Q8sAqtLkHb7cZhRNLEDUEeNmMgcHljRKf_0qnbmVjrjLrHG1zJ8EKaSdjRXhS-GRxcWFyh2k4NJmDeoE9hBWNKsJ4kCtHpLPTwDulPYHF98iIy3WrMDoqCNX7ll0lkWNlVSZhMbhU02bJEB33v-DJYG53Kv_xmjexD30DcosGUHKuBewkhaRm50JedyDIbgW7LKSzuHAkYmn3UHq_dl2FcU4S8crHDS4pxs6sRvMd0PQxsAQAa8sFfEXfKBfID0Qd323EC9VKqlwFXj_qJNZEGhhlcOfWamANWqZO-sKPfTCCnmVuTggHC6A?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQ7YAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Dermatologists Stunned: This Removes Wrinkles Like Crazy! Try It!Neotonics

URL: https://smeagol.revcontent.com/cv/v3/d710JHHNQFETsddtGg4QzmD5rrygewFIywlcIoN0SKnBGB2tKs0dhkeHBJNkG2emCtNAKP-TjRjC18jZqBPGwqL30mJvslmNSV1wzfEojaF9TmBdckRsVGrJgT2_bGo2c_W6TALZxCCi7a3zMR8OILwa3jTkk6x3ROTLhtWsANomTvSg_Kr2wp9fb_K1Fjogp2xvJMzMhA9O7-qdRI-o8Jk3ugfYpY4bJC1d-Z8AIHTfId30fR_EVsMAHhLw7VQRzrpnpzK1t2Wr_a3q3zfNMleLJBWWN2uA_RHB-yqoVHet2Y6dksTz_s0Jcbz6A3wdbOJw7U7iQqtwYh1aVM3XavNsbHn6AJsz1b6iK66VKG6M2iwlubi1b2XcXQJOuL8593-wHHB7JwN053GgNWQ1tlQX4Rfm2ocwy03MxFeyXQCa9aeITPQuXFHM3ehfhQD9AkpNN0S4SgC6-zJ70K2u8bQMFOU0ooEL1iG4ZbePmR9mi2EM-zsyOuY6vVZKVjbebNdmquHVovxEz4pZx6yPui3s?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQ_YAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Too Much Belly Fat? Do This Tonight!Healthy Natural

URL: https://smeagol.revcontent.com/cv/v3/jxIsedB0vj6lf5PtrqbnThTbeQe23s4wzS1bpSysctBHPBDq-u1qggkPzJTXUV8gAcIcJBFioYrgUUBFfocf0XYifL1vJKpME3aEdNjdGgln9u1An8ade-g-sMTDajB_YWPnGeYPyy1WRWa_TMSekje9RRGidnSguTi7xHt9dyXa2IOXBQmwP0weZGQXhYCEipsXeh0PkkHPOeae18K7gHvVZ2EDm6Ww8OrBOHN2jt3gEpkm1z9Pkin_nhKHf0xYHjfePWIuxAXUM7Ofb7ZQD7CFcMVXdlN9lZ7_QEdeqAdm7tjPZYSDmDg8bpxC-mf4sEIZCgOfFbXOmDbgxe1UNtCQka9ccz0cJbz8oAqtZ7fs65WgRR8EhDSxM67_tRfNnB2ajv9jEndOUc2kbFkRtIbhwIiku5kNj8ssQjZqVrEsJdvrocHyR8VDdew97F-OCIkuVsX1jhO8xvMh_fm8kRFDVJBiRj3YxHr71bFATL9GLybCPxB1rhrjXT17vEUkZZdtp33_qyqQwL_EHvQOIeZPcR6FRh4jOY8SeuBFFmTx84lUQFJXg1Kqd8W6Wssd9RakQ_tGDE0S1gO5e6D2CtTOWHDwZq68L2DSz54H9hyFDHsUB4RKhHlrX-ltGJp-G4v0mh7BgJmeLY7cKxj0hWglMrWOsgzNBknp1s4QJ9pftwxkRvLy2otCaBlxjsEDhFSc4DZjVUnq8ZgppbJcnxZY2Ter_bY4TD5rk6d56FIhTc63Q3oXQEroQ64g9m_7no9F2Se0lHhWannHOjS6XEn7iwdPHAKASIrcvLkpX9RQyF206Bw-uiLXgc7nlZtOl_eiCrqrvsq6f9vsOsLS4aGl-N8rgHbl0ynj451yL6IToAF_2KrLWUXeYVFea8p5e-kzu-264EI9FS0QdyiES59GeQcjtcysJRUIZvDn2-JZ_e2J1_3lZBjfT6QSreiQ2wbwtEsc70z0JMYr5__Dj3uDA5nrbKYaw0GUGHpZ9YqUKDxsv6-dxkbst96nMoJMPZ-n-JOZ5p3hn3ONcw-bFHAypeTIorXm74Jb2LdL?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQARDYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Why Doctors in the Know No Longer Prescribe Blood Pressure DrugsPrimal Health

URL: https://smeagol.revcontent.com/cv/v3/QL0hYRECrLX4B8Z-Y_jQUEzfIdmdAaT0ur8YgSGWWNCd8n9CJMakTfjQP8yRzlFoWrHhT8EN0COF8GXNpjzNVN_CDt23JUzEi-K7Z17E8iurQ0JiDjGO8hhbZFnApXt8Txc4GAWpJG8p-S0WzOINVZ6ZimZ5kP1bU_2e9cjT_X-JqZzQQOLJ5hMvXZnBChu4xRhdyea5Q6XWr4esz_jDN9e_P8AGVS96owpXgDmuUl6bXrUxLXnXb8-vez-bT9tC1K2hud-ivwxCETfoyRuOWjTMG2gHfHnAZ8GKW0Z_zgEYdcjtywg5ZM2bi8aEDlZsJg3Lgg7G2GbNyKfSVSDmjUydwqtstxFjg3APDE36Cv_OBN75q_GP4uHsUj7ikYT-_Bs5XT23pB6KkSUWUzM?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQARHYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: High Quality T-shirts Made by Patriots for Patriots Get Yours Now! 10% offPatriot Labs USA

URL: https://smeagol.revcontent.com/cv/v3/Swv7R95V9IVX2FSxpyjb7XtYzDhLB0rph53gNo_PvscCHb5fMFyBB5_5bHhjCXS4G2MiGtFGDy2_O-bLSPG5UDYE2woX-cUZwIFx4WU55w_Cm8ZQPXqI2JQFxWM2jEDNVgJzJWr2RgVtbRuu7qOTQ8Wb09JbtSJi_EKUJZvubapg5LhVGAeCSUf1p6VlXCZMd0360OX86O-Ahde8vsdrqEbJvw8tyKTwFm-IA-iB_YGquFF1pAkP1k5P_gZZHh__wa18dd2mNM7rMM-WeqLv7BLbpUnv6yzj86JU7sEExybAMctVCRT0yOHY0xKV5b-MpemoT5kbVN9EwEehPhpEN05zIB6_Vbr44ZqImLnhMJWPWlxeI5VHIP4TtM_XeBjEuyTfQJN7UvBlSIz4JiDq3t8UNdLd5cR-_-HR32TMbOEeCajmBo35W1cNOKAsYfd1IEgnww6FbkU3GLAY1nCfIdl55QclORfOsVpwxBwswhOL6IHjHlueCMuxzjSWvFvBtuPg-Wtidz4-OtdDgyGI-S2u5AIODC4VRc11itm84Ohd3ZSg5G7ssa9euJONqvawYGWd6yKKS7LaQ4l-iSUpRshG8Zx-tan7OOyv8szZH-8l?p=GgFDMJPQiq4GOiQ0ZTFhNmM3ZC0wZmY2LTRkNDItYWUwYi1kYTQ2MDVmZDZkMDhCJDkzNjBhNDA3LTc3N2YtNGI4OC1iMWYxLWEyNGQ4OTBiZWJkMUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQARLYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC42OOoCEQoIZ3JheV9pbXASBWZhbHNl
Title: This is What Full Mouth Dental Implants Should Cost You in 2024Dental Implants | Search Ads

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F

URL: https://twitter.com/intent/tweet?text=Eyewitness+to+killing+of+Run-DMC%26%238217%3Bs+Jam+Master+Jay+tells+jury%3A+%26%238216%3BThen+I+see+Jay+just+fall%26%238217%3B+-+https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F

URL: https://pinterest.com/pin/create/button/?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&media=https%3A%2F%2Ffreedomheadlines.com%2Fwp-content%2Fuploads%2F2024%2F02%2FScreenshot-129-1180x701.png&description=Eyewitness+to+killing+of+Run-DMC%26%238217%3Bs+Jam+Master+Jay+tells+jury%3A+%26%238216%3BThen+I+see+Jay+just+fall%26%238217%3B

URL: https://plus.google.com/share?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F

ns31533569.ip-162-19-138.eu

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mailz.leafybranch.com/index.php/campaigns/nj769jogtw9a3/track-url/ep298mfawp5ef/b262a7f530abd028eb4a55a3f3846db35185f2c5 HTTP 301
https://mailz.leafybranch.com/index.php/campaigns/nj769jogtw9a3/track-url/ep298mfawp5ef/b262a7f530abd028eb4a55a3f3846db35185f2c5 HTTP 301
https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 114

https://b1sync.zemanta.com/usersync/revcontent/?puid=a31dd66555174ef8b0e87af3c33815c3&cb=https%3A%2F%2Ftrends.revcontent.com%2Fcm%2Fpixel_sync%3Fexchange_uid%3Da31dd66555174ef8b0e87af3c33815c3_2%26bidder%3D3%26bidder_uid%3D__ZUID__%26callback%3DdspCMCallback&us_privacy=1---&rev_dt=1707255827564 HTTP 302
https://b1sync.zemanta.com/usersync/revcontent/?cb=https%3A%2F%2Ftrends.revcontent.com%2Fcm%2Fpixel_sync%3Fexchange_uid%3Da31dd66555174ef8b0e87af3c33815c3_2%26bidder%3D3%26bidder_uid%3D__ZUID__%26callback%3DdspCMCallback&puid=a31dd66555174ef8b0e87af3c33815c3&rev_dt=1707255827564&s=2&us_privacy=1--- HTTP 302
https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3_2&bidder=3&bidder_uid=rqWDE59k90-uLbftfHo5&callback=dspCMCallback&us_privacy=1---

Request Chain 115

https://x.bidswitch.net/sync?ssp=revcontent&us_privacy=1---&rev_dt=1707255827564 HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=revcontent&us_privacy=1---&rev_dt=1707255827564 HTTP 302
https://r.bidswitch.net/sync?bidswitch_ssp_id=revcontent&bsw_custom_parameter=fdd96b06-5a2f-441c-9424-ef70eba3e799 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=fdd96b06-5a2f-441c-9424-ef70eba3e799&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%3Drevcontent%26bsw_param%3Dfdd96b06-5a2f-441c-9424-ef70eba3e799 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3205&partner_device_id=fdd96b06-5a2f-441c-9424-ef70eba3e799&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%3Drevcontent%26bsw_param%3Dfdd96b06-5a2f-441c-9424-ef70eba3e799 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=029877f8-4cfa-48db-ab82-06843bb57b4d%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%252526user_id%25253D0%252526ssp%25253Drevcontent%252526bsw_param%25253Dfdd96b06-5a2f-441c-9424-ef70eba3e799%252C&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=029877f8-4cfa-48db-ab82-06843bb57b4d%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%252526user_id%25253D0%252526ssp%25253Drevcontent%252526bsw_param%25253Dfdd96b06-5a2f-441c-9424-ef70eba3e799%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=21b7045d-c254-48ac-9a8f-1cd489bb1d29&ttd_puid=029877f8-4cfa-48db-ab82-06843bb57b4d%2Chttps%253A%252F%252Fx.bidswitch.net%252Fsync%253Fdsp_id%253D393%2526user_id%253D0%2526ssp%253Drevcontent%2526bsw_param%253Dfdd96b06-5a2f-441c-9424-ef70eba3e799%2C HTTP 302
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=revcontent&bsw_param=fdd96b06-5a2f-441c-9424-ef70eba3e799 HTTP 302
https://trends.revcontent.com/cm/pixel_sync?bidder=118&bidder_uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&callback=dspCMCallback

Request Chain 116

https://rtb.mfadsrvr.com/sync?ssp=revcontent&ssp_user_id=a31dd66555174ef8b0e87af3c33815c3&us_privacy=1---&rev_dt=1707255827565 HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=revcontent&ssp_user_id=a31dd66555174ef8b0e87af3c33815c3&us_privacy=1---&rev_dt=1707255827565 HTTP 302
https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3&bidder=154&bidder_uid=e4bafa5f-b293-48d6-8e59-2fadcc029719&callback=dspCMCallback

Request Chain 213

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgODqq4ObwwEQsAkYsAkyCLECC0Vlv8IN HTTP 301
https://tpc.googlesyndication.com/simgad/3924125642834448992

Request Chain 216

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID&sovrn_retry=true HTTP 307
https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IHk3ALZHTKW55wwqS02JoA7V

Request Chain 225

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=&dcc=t

Request Chain 226

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=cff4de14-c538-11ee-9e3f-3352cae3ab6e

Request Chain 227

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBbFFrN0xoVkFBQUJKTE5fM0tzUQ&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://sync.technoratimedia.com/services?uid=AAAlQk7LhVAAABJLN_3KsQ&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Csas%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 307
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
https://bh.contextweb.com/bh/rtset?ev=AAAlQk7LhVAAABJLN_3KsQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AAAlQk7LhVAAABJLN_3KsQ&pid=558502&do=add&gdpr=0 HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AAAlQk7LhVAAABJLN_3KsQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=4192948985614939915&gdpr=0&gdpr_consent= HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAlQk7LhVAAABJLN_3KsQ&gdpr=0&gdpr_consent=

Request Chain 228

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8266047830043511900&gdpr=0&gdpr_consent=

Request Chain 230

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZcKoFQAC_XKBTwBK

Request Chain 231

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://a.clickcertain.com/px/img/bidswitch/?bidswitch_ssp_id=pubmatic&bs_uid=fdd96b06-5a2f-441c-9424-ef70eba3e799 HTTP 302
https://a.usbrowserspeed.com/cs?puid=b61aea63-904a-5e4a-941e-b8ea263139bd&pid=lc&r=https%3a%2f%2fmatch%2eprod%2ebidr%2eio%2fcookie%2dsync%2ffivebyfive%3fr%3dhttps%253a%252f%252fa%252eclickcertain%252ecom%252fpx%252fimg%252fbidswitch%252f%253fdone%253dtrue%2526bidswitch_ssp_id%253dpubmatic HTTP 302
https://match.prod.bidr.io/cookie-sync/fivebyfive?r=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fbidswitch%2f%3fdone%3dtrue%26bidswitch_ssp_id%3dpubmatic HTTP 303
https://a.usbrowserspeed.com/cs?puid=AAAlQk7LhVAAABJLN_3KsQ&pid=beeswax&r=https%3A%2F%2Fa.clickcertain.com%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26bidswitch_ssp_id%3Dpubmatic HTTP 302
https://a.clickcertain.com/px/img/bidswitch/?done=true&bidswitch_ssp_id=pubmatic HTTP 302
https://x.bidswitch.net/sync?dsp_id=179&user_id=7b049487-1045-4278-8db4-bbdf449c5cb1&expires=5&user_group=0&ssp=pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fdd96b06-5a2f-441c-9424-ef70eba3e799&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

Request Chain 232

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:oafJSOnG1Rxtel5&gdpr=0&gdpr_consent=

Request Chain 233

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=q1CXzfxdxcqwVsHMrFXZyaUGxMuwVJKcq1Cnuq2f

Request Chain 234

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=469b92bc-4c4e-488a-96dd-e52b81d98ba1&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D8375F6E-2B48-40AF-BB63-004D839E5C66

Request Chain 236

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1813050729409154703

Request Chain 237

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=75VtjvQJUThyUo15rWbu4SaEdkQ&gdpr=0&gdpr_consent=

Request Chain 238

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}

Request Chain 239

https://ums.acuityplatform.com/tum?umid=6 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=886166000890

Request Chain 241

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3b4365c2-a815-4b00-a220-bc8d503f5683&gdpr=0&gdpr_consent=

Request Chain 243

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2DdfbitIQK-7YwBNg55cZg%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 244

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=D8375F6E-2B48-40AF-BB63-004D839E5C66 HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D029877f8-4cfa-48db-ab82-06843bb57b4d%252C%252C HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fpixel.tapad.com%252Fidsync%252Fex%252Freceive%253Fpartner_id%253DAPPNEXUS%2526partner_device_id%253D%2524UID%2526pt%253D029877f8-4cfa-48db-ab82-06843bb57b4d%25252C%25252C HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6053676651067766727&pt=029877f8-4cfa-48db-ab82-06843bb57b4d%2C%2C

Request Chain 246

https://eb2.3lift.com/xuid?mid=7976&xuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&dongle=u6nf&gdpr=0&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

Request Chain 247

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RDgzNzVGNkUtMkI0OC00MEFGLUJCNjMtMDA0RDgzOUU1QzY2&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 248

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFOQ8Op6ytW3blEy67TswRA&google_cver=1

Request Chain 249

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1

Request Chain 250

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=

Request Chain 252

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JT_za6VE2uV7b_t6bolhESNylkcXdkI-~A&gdpr=0

Request Chain 253

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=4d0c2158-e5c9-4d72-89a6-012d679159ca&gdpr=0&gdpr_consent=

Request Chain 254

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent= HTTP 302
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=73276de831aa12c5&is_secure=true&networkId=17100&version=1&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGqxr2Lu930ANoDZ6qAAAAAAA&expiration=1707342229&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&is_secure=true&gdpr_consent=&gdpr=0

Request Chain 255

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3090034077542768983&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 257

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1107AD62F_816E4E88&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
https://pmp.mxptint.net/sn.ashx?ak=1

Request Chain 258

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e130cb64-156d-4581-9b09-6b9221f627d0-65c2a815-5553&gdpr=0&gdpr_consent=

Request Chain 259

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&tc=1 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1

Request Chain 266

https://securepubads.g.doubleclick.net/pagead/adview?ai=CILuiE6jCZYbQCL20wNYP5Zy_4AyJqajedbLJgPW2EmQQASD7zfeVAWDJhoCA3KPEEKABocCY8SjIAQngAgCoAwHIA8sEqgSjA0_QvF47yq2SQjWEO3x2vJ5O5kuLdC7kFSusa-TYXTbFmJ1SuYcOrc3OBNEBIHHw1tZ1MVLRg2c7zwudYV3epapJLHhxYAkTBT0fzif1VGzmhkBtmq5fnG_KItF7DNwbZn8hafKEE3-wUMNOVca-3ycj2nIxwP_8ByaBXJpydYQoxRjueq-S6ETTbIAa0ENDgWbjJXPPCC8LAXTisVpRmJuQtSW1r_Cj8WpcTZxwVkTQvHRLy7I0zRTbUaPBqSgi3X45om-pGr89HX3jRQFN9lBiQQGsyXtsXMu8e7GT5qbVeUEXBW93FKHw6-qefDXblWOyvYPkfntd-u-3go1e3SC4CYGE4EEDv-mYf4jRHu709va5yaqbAiVRc4zhk35vcdCvwzC2Z45XKpLg2ewJSjdHkL5rq5jBstojQlAZd2iHMokrHjl6smXmp_4Wu7GYdYXSLrxb7ZA_v9VurEoPGKLwQomvWPg322lOJBamalTd1C8Vy2JfrE7oeQrVQMXvweQ4am_SM9fxsSnauOovPxocyyrRk1HcHcQ2_galVT7iH_OPwASxku2q2wTgBAGIBZ3kxZNOkgUECAQYAZIFBAgFGASgBi6AB7Xft54EqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpr4b2AcA8gcEEOfaHNIIJAiAYRABGB0yAooCOgmAQIDAgICAgAhIvf3BOljQvPXI15eEA5oJ_wFodHRwczovL3d3dy50ZW11LmNvbS9rdWlwZXIvdW4xLmh0bWw_c3Viaj1mZWVkLXVuJl9iZ19mcz0xJl9wX21hdDFfdHlwZT0xJl9wX2p1bXBfaWQ9NzI1Jl94X3ZzdF9zY2VuZT1hZGcmbG9jYWxlX292ZXJyaWRlPTIxMX5lbn5VU0QmZ29vZHNfaWQ9NjAxMDk5NTExODkzODM0Jl9wX3Jmcz0xJl94X2Fkc19jaGFubmVsPWdvb2dsZSZfeF9hZHNfc3ViX2NoYW5uZWw9b3RoZXImX3hfYmdfYWRpZD1nZDI2MzEwNjEtMSZ0b3BpY19jbGFzc2lmeT0xMTSACgHICwHaDBEKCxCQ3q6-yKGu0NQBEgIBA-INEwjrrPbI15eEAxU9GtAEHWXOD8zYEwvQFQGAFwGyFx8KHQgAEhRwdWItODg5ODA3NjQyMzYwMDM1Mhi435oB&sigh=1VvBpSn7K7Q&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgAvHhf_P66Mxtbz3-PJUQOy4KeCT9gyrct74e6vTSY_eKcuQ3mZOhkee37rq3dmwUs-D_AAYabqiBtHkTtQafXoafxp4oDhyo8EfGq4DhgB&template_id=494&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xf353932da09ceb5c0000000000000000%22,%222%22:%220xf386e80f81154dba0000000000000000%22,%223%22:%220xce2d9d824e537d550000000000000000%22,%224%22:%220xfcd5c8bd4c6001300000000000000000%22,%225%22:%220x6c50e3c48a08c8190000000000000000%22},%22debug_key%22:%226097613286722958324%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2202-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221151277588403465265%22}&andc=true

Request Chain 271

https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync2/smartadserver?zcc=1&cb=1707255829567 HTTP 302
https://ad.turn.com/r/cs?pid=45&rndcb=1334358050 HTTP 302
https://sync.1rx.io/usersync/turn/3090034077542768983?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005 HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005

Request Chain 272

https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=

Request Chain 273

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AAAlQk7LhVAAABJLN_3KsQ&partnerid=127&gdpr=0

Request Chain 274

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP 307
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7e50cf2d-e27b-4b5b-8f52-a5ddf27f3031&gdpr_consent=null&gdpr=0

Request Chain 282

https://ssum-sec.casalemedia.com/usermatch?s=190719&cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1

Request Chain 285

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZcKoFppxku0Afot76.WELgAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELrCVOIt195kruxXZbC1C7I&google_cver=1&google_hm=2

Request Chain 286

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZcKoFppxku0Afot76-WELgAACxsAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEC7YZJ2d_7rtmRjGBV-_t3o&google_cver=1

Request Chain 287

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZcKoFppxku0Afot76.WELgAA%262843&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZcKoFppxku0Afot76.WELgAA%262843&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=1bae3dd13e93473fad05cf82815fe3b0 HTTP 303
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

Request Chain 289

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZcKoFppxku0Afot76.WELgAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662066459881630

Request Chain 290

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1722980630&external_user_id=8c74adcb-4689-40ff-826c-7292aaf9c0ea

Request Chain 291

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=6D9yZ78yIGDzOSRm7zo8Y-ZpIWHzO3c26D_8Hcou

Request Chain 295

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17136_2&endpoint=us-east HTTP 301
https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east

Request Chain 298

https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&gpp=&gpp_sid= HTTP 307
https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&gpp=&gpp_sid=&b=1&g=0C2c34mmiPE9ZpUxwxdoAMvtovBE7JIu%2B43n1JhhR1s%3D

Request Chain 303

https://u.openx.net/w/1.0/cm?id=f0686912-7fb3-48f6-be19-4d168ad880c0&r=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fopenx%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=f0686912-7fb3-48f6-be19-4d168ad880c0&r=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fopenx%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP 302
https://sync.ex.co/v1/setuid/openx/?gdpr=0&gdpr_consent=&uid=70550cf6-83bd-4e59-9f2b-cce1d3c14d49

Request Chain 305

https://sync.1rx.io/usersync2/rmpssp?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Funruly%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5BRX_UUID%5D HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3346731785 HTTP 302
https://sync.1rx.io/usersync/tradedesk/21b7045d-c254-48ac-9a8f-1cd489bb1d29 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005?redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Funruly%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DRX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005 HTTP 302
https://sync.ex.co/v1/setuid/unruly/?gdpr=0&gdpr_consent=&uid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005

Request Chain 308

https://ads.stickyadstv.com/user-matching?id=3684&gdpr=0&gdpr_consent= HTTP 302
https://sync.ex.co/v1/setuid?bidder=freewheel&gdpr=0&gdpr_consent=&uid=8bc2e0bf78c720bb7afcfb846ae2f33

Request Chain 311

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token} HTTP 307
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

Request Chain 312

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912 HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU3570204f96444312948ac909cd28d01e

Request Chain 313

https://gocm.c.appier.net/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=TUy3AIwDDWSBAv9iGKjCZQ

Request Chain 314

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=5750424730 HTTP 302
https://sync.1rx.io/usersync3/mediamathtest/1508/3b4365c2-a815-4b00-a220-bc8d503f5683?zcc=0&sspret=1 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005

Request Chain 318

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1&gdpr=0&gdpr_consent=

Request Chain 319

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7605422321657833951&uid=Q7605422321657833951&ref=%2Fepm HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7605422321657833951

Request Chain 321

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent= HTTP 302
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=D8375F6E-2B48-40AF-BB63-004D839E5C66&vxii_pid=12&vxii_pid1=10067&vxii_rcid=13ec2d1c-0206-428a-89b8-931171020608

Request Chain 325

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1744205177370640382

Request Chain 326

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:60b2c46e-076a-40a9-9dc1-1b62efd34037&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

Request Chain 327

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fappnexus%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://sync.ex.co/v1/setuid/appnexus/?gdpr=0&gdpr_consent=&uid=6053676651067766727

Request Chain 328

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17136_2&us_privacy=1---&khaos=LSAW1IVL-1S-KWQ5 HTTP 302
https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LSAW1IVL-1S-KWQ5&us_privacy=1---

Request Chain 329

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1--- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MzcyYmIxODNiNDlkZDE4Mzg4YTZmMzdhOTU1NDNiZmQ0MzRhZjBhMA&us_privacy=1---

Request Chain 330

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=&expires=30

Request Chain 332

https://token.rubiconproject.com/token?pid=25470&us_privacy=1--- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFNBVzFJVkwtMVMtS1dRNQ==&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEdJqQvz94TM5Mg26VKOkd8&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFNBVzFJVkwtMVMtS1dRNQ==&google_push=

Request Chain 333

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=llZyHoWLRdWCtzhEj6AI6A&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=llZyHoWLRdWCtzhEj6AI6A

Request Chain 334

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1--- HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/bWNnByDcCk2g2ujMgEtzrcn5EUdSAgOZEtemQ7w0kco?csrc=&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-eUQsgY1E2oLWfIMwZgufyiNx7JhjPU.yNWLC9g--~A

Request Chain 335

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1--- HTTP 302
https://s.amazon-adsystem.com/ecm3?id=LSAW1IVL-1S-KWQ5&ex=d-rubiconproject.com&status=ok&us_privacy=1---

Request Chain 336

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELQ_gy8V4EFJZs4ZGx2bf2c&google_cver=1

Request Chain 337

https://token.rubiconproject.com/token?pid=36584&us_privacy=1--- HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LSAW1IVL-1S-KWQ5&us_privacy=1---

Request Chain 338

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1--- HTTP 303
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAlQk7LhVAAABJLN_3KsQ&expires=30

Request Chain 339

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1--- HTTP 302
https://capi.connatix.com/us/pixel?puid=LSAW1IVL-1S-KWQ5&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1--- HTTP 302
https://capi.connatix.com/us/pixel?puid=LSAW1IVL-1S-KWQ5&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1---&final=true

Request Chain 340

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1--- HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LSAW1IVL-1S-KWQ5&us_privacy=1--- HTTP 301
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LSAW1IVL-1S-KWQ5 HTTP 302
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LSAW1IVL-1S-KWQ5&ckls=true&ci=t7UaZAI2b0&nc=false&trid=1343600630

Request Chain 341

https://token.rubiconproject.com/token?pid=37556&a=1&us_privacy=1--- HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LSAW1IVL-1S-KWQ5&us_privacy=1---

Request Chain 342

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&us_privacy=1--- HTTP 302
https://ce.lijit.com/merge?pid=80&3pid=LSAW1IVL-1S-KWQ5&us_privacy=1---

Request Chain 343

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&us_privacy=1--- HTTP 302
https://prebid.a-mo.net/setuid/magnite?uid=LSAW1IVL-1S-KWQ5&us_privacy=1---

Request Chain 344

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4d0c2158-e5c9-4d72-89a6-012d679159ca&expires=30&us_privacy=1---

Request Chain 345

https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsundaysky%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7Bssky_uuid%7D HTTP 302
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsundaysky%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7Bssky_uuid%7D&_cvt=t HTTP 302
https://sync.ex.co/v1/setuid/sundaysky/?gdpr=0&gdpr_consent=&uid=d6.d90cbc4eb052486e9ed7b38a7155d62d

Request Chain 353

https://id.a-mx.com/sync/?tagId=&ref=null&u=https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular&tl=https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular&nf=0&rt=true&v=8.17.0&av=2.0&vg=vuuklehb&us_privacy=null&am=null&gdpr=0&gdpr_consent= HTTP 302
https://c3.a-mo.net/b?uid=e7d46c0d-a65a-4425-a238-00a0537c0761&sh=id.a-mx.com&

Request Chain 392

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEH8a3IHgtxdldlR8V1k8Z2I&google_cver=1&google_push=AXcoOmQe6foKbO6uBoGh_n4NQDJyJfYmtTFy_pshP_-NLjFedD8H76Xz8bKNR7YUWO9L-GLv35dHWZqUw_7HNX9LrpH_zq0OG-E HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WmNLb0ZRQUNfWEtCVHdCSw==&google_gid=CAESEH8a3IHgtxdldlR8V1k8Z2I&google_cver=1&google_push=AXcoOmQe6foKbO6uBoGh_n4NQDJyJfYmtTFy_pshP_-NLjFedD8H76Xz8bKNR7YUWO9L-GLv35dHWZqUw_7HNX9LrpH_zq0OG-E

Request Chain 393

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEA1QAwpwCRtE0PLdHymQ3YE&google_cver=1&google_push=AXcoOmSHrQHmOYD8x3r9SHP_HKxOkgUPPf7AG3ZQbp7fSp6clGB5iK97LPAtYLi95Eq4pzPPoAC6DWNhXlHYsDURs_CqP7TqE6o HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSHrQHmOYD8x3r9SHP_HKxOkgUPPf7AG3ZQbp7fSp6clGB5iK97LPAtYLi95Eq4pzPPoAC6DWNhXlHYsDURs_CqP7TqE6o&google_hm=_dlrBlovRByUJO9w66PnmQ==

Request Chain 394

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmQhOR76DCmDRQxYJaoZhKWF_m5oITHIltEWluw0xJfv8lw1AyKybilSX0RWXm6AYbl-05aX62a8Xe8s9GvhAw12ODWhkQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmQhOR76DCmDRQxYJaoZhKWF_m5oITHIltEWluw0xJfv8lw1AyKybilSX0RWXm6AYbl-05aX62a8Xe8s9GvhAw12ODWhkQ

Request Chain 395

https://rtb.openx.net/sync/dds?google_gid=CAESEOiJ1bF8qhe2qxio9y0PHC0&google_cver=1&google_push=AXcoOmSYVvq-5qWwj7CZnKNGleHA57WZzwB0w2wYjTrSJgHqUF1gSmvIHEruT2cXClPb8PRg2Hye72nEp980bDxWutKQO_iDuw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSYVvq-5qWwj7CZnKNGleHA57WZzwB0w2wYjTrSJgHqUF1gSmvIHEruT2cXClPb8PRg2Hye72nEp980bDxWutKQO_iDuw&google_hm=76VZu0UBztMKm0a86Ok0ZA==

Request Chain 396

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEBOQH6XLcJJITQBcim4gFSY&google_cver=1&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9ggbT1P8Sft65bV4x_vAmghow HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9ggbT1P8Sft65bV4x_vAmghow&google_hm=WmNLb0g4Q284WXNBQU1LZktsc0FBQUFB

Request Chain 397

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmS3xLPZrpepUW05YijnU2xM0iD8N5KWzL34676mYTU26BrOMIyWa4unoW2A0-czioS8rVVxUGfLcod_7W_tq3ITU5tgZh4r HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmS3xLPZrpepUW05YijnU2xM0iD8N5KWzL34676mYTU26BrOMIyWa4unoW2A0-czioS8rVVxUGfLcod_7W_tq3ITU5tgZh4r HTTP 302
https://cm.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5 HTTP 302
https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5

Request Chain 398

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEKIQfftu4pHnUH8uWi_GGQA&google_cver=1&google_push=AXcoOmRnQxA0GbVAEujHh_rkzj1bG5XUa9IJAj-dLypkJsGnkI5eWXtLLGieLPRjgD9t-SdWzoyBzdj0ZF6cQ0aHH6JKQ0H2XcNW HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmRnQxA0GbVAEujHh_rkzj1bG5XUa9IJAj-dLypkJsGnkI5eWXtLLGieLPRjgD9t-SdWzoyBzdj0ZF6cQ0aHH6JKQ0H2XcNW&google_hm=cnFXREU1OWs5MC11TGJmdGZIbzU=

Request Chain 401

https://um.simpli.fi/gp_match?google_gid=CAESEGUdXpGFnvaBl2gHwTm7ZzQ&google_cver=1&google_push=AXcoOmR-gwZkgvppCfbr5WCPzoHCG0hCPPajWosEUP-tWSbobjCsUrw7D1LPaos8WtilbxEQMHalJXWrQbzrDG9mbiobVAOVjJ0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3D73E86F3FA34461AD86F9585A54B5A1&google_push=AXcoOmR-gwZkgvppCfbr5WCPzoHCG0hCPPajWosEUP-tWSbobjCsUrw7D1LPaos8WtilbxEQMHalJXWrQbzrDG9mbiobVAOVjJ0

Request Chain 402

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECfA0HllUIIRnz-3NTPbqBQ&google_cver=1&google_push=AXcoOmS998rP0nw3aSjsLPutL2n6g11bRd3rCMN8fnMkqvlJDXHDEP9cOLmfBIm9T8LtzQOvjiz5vur4moQRIgFREPgnr3Q0Pkn7 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmS998rP0nw3aSjsLPutL2n6g11bRd3rCMN8fnMkqvlJDXHDEP9cOLmfBIm9T8LtzQOvjiz5vur4moQRIgFREPgnr3Q0Pkn7&google_hm=eS1BcG51SGxoRTJwRWYzNDdFNFhZVGpQNkhHcmN0X2QzWX5B

Request Chain 404

https://dsum-sec.casalemedia.com/cma?google_gid=CAESEC7YZJ2d_7rtmRjGBV-_t3o&google_cver=1&google_push=AXcoOmR-_pCRDfBzuKoLUPSf_ppHf4IbT2g3j7onxKi0sZlYZA_C1ysCai7Lg4zLd0UzWuQHf-Z5MV_0uFa3vJu2JnZ6vHlL8Z8 HTTP 302
https://rtb.adentifi.com/CookieIndex HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=188&external_user_id=cuid_d00bd1a0-c538-11ee-bf6c-121a6d1d7927

Request Chain 405

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmR1GApMU3DA0iQr7SyqUcFUM1VgpVJEFJjA-MQlSJKZfSq1N9nphkte45jv6eEmVrxdDtsIdLc35jFl1wB5NTLJcIMLwFCZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmR1GApMU3DA0iQr7SyqUcFUM1VgpVJEFJjA-MQlSJKZfSq1N9nphkte45jv6eEmVrxdDtsIdLc35jFl1wB5NTLJcIMLwFCZ HTTP 302
https://cm.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5 HTTP 302
https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5

Request Chain 406

https://gtrace.mediago.io/ju/cs/google?google_gid=CAESEO-sO-w0BpF9CLQlk4gdKkc&google_cver=1&google_push=AXcoOmQszwEbFSW1f8473X4Dps7g-GYsvruxXbLyYXkrGvD8lWkE2uNZu6MRQLSZXZunS7mvRB8Ks8EZQtgvXwW_5ZQ6R8gaz8vL4w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQszwEbFSW1f8473X4Dps7g-GYsvruxXbLyYXkrGvD8lWkE2uNZu6MRQLSZXZunS7mvRB8Ks8EZQtgvXwW_5ZQ6R8gaz8vL4w&google_hm=1a43c5a5564954692ydhll00lsaw1nvx

Request Chain 430

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZcKoFQAC_XKBTwBK

Request Chain 433

https://match.adsrvr.org/track/cmf/openx?oxid=30f3d387-ec87-77fd-ecef-0a0b3bf00ede&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=21b7045d-c254-48ac-9a8f-1cd489bb1d29&ttd_puid=30f3d387-ec87-77fd-ecef-0a0b3bf00ede&gdpr=0&gdpr_consent=

Request Chain 435

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrv9P6PF_3e7Dkv6cRu4n4&google_cver=1

Request Chain 439

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D583257%26t%3Dimage%26uid%3D%24%7BBSW_UUID%7D%26us_privacy%3D1--- HTTP 302
https://sync.adkernel.com/user-sync?zone=180530&dsp=583257&t=image&uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&us_privacy=1---

Request Chain 441

https://ads.us.e-planning.net/uspd/1/7e908545a85d1a3e?ruidm=1&du=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D687665%26t%3Diframe%26uid%3D%24UID%26us_privacy%3D1--- HTTP 302
https://ads.us.e-planning.net/uspd/1/7e908545a85d1a3e?ct=1&ruidm=1&du=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D687665%26t%3Diframe%26uid%3D%24UID%26us_privacy%3D1---

Request Chain 442

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001eeJhsAAE&ru=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D602159%26t%3Diframe%26uid%3D33XUSERID33X%26us_privacy%3D1--- HTTP 302
https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001eeJhsAAE&ru=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D602159%26t%3Diframe%26uid%3D33XUSERID33X%26us_privacy%3D1--- HTTP 307
https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001eeJhsAAE&ru=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D602159%26t%3Diframe%26uid%3D33XUSERID33X%26us_privacy%3D1---&b=1

Request Chain 445

https://idsync.rlcdn.com/712188.gif?partner_uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent= HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CPy7KxIwCiwIARCFpQoaJEQ4Mzc1RjZFLTJCNDgtNDBBRi1CQjYzLTAwNEQ4MzlFNUM2NhAAGg0In9CKrgYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=882140a80c928748292cde1af6c7d724e2e4390a64578eb3bc2686e6b922fd2a791426b5417dce21&_=2 HTTP 307
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=882140a80c928748292cde1af6c7d724e2e4390a64578eb3bc2686e6b922fd2a791426b5417dce21&rand=03698495

Request Chain 451

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dinmobi%26uid%3D%7BID5UID%7D HTTP 302
https://sync.quantumdex.io/setuid?bidder=inmobi&uid=ID5-00cdn1_5PK82vbh8Oh35yr89jxw9PlE2ueYs1Ds9Hg

Request Chain 452

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID HTTP 302
https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=39779bea-e14e-4748-b5b8-9b367b06830e

Request Chain 454

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID HTTP 302
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=6053676651067766727

Request Chain 455

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://sync.quantumdex.io/setuid?bidder=sovrn&uid=IHk3ALZHTKW55wwqS02JoA7V

Request Chain 459

https://sync.1rx.io/usersync2/rmphb?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%5BRX_UUID%5D HTTP 302
https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=

Request Chain 470

https://id.a-mx.com/sync?tao=1&&do=freedomheadlines.com HTTP 302
https://c3.a-mo.net/b?uid=e7d46c0d-a65a-4425-a238-00a0537c0761&sh=id.a-mx.com&

Request Chain 471

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-adaptmx HTTP 301
https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx

Request Chain 472

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=58931442-874e-4388-af38-614ae9f9ca68&gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid= HTTP 302
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=fdd96b06-5a2f-441c-9424-ef70eba3e799&ssp=adaptmx&gdpr=0&gdpr_consent=

Request Chain 473

https://ups.analytics.yahoo.com/ups/58570/occ?uid=58931442-874e-4388-af38-614ae9f9ca68 HTTP 302
https://prebid.a-mo.net/setuid/yahoo?uid=y-aRwjWj9E2uE5yqUxo6wROlAUmXAoYdNCUR1Xlnc-~A

Request Chain 474

https://id.a-mx.com/u?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Damx_com%26uid%3D HTTP 302
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=amx_com&uid=e7d46c0d-a65a-4425-a238-00a0537c0761

Request Chain 475

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=1---_e&r=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dopenx%26uid%3D%24%7BUID%7D HTTP 302
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=openx&uid=092d5c48-5518-4414-8763-ca1ebaabcc53

Request Chain 477

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&us_privacy=1---_e&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync.a-mo.net%252Fsetuid%253FA%253D58931442-874e-4388-af38-614ae9f9ca68%2526bidder%253Dpubmatic%2526uid%253D%2523PMUID HTTP 302
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dpubmatic%26uid%3DD8375F6E-2B48-40AF-BB63-004D839E5C66&us_privacy=1---_e

Request Chain 478

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---_e&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=index_rtb&uid=ZcKoFppxku0Afot76.WELgAA%262843

Request Chain 480

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dappnexus%26uid%3D%24UID HTTP 302
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=appnexus&uid=6053676651067766727

Request Chain 483

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=3658&xuid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&dongle=0cfd&gdpr=0&gdpr_consent=

Request Chain 484

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE4MDU2MzMyOTQwNDE0ODM1Njc5Ng%3D%3D HTTP 302
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

Request Chain 485

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP_8hWZ6UsO8oSmyNqga1iI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

Request Chain 486

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE4MDU2MzMyOTQwNDE0ODM1Njc5Ng%3D%3D

Request Chain 488

https://pr-bh.ybp.yahoo.com/sync/triplelift/4180563329404148356796?gdpr=0&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2662&xuid=y-yfArEsJE2oSjJVVwvBZveeSDhrdEbGDnLwERuGoJjg--~A&dongle=0883

Request Chain 489

https://x.bidswitch.net/sync?ssp=triplelift&user_id=4180563329404148356796&gdpr=0&gdpr_consent=${GDPR_CONSENT} HTTP 302
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=fdd96b06-5a2f-441c-9424-ef70eba3e799&gdpr=0&gdpr_consent=

Request Chain 491

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=3335&xuid=6053676651067766727&dongle=4d58&gdpr=0&gdpr_consent=

Request Chain 497

https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeebd%26fi%3Dfc5ff551c2f43880%26uid%3D%24%7BUID%7D HTTP 302
https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=fc5ff551c2f43880&uid=092d5c48-5518-4414-8763-ca1ebaabcc53

Request Chain 501

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3Dfc5ff551c2f43880%26uid%3D%24UID HTTP 302
https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=fc5ff551c2f43880&uid=6053676651067766727

Request Chain 505

https://match.sharethrough.com/universal/v1?supply_id=H7IJBRjH HTTP 302
https://sync.e-planning.net/um?uid=6b78554f-659c-4213-b9de-f0b7e24adb97&dc=769fefa8321c94fb&iss=1

Request Chain 511

https://sync.1rx.io/usersync2/rmpssp?sub=eplanning HTTP 302
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005&rndcb=4746440108

Request Chain 512

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=21b7045d-c254-48ac-9a8f-1cd489bb1d29&expiration=1709847840&gdpr=0&gdpr_consent=

Request Chain 514

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6053676651067766727

Request Chain 516

https://p.rfihub.com/cm?in=1&pub=2079 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1813050729409154703

Request Chain 518

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZcKoFppxku0Afot76.WELgAA%262843&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
https://i6.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZcKoFppxku0Afot76.WELgAA%262843&gpp_sid=&us_privacy=&gpdr=

Request Chain 519

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=rqWDE59k90-uLbftfHo5&puid=

Request Chain 521

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=eplanning_east&endpoint=us-east HTTP 301
https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east

534 HTTP transactions
16 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/
Redirect Chain

http://mailz.leafybranch.com/index.php/campaigns/nj769jogtw9a3/track-url/ep298mfawp5ef/b262a7f530abd028eb4a55a3f3846db35185f2c5
https://mailz.leafybranch.com/index.php/campaigns/nj769jogtw9a3/track-url/ep298mfawp5ef/b262a7f530abd028eb4a55a3f3846db35185f2c5
https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular

53 KB
14 KB

213ms
134ms

Document
text/html

2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

580b1cad557f500b28a1ef8af96296744191e4ba0237152f6951b156528d6ed4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8516920c8fa6dacd-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 21:43:45 GMT
fastcgi-cache: BYPASS
link: <https://freedomheadlines.com/wp-json/>; rel="https://api.w.org/" <https://freedomheadlines.com/wp-json/wp/v2/posts/30702>; rel="alternate"; type="application/json" <https://freedomheadlines.com/?p=30702>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fXJmpstBefwrmZhGU%2Fk4N5qcgFgnTkUEfhSs1dQroBdJ0N%2FpKQwnfSasnFL9fRu8QHpY4XzbH0oEN5LqQsh4vt%2BdD8h%2F21AHyDgUx8m51aT3C4KLv09xMhit0oZcu8jF97%2B2LoqkkQ8gFZVKhYzJbQi7ew%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 21:43:45 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Tue, 06 Feb 2024 21:43:45 GMT
Location: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Pragma: no-cache
Referrer-Policy: no-referrer
Server: Apache/2.4.56 (Debian)
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-Robots-Tag: noindex
X-XSS-Protection: 1; mode=block

GET
H2 200 style.min.css
freedomheadlines.com/wp-includes/css/dist/block-library/ 81 KB
12 KB 56ms
51ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.9

Requested by

Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:02 GMT
server: cloudflare
etag: W/"6352011e-145db"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1sbcDRWTzn3rVSmnz82%2FpeQzJQNuhln4AjS6IUCB1e%2BvU2k3SdPPQswNgyH%2BTvqCH7TDN%2B%2BrUsQ2mRMakBNNiqMHcs%2BoijqaNExScqUCBt3o7tP0HbTlzn%2BW%2F10Mr8VFnPTUH5yqTfUbA5TZ2jESttAhqg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d7996dacd-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
freedomheadlines.com/wp-includes/js/mediaelement/ 11 KB
3 KB 60ms
55ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5905379
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:01 GMT
server: cloudflare
etag: W/"6352011d-2bf8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iTWDc%2F2YzG47SJvD31WWmJQjxf%2FbRVsz%2FFfBnNycKowhw7%2BzihlT65A%2FWSIjTX0v9BQ4IQqvRIPJ1CY0QW4af4JTLPjgPx7Vq2R1nN1hD9OuYezUhwmLuE88eQAh9vSV9ggHuXP3fW77kPvsR7EsO%2FmavQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d799bdacd-MIA
expires: Thu, 07 Nov 2024 13:02:07 GMT

GET
H2 200 wp-mediaelement.min.css
freedomheadlines.com/wp-includes/js/mediaelement/ 4 KB
1 KB 57ms
53ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.9.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:02 GMT
server: cloudflare
etag: W/"6352011e-105a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C2ZNoeZuud3auAqye5mY%2FctyHRRKwNFNMYTZ7OkTBL%2FZTkiwtRHXDUTB22FcQ33EgD5FLA7JdDR8dRwfcDVNGZzPtP2KwQtMoTki9FbPhHl6t%2FVX6m%2B3EfG0G%2F8djBh%2Fe4R1MpuVcAvNROfOwmm%2FG2W%2BDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d799fdacd-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 components.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/ 52 KB
10 KB 60ms
56ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/components.css?ver=5.9.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76bbe117102ce802cd20b57f9722133d7924bb3395bfe201f8f0b515a81c46dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:19 GMT
server: cloudflare
etag: W/"6352012f-cf80"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3uRjb%2Bmq1S9i439j%2BOxvb2%2FOX5w9cz%2FC2uw7pl6INICKyt0OpQzl4ssxSpNFYZjPpNVFMh5jRV3doYe5NuEBlKIvr9aI0tnPuzLBkFjvm5ufIWq3l5EbLirx3cGUz7oaS3ifv%2F6apoWbieDRTgOfq0PfUg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d79a1dacd-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 style.css
freedomheadlines.com/wp-content/themes/breena/ 106 KB
19 KB 61ms
58ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/style.css?ver=5.9.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f673a8adc98789a6eca1dd65c67fb782787f2571ba2730bb8c5f69bea7b5bc0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 01:58:37 GMT
server: cloudflare
etag: W/"6351fccd-1a9ae"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZyelyY8o8rlw6SSszXxkATrLMjPc%2Bi7qk%2F5zi4EBp5LQtZE0h6DZoqJ3O90HT5mBD6UZROv863s%2Fp2InUAceOGScOwnmXRTditnPEC%2BsdztFCN0VBZzOaE4FzmFV8gF9nvK3jy6LcDS5IOCpAPW4khwFDA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d79a4dacd-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 responsive.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/ 15 KB
3 KB 57ms
54ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/responsive.css?ver=5.9.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2e99d9f642cf26e56bad3ff3705fd8ab8ea028ffa302405d1642bb7456d796a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:19 GMT
server: cloudflare
etag: W/"6352012f-3c33"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1KyN%2Fr8S3nbD%2FnAYUL%2FM863GNZJGrGVqeN03QWCFSenZh89%2BVr4n7JVyd1CKGUBEQlvXF8usKe0Lb0uqYngqKp8RPFWKHTMFWFmKCSxok2BJe6otZhChat7w8oWcR4TgkIxPY3OpivJ17Mm3rCXCwVrXtg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d79a5dacd-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 font-awesome.min.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/ 30 KB
7 KB 90ms
88ms Stylesheet
text/css 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:20 GMT
server: cloudflare
etag: W/"63520130-7918"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PBqi6GnGROHpc8fCcDcrlnhRI2JUzx4vEhQ14Ui0Y8SrWeKehe1IMEBuP8bg5EHSTMH8aZnR1fs42boE1WeN7Ut8uM1boJqvir%2Faid4OZ4vJPfCg9PiMyA2JoCsQbD1jklgdUtDsek7EiJqmpq6WWsr5pg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d79a8dacd-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 css
fonts.googleapis.com/ 58 KB
3 KB 218ms
81ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

253ce4a3cb84db5cb5505c8843c26aebe9d5e4c1bfbd36496e75c5f1964295b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 21:43:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:45 GMT

GET
H2 200 jquery.min.js Show response
freedomheadlines.com/wp-includes/js/jquery/ 87 KB
32 KB 91ms
89ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5431228
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:02 GMT
server: cloudflare
etag: W/"6352011e-15db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=etvEFX7WfWVaazJFexcZz%2FPbhurx6zdZaSUX7OC%2FAyMrG%2FeGb8Ym0xsbF4AwlrhqmkyX8eOOUtRwKPe4XIlrDH9r%2BxxzB2JscFWgMuVcsnZhube7xrN%2FFwkT54isFltUEXMh%2B0XMvT5XjcO%2BYFKFrVLQpw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d79aadacd-MIA
expires: Mon, 11 Nov 2024 13:10:50 GMT

GET
H2 200 jquery-migrate.min.js Show response
freedomheadlines.com/wp-includes/js/jquery/ 11 KB
5 KB 63ms
61ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5835376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-2bd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BVcwdGgYXVFytsyrof%2BzsL1Q4LCBOhGfQUoXcRs5EjwOHV2fpnRvdeOAFmN6khxYqfb0g6VSQYEFqeFY1a5WoggBprfhgfR27ikDN04ugtbQ3SCw1Cj2mAbV171Vs1JHECQsfk8nirE7%2FBeROVoHGGy8pQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920d79abdacd-MIA
expires: Thu, 28 Nov 2024 12:19:58 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 97 KB
30 KB 421ms
92ms Script
text/javascript 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3231c1d163f6e62d88e8538d7d7f37620559a9b13034d8940faf7bab0e71f842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29825
x-xss-protection: 0
server: cafe
etag: 801 / 19759 / 31080925 / config-hash: 11818957895304582832
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 21:43:46 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 190 KB
69 KB 416ms
88ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-32644619-11

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a89c719a8e89fae4aaf65f22efe6ff64c96517879a21b013530b9bece6558b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 69904
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 06 Feb 2024 21:43:46 GMT

GET /
users.api.jeeng.com/users/domains/mO6DXK83XA/sdk/ 0
0

GET
H2 200 FH-2021-sized-1.jpg
freedomheadlines.com/wp-content/uploads/2021/01/ 28 KB
28 KB 63ms
62ms Image
image/jpeg 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2021/01/FH-2021-sized-1.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5f4f96e32a749a3c07b566aceb9b84a8445c71ca9713a4bfce9b7d28731fc33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5823328
alt-svc: h3=":443"; ma=86400
content-length: 28587
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 01:55:25 GMT
server: cloudflare
etag: "6351fc0d-6fab"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jYHCKp0zSvk5NsCWjJuFzzKsWJ8im1Tg7EfMj1g8k5FTjZd9l39sHjqYrBMVzYJbnrd6Hfq%2FH5Qc8A3mpwjwYG5rL9nY%2BPoEFsGWcFl4PkiS4E%2FunPk8Z%2Bn50s7d36VyiE7mFrQBG6OV4LzQ33sSg57x4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920d79addacd-MIA
expires: Tue, 12 Nov 2024 11:19:06 GMT

GET
H2 200 Screenshot-129-800x475.png
freedomheadlines.com/wp-content/uploads/2024/02/ 391 KB
391 KB 133ms
132ms Image
image/png 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/02/Screenshot-129-800x475.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a667beff2d4ade1db23b92678ad6a483aa87ee98a0049e9926534575cacf4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 400016
x-xss-protection: 1; mode=block
last-modified: Sat, 03 Feb 2024 15:23:51 GMT
server: cloudflare
etag: "65be5a87-61a90"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RoiBdaeZu01gxjma6lFWEx8XhSlZ0976X68rXTElfRqutBk5lB1aPSFzC%2FphhbMYBBeCZ4OxlnnkMxaEtJCQjKhi8RpG8fp4MHuR7d%2F8SVLh9kuMVE8wOpP%2B0EPcUYts3WPbbyvavNmKkO2ke%2FbFIiOHSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920daa11dacd-MIA
expires: Sun, 02 Feb 2025 15:24:54 GMT

GET
H3 200 Screenshot-129-440x261.png
freedomheadlines.com/wp-content/uploads/2024/02/ 156 KB
157 KB 43ms
42ms Image
image/png 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/02/Screenshot-129-440x261.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aa66801f17ac0d096b75a914a2f84a88207787403c52686b5c41e2d7c77c1e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 170083
alt-svc: h3=":443"; ma=86400
content-length: 159820
x-xss-protection: 1; mode=block
last-modified: Sat, 03 Feb 2024 15:23:53 GMT
server: cloudflare
etag: "65be5a89-2704c"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WNpZEtyzN9hwcvJMN1QlhOcKu%2FFvZ%2FwgFZ6vKNVmKWjc3QjjX%2Bvex1JhJV0COskwZszrBcM5uHHVuuY2nE0TWPYsSHMO4kDQaC5WPVir%2BtnN0czpRDycKCz3fTqFHHks3TjKfrnoSgn4YzPN1an%2BPDMxsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920dff586da3-MIA
expires: Sun, 02 Feb 2025 15:24:54 GMT

GET
H2 200 widget_v3.js Show response
cdn.whizzco.com/scripts/widget/ 7 KB
3 KB 149ms
62ms Script
application/javascript 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d8562efd8364015edd8080e72d8bd98f0a92019058f15df14e03f9951e01876

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
via: 1.1 31d0f5402937d8e69db50160c44f0fc4.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: MIA3-P4
age: 90
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 05 Mar 2023 13:26:38 GMT
server: cloudflare
etag: W/"af75195749ffac29c536aae88fdbda39"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MqBBWwUXCP2VAdsdgT5y9QBKMTKt3ladSHp7nEInU0W4DRcdEmhnXpUIrbL8Nq%2Beuof3orkq78x6FYjqCvC%2BeV%2BUkPyFTVUVCShd3DLTmiNT5b5rpAeZXHpBk91zbLHxFO89cc5xFZ65s%2BeV0Z8%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Access-Control-Allow-Origin
cache-control: max-age=14400
vary: Accept-Encoding
cf-ray: 8516920f6ef77420-MIA
x-amz-cf-id: opzCdV-7w9Nw4fI6jMJzvMwtMNB_3lBYVuhwyot5M1fBEsF69yRmNg==

GET
H3 200 email-decode.min.js Show response
freedomheadlines.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 98ms
98ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 30 Jan 2024 18:47:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b94449-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IGYU1l3%2FZz93mqeTe4GHr7usoQi%2FXBYouFi42GnnO6WT6GSLF%2BjS9eEOXyR4QVm%2B%2FnFtwZZp5TZ8vGijXoqQE%2Bc5xmRgNhcqGpEil1WVCxIYqUKiqx0VQHR4ohGJRgmuVWvAx6B%2B8IdZ8x2Eo95c%2BV1mqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 8516920e78326da3-MIA
expires: Thu, 08 Feb 2024 21:43:45 GMT

GET
H2 200 freedomheadlines_freedomheadlines_sticky.js Show response
cdn1.lockerdomecdn.com/embeds/ 1003 B
1 KB 382ms
66ms Script
application/javascript 2600:9000:25c8:c800:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/embeds/freedomheadlines_freedomheadlines_sticky.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25c8:c800:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2bcf7c31dad5a7352c5b9750d4e991939473441aef5d9ea22c036a47df0e1dca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:02:10 GMT
x-amz-version-id: 2FslkIyxepjVYcj6UqIyjxnPoJ3KBM3m
via: 1.1 ddcac3e1d2d0eae07c0ba394a446dda2.cloudfront.net (CloudFront)
last-modified: Thu, 05 Jan 2023 17:31:35 GMT
server: AmazonS3
x-amz-cf-pop: PHL51-P1
age: 81697
etag: "c33cc7321d972455c359a8bc75ba8455"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 1003
x-amz-cf-id: AAlB-EV40TJfrVm0qjguGZZUJ0AzsPZrYm4nDX_la-f5K-2GvodkKQ==

GET
H3 200 components.js Show response
freedomheadlines.com/wp-content/themes/breena/inc/assets/js/ 241 KB
67 KB 69ms
67ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/js/components.js?ver=5.9.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1bcf2aae786aa72292ec28f330390b1e324f4c273f9ca993150b5163620d862

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:20 GMT
server: cloudflare
etag: W/"63520130-3c5ec"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FZ1RruATx47DSLRHie1qwevMGR9JjV3J17Tu02P7If0O1qHjna5J9DvZCxMkBnD%2B0kmxjeP%2Fk7HxSM%2BLRvJi4pvxBnXJaWxWQwRW06FYws8Mr0I%2FjihfBy4raNBK%2Fxvi4bdEXMHnyhxntkIo%2BDqNwEmB3w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ed8a16da3-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H3 200 breena.js Show response
freedomheadlines.com/wp-content/themes/breena/inc/assets/js/ 13 KB
5 KB 57ms
51ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/js/breena.js?ver=5.9.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6f14681142e16db6027f013840dc46f68cce2f3c5ccf8814d2361d06b5127d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:18 GMT
server: cloudflare
etag: W/"6352012e-356e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ytAXu06QP5oKd3JYuQFqaFlMmXNlVe7xs46eM6I%2B%2FfxhPCOWjuLy4XWewAmngA8YKs8ja9cSK3b3fL5%2Bcitsz9VRzovkGkNHIvSldPr4qpb5C9elpIKEtsdB4eetWQzH7a2gmK6thTG6o6yxUKzpveRCkA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ee8ad6da3-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H3 200 mediaelement-and-player.min.js Show response
freedomheadlines.com/wp-includes/js/mediaelement/ 154 KB
38 KB 59ms
53ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5911792
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-267aa"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xYOHMsw8gCe9U3hCypuDGuwOi9wRVDJ%2Bzm8pX12spm2lgFG7mtvOj1EOK0CJJUd%2BSHXYIkTMRwbXhMb0RkkKkqboKYsXeGYR%2FsY58mtHlFRHvA5h8ND9YUWZB0MzQHicJrNamhywJA4QKWgLRXxvM6VhmA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ee8b06da3-MIA
expires: Wed, 27 Nov 2024 09:47:26 GMT

GET
H3 200 mediaelement-migrate.min.js Show response
freedomheadlines.com/wp-includes/js/mediaelement/ 1 KB
1 KB 53ms
47ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=5.9.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-4a9"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PIlj4EkbETn%2B%2Bi%2FQ1EJDaQcQhs0%2BBPe4slNlxiTCyXmrL7gT33HlvXzE57Grd3ABzQNs7uvZDXrSSeLCD%2FC8Hxfa2WwIs%2F9sKfH4h0ZexcFBgvFIZQYyZc6%2BCxvwkSvGJwEX89o2ISHqug3dXlTOS%2BL3Vw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ee8b16da3-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H3 200 wp-mediaelement.min.js Show response
freedomheadlines.com/wp-includes/js/mediaelement/ 906 B
991 B 54ms
48ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=5.9.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-38a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jjohZFj72Nv6A8Qj%2BxJwP2H6qOA69iUfOdtUAfRir0f2dlGVlnNv1gHV6Zr87QAD6n%2FEP4Gt2hGybIWlcu%2Filtda45W2f0dNdx16UMANAAP9ml8aOc4mTYy3KOXeeyySUVAqaXZG%2BVSS6NZHAOIxlNBO4A%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ee8b36da3-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H3 200 comment-reply.min.js Show response
freedomheadlines.com/wp-includes/js/ 3 KB
2 KB 55ms
50ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/comment-reply.min.js?ver=5.9.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:03 GMT
server: cloudflare
etag: W/"6352011f-ba3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPhA8qkRXmiZA8ieZKQ1NaFbL%2B2Y55ZKMxcIwDDuo6y73Ny0%2BWKOn1oU1jt6d6z%2BnxkIUL1JnP0SR9O1CJwbSwxIgMPmKxup8WgNGd7tOcqA3sqSDy6KcUu3KJBNxhbyfntlU9f5bnSPSmWhBeADb%2ByKsw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ee8b66da3-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H3 200 wp-emoji-release.min.js Show response
freedomheadlines.com/wp-includes/js/ 18 KB
5 KB 52ms
51ms Script
application/javascript 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 532152
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-4705"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxYO5g0qaL1DSGsT1vU36wzAK%2FRBM0QFkX5u2D8idCwVRLrUCPJ3Hx37E%2FdUPPAzWoneTXixG8DLXNq8bvq9VENMX%2FaJ46vGtu3yvXj2MZ2oJus8fctvIul57qfsTTkzlE6Q66Yvnm%2BZS71F4MYDaKOR6g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8516920ee8bc6da3-MIA
expires: Thu, 30 Jan 2025 17:47:14 GMT

GET
H2 200 ajs.js Show response
cdn2.decide.dev/_js/ 6 KB
3 KB 390ms
66ms Script
application/javascript 2600:9000:20ed:2800:3:7df3:55c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.decide.dev/_js/ajs.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ed:2800:3:7df3:55c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 571b06d1913de139d860b755ded1b677f7bae6a45ddd2c30393fadc8e8720279

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 14:20:59 GMT
content-encoding: gzip
via: 1.1 google, 1.1 934f97734451ac135c3e6c1480f72d4e.cloudfront.net (CloudFront)
last-modified: Thu, 01 Feb 2024 04:20:37 GMT
x-amz-cf-pop: PHL50-C1
age: 26567
etag: W/"1675-18d62e5b507"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
accept-ranges: bytes
x-amz-cf-id: z62JcQjVBQ7yhgjNLmbGJDlAKnOSx_awum4ERRqDGu5aaTGqrG6RDA==

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 454ms
142ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:10:29 GMT
x-content-type-options: nosniff
age: 592397
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jan 2025 01:10:29 GMT

GET
H3 200 fontawesome-webfont.woff2
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/fonts/ 75 KB
76 KB 56ms
55ms Font
font/woff2 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.9
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 548156
alt-svc: h3=":443"; ma=86400
content-length: 77160
last-modified: Fri, 21 Oct 2022 02:17:20 GMT
server: cloudflare
etag: "63520130-12d68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3FNu6wgey0nkrJ38s%2B%2FHanMjIQrz78p0tx8BjVJXLl%2FaFjRH3g6okmN70gDh8B09RoSsbURFR%2F%2FV6PSR8rCLnUrLAdp%2B%2F65bv7uI8WI0F5ZokSXpf2OXMja6fW894TDxC5wu26tRlc%2FAEngYGZQH0zLc1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920ef8d66da3-MIA
expires: Sat, 04 Jan 2025 00:31:15 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 380ms
68ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:26:11 GMT
x-content-type-options: nosniff
age: 591455
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jan 2025 01:26:11 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 486ms
175ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:15:09 GMT
x-content-type-options: nosniff
age: 476917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 31 Jan 2025 09:15:09 GMT

GET
H3 200 Screenshot-140-150x150.png
freedomheadlines.com/wp-content/uploads/2024/02/ 44 KB
44 KB 43ms
42ms Image
image/png 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/02/Screenshot-140-150x150.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

077d80faf2c6d15254aa0a02a389402e35cbab4179196bcd1550f03e3904bfc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 34692
alt-svc: h3=":443"; ma=86400
content-length: 44983
x-xss-protection: 1; mode=block
last-modified: Mon, 05 Feb 2024 16:42:14 GMT
server: cloudflare
etag: "65c10fe6-afb7"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6cDUreJUmx2mSa19pq%2BXqbY5lg3eRLwId0G5NOSy8UyqPhYWuV%2FLHiaqrt3VurDx9N4aPfw5eAiUxZ9%2B1vNuBiPD3gqlltWBZaLoS6deTqvBV042ohcF0CGyAChOfu7%2ByFNhaEt8lhtdlIjXy68tEp0iuw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920f29066da3-MIA
expires: Wed, 05 Feb 2025 07:49:47 GMT

GET
H3 200 Screenshot-143-150x150.png
freedomheadlines.com/wp-content/uploads/2024/02/ 29 KB
30 KB 57ms
57ms Image
image/png 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/02/Screenshot-143-150x150.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3addb83f1794be21eb2a7b45cbf6b6b6fe5ce450ca34d2cad026cc23ea64ae52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 34692
alt-svc: h3=":443"; ma=86400
content-length: 29924
x-xss-protection: 1; mode=block
last-modified: Mon, 05 Feb 2024 17:12:17 GMT
server: cloudflare
etag: "65c116f1-74e4"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AKzOQEPq4t%2BXqGLQ%2F2pI7LHT8Gkpxvt8zQMVA3txCTTlvVqEB5H%2ByqRjxoucvs2Wnj0Nwdf6FalDIM3AUQV%2FCABYYjm%2BtEzWOwbvQDd5ZhWAfyNTcyUqUoMI9XGO3tctadLH2FiDEIZn2HLgXGDZ5WvriQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920f29086da3-MIA
expires: Wed, 05 Feb 2025 07:48:41 GMT

GET
H3 200 Screenshot-69-150x150.png
freedomheadlines.com/wp-content/uploads/2024/02/ 38 KB
38 KB 60ms
59ms Image
image/png 2606:4700:3031::ac43:a0b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/02/Screenshot-69-150x150.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:a0b9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c72d095531cede90188561a358939be4d6decaaffa7d156d5561a8dc5a816bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 34692
alt-svc: h3=":443"; ma=86400
content-length: 38857
x-xss-protection: 1; mode=block
last-modified: Mon, 05 Feb 2024 16:58:03 GMT
server: cloudflare
etag: "65c1139b-97c9"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yTVj5kZ9dQ5pNf3b7N2K5xEX3c94aW0MorJfcPsOYchm6Ybjcg32fSk9%2BoRkTnP7ZXiPfyDJB7bg1vSq6S5Yeah6KwW3OHH2rSVEoEalzTXMFUajteB8fvuNOUfOOwae6cWq%2BdJ7CKjWhZ6yiogPZDjInw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8516920f29096da3-MIA
expires: Wed, 05 Feb 2025 07:48:40 GMT

GET
H2 200 platform.js Show response
cdn.vuukle.com/ 256 KB
64 KB 135ms
54ms Script
application/javascript 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/platform.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca834e61ff3a9e41d55a140201ce56b1d4380abb259bdafb949ba9646e66c5dd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:45 GMT
content-encoding: br
cf-cache-status: HIT
age: 42710
cf-polished: origSize=261763
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 06 Feb 2024 09:50:28 GMT
server: cloudflare
etag: W/"65c200e4-3fe83"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=7200
cf-ray: 8516920fbd90dab9-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

POST
H3 200 rtads Show response
api.whizzco.com/demand/v1/ 626 B
819 B 275ms
234ms XHR
application/json 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e051bf1d9e0e6d44a2db5887e43b2383cc9016194bd59c7d5067d70cf296a44

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FAUisgHFPWY1kZfdkIkOVONZ44zXj7DuWusHr7Vnzk7%2BZ%2BwlC0022bzLX9NKuJgYEactWacNU91wl8P97Yy8PZD7z%2B0RaOCFVwxBGddMj1dLtnx0pJsXpmkAOhR5OqjHJtOuWE4Tcsgk89ZctCE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 85169211fbba31de-MIA
alt-svc: h3=":443"; ma=86400
priority: u=1,i

POST
H2 200 getGeo Show response
vuukle.com/ 113 B
374 B 137ms
48ms XHR
application/json 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vuukle.com/getGeo
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c61aab476e6ae3c05e5eac8a401047cbd6b30e0c16ef5ad14f7bcfec9694e9f2

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
accept-ch: sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-viewport-width
server: cloudflare
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,HEAD,POST,OPTIONS
access-control-allow-origin: *
content-type: application/json;charset=UTF-8
cf-ray: 85169210e9e35d0e-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 loadVuukle Show response
api.vuukle.com/api/v1/Comments/ 11 KB
3 KB 413ms
333ms XHR
application/json 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.vuukle.com/api/v1/Comments/loadVuukle?apiKey=92fd8992-dbb2-4d42-9cc3-1b8101c44b9b&articleId=30702&globalRecommendation=false&host=freedomheadlines.com&start=0&uri=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&quizEnabled=false

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1f64862a7cb33dc66abf6e2ad3b29fd069be1d3936a84c16cb62de2ff5ab18e

Security Headers

Name	Value
X-Xss-Protection	1

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
via: 1.1 varnish (Varnish/6.2)
content-encoding: br
cf-cache-status: DYNAMIC
age: 0
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
pragma: no-cache
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
x-varnish: 442738008
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-store,no-cache
access-control-allow-credentials: true
access-control-allow-credentiails: true
cf-ray: 85169210e9cdb3ef-MIA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2 200 freedomheadlines.com.js Show response
cdn.vuukle.com/domain-configs/ 139 B
233 B 54ms
54ms Script
application/javascript 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/domain-configs/freedomheadlines.com.js
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdf47e9be1ad651fcad55288d534fbeeba846ce487322a2b8f1f7e0f6dfaab12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: HIT
age: 88160
cf-polished: origSize=186
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 05 Feb 2024 16:14:49 GMT
server: cloudflare
etag: W/"65c10979-ba"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=1800
cf-ray: 851692109f76dab9-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 index.html Show response
cdn.vuukle.com/widgets/ Frame 03C5 335 KB
107 KB 62ms
61ms Document
text/html 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/index.html?version=3.32.3
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6f607cc20a654cc7a3866988a39751a0fec99f90279c82dd8c58072c497ca93

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
age: 39482
alt-svc: h3=":443"; ma=86400
cache-control: max-age=10800
cf-cache-status: HIT
cf-ray: 85169210d867dab9-MIA
content-encoding: br
content-type: text/html
date: Tue, 06 Feb 2024 21:43:46 GMT
last-modified: Tue, 23 Jan 2024 10:42:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 emotes.html Show response
cdn.vuukle.com/widgets/ Frame 1B75 88 KB
31 KB 52ms
52ms Document
text/html 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/emotes.html?version=3.12.7
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dce71ab51a78cd822e206359a85e59842a5159b17de2689b0e0e19db929143e

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
age: 39491
alt-svc: h3=":443"; ma=86400
cache-control: max-age=10800
cf-cache-status: HIT
cf-ray: 85169210d86fdab9-MIA
content-encoding: br
content-type: text/html
date: Tue, 06 Feb 2024 21:43:46 GMT
last-modified: Tue, 23 Jan 2024 10:42:53 GMT
server: cloudflare
vary: Accept-Encoding

OPTIONS
H2 200 rtads
api.whizzco.com/demand/v1/ Frame 0
0 298ms
125ms Preflight 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85169210ef5d21c1-MIA
content-length: 0
date: Tue, 06 Feb 2024 21:43:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0u0mleB5ody2fuxbhhW1TvXFmhUc9vPKx4YWXLQVnodiDLt4h2e38%2BCM7bJt9up1u3fsE7%2FQsjhEyae%2FO%2BDor59K4EId7SYAVk2PRwcqfWMN7GTkD9MEJLWwL%2FYLpi%2BvgTm0B61L8E4E2xc0nO8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 prebid3.js Show response
cdn.vuukle.com/static/ 448 KB
145 KB 62ms
61ms Script
application/javascript 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/static/prebid3.js
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbbc1d6d55e90d54956dd8aa41d8edfb36f72f11125b04cdba0efad8fd875ce7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: HIT
age: 658109
cf-polished: origSize=608215
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sat, 30 Dec 2023 16:47:33 GMT
server: cloudflare
etag: W/"659049a5-947d7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=43200
cf-ray: 85169210ff79da97-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 freedomheadlines.com.json Show response
cdn.vuukle.com/ads/ 16 KB
1 KB 1250ms
1214ms XHR
application/json 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/ads/freedomheadlines.com.json
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f48bbdaebf4cd06636120162cde7b0394650efbd4b8b44621ad604a8797b5c9e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Tue, 06 Feb 2024 15:15:07 GMT
server: cloudflare
etag: W/"65c24cfb-3eba"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cf-ray: 8516921128744c26-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
alt-svc: h3=":443"; ma=86400

GET
H3 200 emotes.css
cdn.vuukle.com/widgets/ Frame 1B75 10 KB
3 KB 133ms
132ms Stylesheet
text/css 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/emotes.css
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/widgets/emotes.html?version=3.12.7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f925fa8dbc81f392877586a648a300da7b3d1a868b84ba700d67946e9f1e625d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: HIT
age: 39583
cf-polished: origSize=10047
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 23 Jan 2024 10:43:13 GMT
server: cloudflare
etag: W/"65af9841-273f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=10800
cf-ray: 85169211381eda97-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 comments.css
cdn.vuukle.com/widgets/ Frame 03C5 38 KB
10 KB 97ms
97ms Stylesheet
text/css 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/comments.css
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/widgets/index.html?version=3.32.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 052f1afdf61b295c91dcf79a3ef83089696ff180ea146a4331a6ca6659b4d523

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: HIT
age: 39637
cf-polished: origSize=39152
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 23 Jan 2024 10:42:34 GMT
server: cloudflare
etag: W/"65af981a-98f0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=10800
cf-ray: 85169211790dda97-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 bq-publish Show response
publish.vuukle.com/ 28 B
328 B 319ms
318ms XHR
text/plain 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://publish.vuukle.com/bq-publish?callback=&{%22action%22:%22view_page%22,%22hashed_email%22:%22$fa25e1-1ffe-4256-b543-a3355822fd79%22,%22hostname%22:%2292fd8992-dbb2-4d42-9cc3-1b8101c44b9b%22,%22pubdomain%22:%22freedomheadlines.com%22,%22refDomain%22:%22%22,%22sessionId%22:%22a3a4e18b-3f67-446f-a14b-1db358889e46%22,%22version%22:%224.20%22,%22articleImg%22:%22%22,%22articleTitle%22:%22Eyewitness%20to%20killing%20of%20Run-DMC%E2%80%99s%20Jam%20Master%20Jay%20tells%20jury:%20%E2%80%98Then%20I%20see%20Jay%20just%20fall%E2%80%99%22,%22article_id%22:%2230702%22,%22hashed_article_url%22:%22freedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F%22,%22referrer%22:%22Mubariz%22,%22tags%22:%22%22,%22browser%22:%22Chrome%22,%22device%22:%22Desktop%22,%22os%22:%22Windows%22,%22isArticleBrandSafe%22:null}&_=1489139930741

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b99c55c9eb310eb2bd960cb8b5777470c7684dc92ebe781f71a1ebfadb2d961

Security Headers

Name	Value
X-Xss-Protection	1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 85169211ab435d0e-MIA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1

GET
H2 200 sjs.js Show response
cdn2.decide.dev/_js/ 10 KB
2 KB 66ms
65ms Script
application/javascript 2600:9000:20ed:2800:3:7df3:55c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.decide.dev/_js/sjs.js
Requested by: Host: cdn1.lockerdomecdn.com
URL: https://cdn1.lockerdomecdn.com/embeds/freedomheadlines_freedomheadlines_sticky.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ed:2800:3:7df3:55c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 61773d9a3aa1ba14b2f4ea9a8118c619c460c5acbc8770405530cc5ce31ed7e4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 10:24:46 GMT
content-encoding: gzip
via: 1.1 google, 1.1 934f97734451ac135c3e6c1480f72d4e.cloudfront.net (CloudFront)
last-modified: Thu, 01 Feb 2024 04:20:37 GMT
x-amz-cf-pop: PHL50-C1
age: 40740
etag: W/"26be-18d62e5b4e1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
accept-ranges: bytes
x-amz-cf-id: pk6kX3Y_mQLPgFYjj0rpTXA8WHatcRU5hTrG8ZPRfbINW6BDNxByHA==

GET
H2 200 14305628449616998 Show response
decide.dev/lad/ Frame B9CD 1 KB
1 KB 206ms
125ms Document
text/html 34.149.139.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://decide.dev/lad/14305628449616998?pubid=ld-1613-6204&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&x=220&y=1391.3125&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by: Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.139.129 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 129.139.149.34.bc.googleusercontent.com
Software: /
Resource Hash: f670413d2ae1a2ae6adb0f76cf9a23e52e96324d60f3c10658a9bfe558a6513d

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, max-age=0, must-revalidate, no-store
content-length: 1342
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:46 GMT
via: 1.1 google

GET
H2 200 14305626872558694 Show response
decide.dev/lad/ Frame ABEA 1 KB
1 KB 248ms
176ms Document
text/html 34.149.139.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&x=220&y=1879.3125&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by: Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.139.129 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 129.139.149.34.bc.googleusercontent.com
Software: /
Resource Hash: f670413d2ae1a2ae6adb0f76cf9a23e52e96324d60f3c10658a9bfe558a6513d

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, max-age=0, must-revalidate, no-store
content-length: 1342
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:46 GMT
via: 1.1 google

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/ 436 KB
137 KB 72ms
62ms Script
text/javascript 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2591678fad53984444b2ac01da6b320f0f4262b759dd6e7e308961c369e18bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:37:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 376
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139610
x-xss-protection: 0
server: cafe
etag: 8632381593817151086
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 05 Feb 2025 21:37:30 GMT

GET
H2 200 14729220068684902 Show response
decide.dev/lad/ Frame 85A4 1 KB
1 KB 118ms
117ms Document
text/html 34.149.139.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&x=-100779&y=101199&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by: Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.139.129 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 129.139.149.34.bc.googleusercontent.com
Software: /
Resource Hash: f670413d2ae1a2ae6adb0f76cf9a23e52e96324d60f3c10658a9bfe558a6513d

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, max-age=0, must-revalidate, no-store
content-length: 1342
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:46 GMT
via: 1.1 google

GET
H3 200 freedomheadlines.com.json Show response
cdn.vuukle.com/ads/ 16 KB
1 KB 374ms
373ms Fetch
application/json 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/ads/freedomheadlines.com.json
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f48bbdaebf4cd06636120162cde7b0394650efbd4b8b44621ad604a8797b5c9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Tue, 06 Feb 2024 15:15:07 GMT
server: cloudflare
etag: W/"65c24cfb-3eba"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cf-ray: 85169213abd94c26-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
alt-svc: h3=":443"; ma=86400

GET
H3 200 widget_v3.js Show response
cdn.whizzco.com/scripts/widget/ 7 KB
3 KB 44ms
43ms Script
application/javascript 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d8562efd8364015edd8080e72d8bd98f0a92019058f15df14e03f9951e01876

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
via: 1.1 ed047841b922f7dcf5bcfb295eb3311c.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: MIA3-P4
age: 4284
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 05 Mar 2023 13:26:38 GMT
server: cloudflare
etag: W/"af75195749ffac29c536aae88fdbda39"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zB6gju0LqVhpih7eaYbcUNUFrBReZtXqL2U8CVKvTCL9vYhoZzs8YJekRoLy01FV3HwHc64l5XePggafyIGufsGX8haacZt0OmF3pBejCwM7G7QoOQj9YMgJge34K6zSV4clTYdHEFWagcikUYU%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: Access-Control-Allow-Origin
cache-control: max-age=14400
vary: Accept-Encoding
cf-ray: 85169213fef031de-MIA
x-amz-cf-id: d83CMyD4h5QCSJ_Vc7lGfbVTDGQozBE2JCuvksMT2A-lRSnT6h-TgA==
priority: u=3,i=?0

GET
H2 200 delivery.js Show response
assets.revcontent.com/master/ 162 KB
48 KB 209ms
68ms Script
text/javascript 13.224.214.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/delivery.js
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-14.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7061ad8c2be93fd12e4681e238aeb157d2ff81171fc9c25f56ff531afa381058

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 18:07:28 GMT
content-encoding: br
via: 1.1 aa68d5eaf078dffca4154e55039dbb84.cloudfront.net (CloudFront)
last-modified: Tue, 06 Feb 2024 18:07:20 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 12979
etag: W/"cb07a9b7f96ab29e717e100f807abbe6"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: PJdAsT8nblV0uvvFXc3ko7tFFNXF-Bf2ZjbFF5YnjZHiDPjCmiCScQ==

POST
H3 200 tshow Show response
api.whizzco.com/dtracking/v1/ 15 B
485 B 128ms
126ms XHR
application/json 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=42ERZvfKlLJPrEtcTRoyZtXrgpJGQy8JnCzp9SzjduMATkre1fczcDCg8lkgWaHM2A1jpFXHeAeN3gVD9z3ECc2KY08zkQs0ghVCvvi3%2FIpxG920Mk2qY93VAt4nfEWYkpuyae4TSYUP0U0o5Gg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 85169214cb2d4984-MIA
alt-svc: h3=":443"; ma=86400
content-length: 15
priority: u=3,i=?0

OPTIONS
H2 200 tshow
api.whizzco.com/dtracking/v1/ Frame 0
0 128ms
127ms Preflight 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85169213fc5721c1-MIA
content-length: 0
date: Tue, 06 Feb 2024 21:43:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QVfm5KjRuC02dGtuKmv4hS0q1%2BRsVjn8OSWDm%2BgF0RXmVwZ2%2Blm%2FdOSO%2FCG8z5Eww4LUVzFW1j6ggdZ87ykovN9p0y1Wiiy0gI6vUWpnMfDiwGo8cHNnVtCS1IMfklcJTC6oZ3d3Qe3X2bc%2F7Pw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 220 KB
78 KB 89ms
88ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CP4TF595X7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32644619-11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

25d49ed8029cd1a8c2c404919c24d85962799fc3923710653ba1ec5d020fc1a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 80083
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 06 Feb 2024 21:43:46 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 199ms
63ms Script
text/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32644619-11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 19:51:43 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6723
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 06 Feb 2024 21:51:43 GMT

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame B9CD 45 KB
17 KB 189ms
61ms Script
text/javascript 2607:f8b0:4004:c09::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: decide.dev
URL: https://decide.dev/lad/14305628449616998?pubid=ld-1613-6204&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&x=220&y=1391.3125&utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://decide.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 20:48:36 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3310
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Tue, 06 Feb 2024 22:48:36 GMT

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame ABEA 45 KB
17 KB 206ms
79ms Script
text/javascript 2607:f8b0:4004:c09::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: decide.dev
URL: https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&x=220&y=1879.3125&utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://decide.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 20:48:36 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3310
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Tue, 06 Feb 2024 22:48:36 GMT

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame 85A4 45 KB
17 KB 262ms
137ms Script
text/javascript 2607:f8b0:4004:c09::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: decide.dev
URL: https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&x=-100779&y=101199&utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://decide.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 20:48:36 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3310
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Tue, 06 Feb 2024 22:48:36 GMT

GET
H2 200 213794966 Show response
fundingchoicesmessages.google.com/i/ 183 KB
61 KB 254ms
118ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/213794966?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a937456cbf115f03d429700ab3f2830f5350fd7e7a9a0506c82b76337d8285df

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-eZjFa-SEiaWty2OijiKlLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-eZjFa-SEiaWty2OijiKlLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjWsOoxSXF4KUhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ySTw9SWTBBBrAfE7yVdM34B4h48Hy5vw6ax8EdNZ4-qmsxYAMd-66ayG66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYQIP6cOYP1NxCX3T7HWgfEwnLnWaWBWIiHY9KFrnVsAh-en2lkBgCp0k3_"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 image-freedomheadlines.com-30673
image.vuukle.com/ Frame 03C5 25 KB
26 KB 55ms
54ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30673
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59ec1d54b5517e5da955dc9c7cd47001e3462ac61e5f95c62c087d22438732ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 348500
cf-polished: origFmt=png, origSize=44422
x-guploader-uploadid: ABPtcPr8ekACkQcJUbDUS4UNRIilj71F-lzCB2b3GKSSM9X-W3lQehQZj2xHieJ8TQjAWJaUs-q2I9TqAQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 26050
cf-bgj: imgq:100,h2pri
last-modified: Fri, 02 Feb 2024 10:47:20 GMT
server: cloudflare
etag: "9256d46e4ff328f7a41af5da1999c4e3"
vary: Accept
x-goog-generation: 1706870840640121
content-type: image/webp
x-goog-hash: crc32c=mODCgQ==, md5=klbUbk/zKPekGvXaGZnE4w==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 44422
accept-ranges: bytes
cf-ray: 851692146fb9dab9-MIA
expires: Fri, 02 Feb 2024 21:55:26 GMT

GET
DATA 200
OK truncated
/ Frame 03C5 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3cd72707a6eb0ba2f481bf98476ada929d93c3cc1ccf2fa702f4e237ddbea113

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 image-freedomheadlines.com-30669
image.vuukle.com/ Frame 03C5 34 KB
35 KB 47ms
47ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30669
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1497585d35114397fcc194655ba454903016d5cce5f0c6bfeec4616a6340f80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 346181
cf-polished: origFmt=png, origSize=53769
x-guploader-uploadid: ABPtcPrt3b0BWIOaH280Ugeb0Kv9Sm-tPIsyOKYvQ54w0sGPg6yyZ04B3oJEgkOPuvADEWng9rmYSxETpw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 34962
cf-bgj: imgq:100,h2pri
last-modified: Fri, 02 Feb 2024 20:26:58 GMT
server: cloudflare
etag: "9b0f435e7f54a6cf75626cab78509bc8"
vary: Accept
x-goog-generation: 1706905618977617
content-type: image/webp
x-goog-hash: crc32c=kYuBBw==, md5=mw9DXn9Ups91YmyreFCbyA==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 53769
accept-ranges: bytes
cf-ray: 851692146fbedab9-MIA
expires: Fri, 02 Feb 2024 22:34:05 GMT

GET
DATA 200
OK truncated
/ Frame 03C5 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1c7910e18cb0252957c7e629b54d6fd7a90f7de6b3ac599ba4f1f8331313e92

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 image-freedomheadlines.com-30693
image.vuukle.com/ Frame 03C5 35 KB
35 KB 58ms
55ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30693
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8fb8a8fa1d26a1b76ce0acff9e5a0a81eb0ee391d3f80d4cf22dabd5ea76779f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 253735
cf-polished: origFmt=png, origSize=57821
x-guploader-uploadid: ABPtcPosNjknaRbHbLIQPuVhiewQ1_1ihnPL_ge2K6oJ-nZUnkC4uTbgwtYDndNF15YIHDM6shDRyu4v4Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 35896
cf-bgj: imgq:100,h2pri
last-modified: Sat, 03 Feb 2024 23:12:08 GMT
server: cloudflare
etag: "5dbb2ac87e8da5401370ae789773c6d0"
vary: Accept
x-goog-generation: 1707001928073700
content-type: image/webp
x-goog-hash: crc32c=/EIl0g==, md5=XbsqyH6NpUATcK54l3PG0A==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 57821
accept-ranges: bytes
cf-ray: 851692147fc6dab9-MIA
expires: Sun, 04 Feb 2024 00:14:51 GMT

GET
H2 200 image-freedomheadlines.com-30706
image.vuukle.com/ Frame 03C5 22 KB
22 KB 55ms
52ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30706
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 260ea0ba7fa22e4091fc3f376d83ebcda06e755bcd3241202143cd5b0bed1183

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 197862
cf-polished: origFmt=png, origSize=34526
x-guploader-uploadid: ABPtcPoG-MXg4OMAzFuJbHqE7tOzpNOvmRsKCMnu4WOhe4dN2BSRemGRo2fPVXiFRcShlydcXmI
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 22512
cf-bgj: imgq:100,h2pri
last-modified: Sun, 04 Feb 2024 14:19:37 GMT
server: cloudflare
etag: "42542459e25b35d7dcc08607d9e5bb56"
vary: Accept
x-goog-generation: 1707056377940226
content-type: image/webp
x-goog-hash: crc32c=POjOiQ==, md5=QlQkWeJbNdfcwIYH2eW7Vg==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 34526
accept-ranges: bytes
cf-ray: 851692147fc8dab9-MIA
expires: Sun, 04 Feb 2024 15:46:04 GMT

GET
H2 200 image-freedomheadlines.com-30738
image.vuukle.com/ Frame 03C5 32 KB
32 KB 59ms
56ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30738
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 768817493ce425bdeee7aaa9086f296500f625361566f4b768cb152b7da33a56

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 70268
cf-polished: origFmt=png, origSize=51085
x-guploader-uploadid: ABPtcPp7TZhr6dIws1FnIuhZ4UD11aIbjzZJa0Ecg-logsuLLpXdX2FgJ7QQTGVBcVIkNvI-zEp3ggPF_g
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 32302
cf-bgj: imgq:100,h2pri
last-modified: Mon, 05 Feb 2024 23:47:49 GMT
server: cloudflare
etag: "635f4ef7ef8d8938e3c0533d1f9ff2dc"
vary: Accept
x-goog-generation: 1707176869055070
content-type: image/webp
x-goog-hash: crc32c=aQ7qew==, md5=Y19O9++NiTjjwFM9H5/y3A==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 51085
accept-ranges: bytes
cf-ray: 851692147fcbdab9-MIA
expires: Tue, 06 Feb 2024 03:12:38 GMT

GET
H2 200 image-freedomheadlines.com-30676
image.vuukle.com/ Frame 03C5 33 KB
34 KB 51ms
49ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30676
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70c036e95f5572337b78ddcb7ec0845e1c31a4078b295f7753b050fafb883843

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 271905
cf-polished: origFmt=png, origSize=53905
x-guploader-uploadid: ABPtcPr1DHrD5gE48LuNaIa-pAB1KPBkEI0-Qs2UrZU_642fTcbPhRgMDVz3syuC-f4yceeHWpcX9VFWqg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 34064
cf-bgj: imgq:100,h2pri
last-modified: Sat, 03 Feb 2024 17:58:55 GMT
server: cloudflare
etag: "dd040ac5dfaa023709cb1536b9b7d648"
vary: Accept
x-goog-generation: 1706983135852158
content-type: image/webp
x-goog-hash: crc32c=uirj2A==, md5=3QQKxd+qAjcJyxU2ubfWSA==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 53905
accept-ranges: bytes
cf-ray: 851692147fccdab9-MIA
expires: Sat, 03 Feb 2024 18:59:49 GMT

GET
H3 200 image-freedomheadlines.com-30689
image.vuukle.com/ Frame 03C5 26 KB
27 KB 55ms
49ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30689
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36339c59e4271846c65d2a3286a3fc7b30b6300458ebf27e800af0c2e382d4ed

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 208993
cf-polished: origFmt=png, origSize=42602
x-guploader-uploadid: ABPtcPpXMuL6d3a1ak4yk4XkC1svxDfJrIMg1Wb_wUgGwb9INaFtQU4U6ZbH3npb3qvPtkrWLUk
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 26808
cf-bgj: imgq:100,h2pri
last-modified: Sun, 04 Feb 2024 06:42:36 GMT
server: cloudflare
etag: "ddf829322b37535fb75fa22f438b383b"
vary: Accept
x-goog-generation: 1707028956391099
content-type: image/webp
x-goog-hash: crc32c=fKQ98A==, md5=3fgpMis3U1+3X6IvQ4s4Ow==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 42602
accept-ranges: bytes
cf-ray: 85169214cf89da97-MIA
expires: Sun, 04 Feb 2024 12:40:33 GMT

GET
DATA 200
OK truncated
/ Frame 03C5 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a440db4a7ca252d08987e6cfd770e55127e13080c9bc856147ee03bfb250845a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 image-freedomheadlines.com-30725
image.vuukle.com/ Frame 03C5 49 KB
49 KB 55ms
51ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30725
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bc168ca69ddbe8554f8849ff743af937353ce378ea0399571e5fe5c1de7842e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 76415
cf-polished: origFmt=png, origSize=66297
x-guploader-uploadid: ABPtcPquSjdBWyDLqjxaXpi4BaSSP2RPLurDDtPzoP_2RN9Q9CDYgBIce1E6MnjcYlnKM-35WDNSjKD3Bw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 49820
cf-bgj: imgq:100,h2pri
last-modified: Mon, 05 Feb 2024 23:53:10 GMT
server: cloudflare
etag: "7917558f4d4d7115cb2c208d7fd71041"
vary: Accept
x-goog-generation: 1707177190309456
content-type: image/webp
x-goog-hash: crc32c=Xk8WCQ==, md5=eRdVj01NcRXLLCCNf9cQQQ==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 66297
accept-ranges: bytes
cf-ray: 85169214cf8dda97-MIA
expires: Tue, 06 Feb 2024 01:30:11 GMT

GET
DATA 200
OK truncated
/ Frame 03C5 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8da847aa621361c3472c2283b8702e5d25119305aa98931fd18dc43831daaef3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 image-freedomheadlines.com-30728
image.vuukle.com/ Frame 03C5 48 KB
49 KB 51ms
47ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30728
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34eba3faa95d36f4f56b4812d9b0a8452ab42ebe099fcca3cee1481d76d113ed

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 9824
cf-polished: origFmt=png, origSize=68279
x-guploader-uploadid: ABPtcPqny73MII7-lEDWvci1lxE0UACzVikRqCFtUoiWat16cioa658_iYj5BIa3JpM3JPF50c1pgkMSzQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 49424
cf-bgj: imgq:100,h2pri
last-modified: Tue, 06 Feb 2024 18:44:20 GMT
server: cloudflare
etag: "2b61b4b3ea7d77fe1578345264990955"
vary: Accept
x-goog-generation: 1707245060308329
content-type: image/webp
x-goog-hash: crc32c=iEl7aA==, md5=K2G0s+p9d/4VeDRSZJkJVQ==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 68279
accept-ranges: bytes
cf-ray: 85169214cf90da97-MIA
expires: Tue, 06 Feb 2024 19:48:06 GMT

GET
H3 200 image-freedomheadlines.com-30614
image.vuukle.com/ Frame 03C5 24 KB
25 KB 86ms
82ms Image
image/webp 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30614
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84f5ac6e4231787178868a6cdd9db8adbeb73930f6a24b806e992fc9e9c31873

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
cf-cache-status: HIT
age: 107350
cf-polished: origFmt=png, origSize=39710
x-guploader-uploadid: ABPtcPolWpTzt_d_UAsr2TWTt6kvfxZvuF6vmvhYxanuR4AQvqS1-1cSRmVulgtNioNfczebGFgIFvAn1w
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 25052
cf-bgj: imgq:100,h2pri
last-modified: Thu, 01 Feb 2024 00:08:46 GMT
server: cloudflare
etag: "c6fd602ef24913a4431ebea2ff00715d"
vary: Accept
x-goog-generation: 1706746126735902
content-type: image/webp
x-goog-hash: crc32c=5kCh2A==, md5=xv1gLvJJE6RDHr6i/wBxXQ==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 39710
accept-ranges: bytes
cf-ray: 85169214cf93da97-MIA
expires: Mon, 05 Feb 2024 16:54:36 GMT

GET
DATA 200
OK truncated
/ Frame 1B75 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3cd72707a6eb0ba2f481bf98476ada929d93c3cc1ccf2fa702f4e237ddbea113

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 1B75 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8da847aa621361c3472c2283b8702e5d25119305aa98931fd18dc43831daaef3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 1B75 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1c7910e18cb0252957c7e629b54d6fd7a90f7de6b3ac599ba4f1f8331313e92

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 1B75 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a440db4a7ca252d08987e6cfd770e55127e13080c9bc856147ee03bfb250845a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 1B75 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed01ba1fa7ade62e77ee0032423f982b85c5707b040d71188ed88e716fd8cbd0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 1B75 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f96efa3bffc086940d1a9675afe64d0e6544d8b82fdfa6a4c8e7cd3c7793a382

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3 200 rtads Show response
api.whizzco.com/demand/v1/ 501 B
733 B 185ms
184ms XHR
application/json 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a111ee04e02df713406e87ed6a7cb8d065f6b3435fac65479650250aa1a2bba

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=11Q%2B%2BqJ20Wwj05N4g%2FVc8kqfui1RkuDwEiy7LqmA7JdSgrmVcYHYPR2RbH%2FivhfEvITH3jc5jobpsOAzvK0X9yDPMw2sU6uEiQsKDDebma%2F5f4FNUfw3UFEZvHkp%2FSr5AQOUORx0XedF1eVovYg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 851692162a7531de-MIA
alt-svc: h3=":443"; ma=86400
priority: u=1,i

OPTIONS
H3 200 rtads
api.whizzco.com/demand/v1/ Frame 0
0 242ms
241ms Preflight 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85169214db3c4984-MIA
content-length: 0
date: Tue, 06 Feb 2024 21:43:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=1,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lB5nbDi3jVSU1Kadhv0nee%2BDwnF2al4R5rkF9EEx06S9BNE3A4fgQgNXJWiniF9fsAI1c%2FMc1kHSsU8oCBDFPRCX6o1dzKXkXgcOPed%2B0%2BA3wsbrqLzapiuiGzeluDXpnPEgE%2FAkvern8DQLBkA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
174 B 102ms
101ms Ping
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CP4TF595X7&gtm=45je41v0v9116368575za200&_p=1707255825720&gcd=13l3l3l3l1&npa=0&dma=0&cid=1766293042.1707255827&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1707255826&sct=1&seg=0&dl=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&dt=Eyewitness%20to%20killing%20of%20Run-DMC%E2%80%99s%20Jam%20Master%20Jay%20tells%20jury%3A%20%E2%80%98Then%20I%20see%20Jay%20just%20fall%E2%80%99%20%E2%80%93%20Freedom%20Headlines%20%7C%20Top%20Political%20News%20USA%20%7C%20USA%20Politics&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2000
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CP4TF595X7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80f::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:46 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/160835/4933/ 222 KB
67 KB 198ms
66ms Script
application/javascript 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6b30722487e92833baf8f01d6b2d2fed4e459d7cd42dc81ac1a80d8d08b9450e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:46 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 00:25:40 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=47384
accept-ranges: bytes
content-length: 68444
expires: Wed, 07 Feb 2024 10:53:30 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
92 B 80ms
79ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1426236456&t=pageview&_s=1&dl=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&ul=en-us&de=UTF-8&dt=Eyewitness%20to%20killing%20of%20Run-DMC%E2%80%99s%20Jam%20Master%20Jay%20tells%20jury%3A%20%E2%80%98Then%20I%20see%20Jay%20just%20fall%E2%80%99%20%E2%80%93%20Freedom%20Headlines%20%7C%20Top%20Political%20News%20USA%20%7C%20USA%20Politics&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=913709718&gjid=891688108&cid=1766293042.1707255827&tid=UA-32644619-11&_gid=644957403.1707255827&_r=1&gtm=457e41v0za200&gcd=13l3l3l3l1&dma=0&jsscut=1&z=1344309330

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
210 B 67ms
66ms XHR
text/plain 2607:f8b0:4004:c09::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-32644619-11&cid=1766293042.1707255827&jid=913709718&gjid=891688108&_gid=644957403.1707255827&_u=YADAAUAAAAAAACAAI~&z=320832800

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9c Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 06 Feb 2024 21:43:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxWhCCxoqeMD6upuDlZqmV_bYxfz2iJtsWJ7Yaw_ophnt2KEGXihoc-QUJ0VIVzxhVUulrVHnVOxj21L1MykG60qUR-349SdEHheEsFo-acOhCBzvtlFnQ1lPhiXQ8rdyy2glTXZMQ== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 110ms
109ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWhCCxoqeMD6upuDlZqmV_bYxfz2iJtsWJ7Yaw_ophnt2KEGXihoc-QUJ0VIVzxhVUulrVHnVOxj21L1MykG60qUR-349SdEHheEsFo-acOhCBzvtlFnQ1lPhiXQ8rdyy2glTXZMQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3MjU1ODI2LDk4ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9mcmVlZG9taGVhZGxpbmVzLmNvbS9mcmVlZG9tLXdpcmUvZXlld2l0bmVzcy10by1raWxsaW5nLW9mLXJ1bi1kbWNzLWphbS1tYXN0ZXItamF5LXRlbGxzLWp1cnktdGhlbi1pLXNlZS1qYXktanVzdC1mYWxsLyIsbnVsbCxbWzgsImdEdHlnNlhsNDVrIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gDtyg6Xl45k.es5.O/am=wA/d=1/rs=AJlcJMxMxpNOvw8cTkR2qfYPnhDIpmxf3g/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

84e79625cb9eca19a62d1e67defe4787d6ebf369f2239d93ca75e55ddb53ad19

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-FXX6cxel7rs34NiTkPZrUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-FXX6cxel7rs34NiTkPZrUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjWsOoxSXF4KwhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ySTw9SWTBBBrAfE7yVdM34B4h48Hy5vw6ax8EdNZ4-qmsxYAMd-66ayG66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYQIP6cOYP1NxCX3T7HWgfEwnLnWaWBWIibY_KFrnVsAifWH5EEAFUeTSU"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 87 KB
26 KB 150ms
49ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f71c68db8f50cecab42686d45c685b9fa2710dac74bd8eb50df4689575fc204

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 30 Jan 2024 10:08:32 GMT
server: cloudflare
x-amz-request-id: S2T7VKKR53KNJ5PW
age: 2626
etag: W/"b03d5064c95ecd01501cdae49ca9228b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 85169217afe76db0-MIA
x-amz-id-2: T0JKVu5XvBT6Jv4DiYHEdvk11QG/C5TFVSD8HUN0Tub96aujewTv3Ex48h0RfosD5I7Q4Li0jCg=

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 219ms
65ms Script
text/javascript 2600:9000:20ed:dc00:a:e047:753:eb41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ed:dc00:a:e047:753:eb41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Tue, 06 Feb 2024 10:24:12 GMT
Via: 1.1 0112af6219abab80a1c298e0563cf966.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: PHL50-C1
Age: 40776
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: xzCOw9pCfzkGujuS8cIUIwdQt7gPdFbofIIBNTSykgMbHmP2YuWU-w==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
901 B 131ms
32ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 06 Feb 2024 21:43:47 GMT
x-content-type-options: nosniff
content-encoding: br
age: 7338
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-mia-kmia1760078-MIA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 220ms
72ms Script
text/javascript 13.224.214.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-92.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 03:08:34 GMT
content-encoding: gzip
via: 1.1 80d115dafe1d45606330f418d944b1ec.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 66914
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 93BLtzpvN3qgo1KKMB4VA9UVEQRZcskPiAgT9zhmjjTSBl2Ms8yoBw==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 263ms
164ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e388e19ca38c825b329e762c79c66bbd41bd334f18312c5e97fde0a8f64bca36

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
via: 1.1 google, 1.1 google
last-modified: Mon, 05 Feb 2024 22:07:56 GMT
server: Google Frontend
etag: cd19e0900da0cdbc6697310fd9330fb6
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: c187cdae98d8143c8c0d4171db63e5f7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1195

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 133ms
35ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 20:36:42 GMT
content-encoding: gzip
age: 954425
x-guploader-uploadid: ABPtcPquzGfuyGUirOwTBDkvfyjnBfQFEjCCdKik0TGfpPYUeTjKEbbNntuAKoQvsnY388GNiTiCSa9EbA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Sat, 25 Jan 2025 20:36:42 GMT

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
6 KB 137ms
41ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ad3f727ef5f17ff632a0cf27ad59f11458e1b4033322e5d2b4b2c3abe09ca5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 02 Feb 2024 21:17:15 GMT
server: cloudflare
age: 333972
etag: W/"65bd5bdb-42d1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 85169217aa87da7f-MIA
expires: Fri, 09 Feb 2024 21:43:47 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 41 KB
13 KB 241ms
110ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

885cb38c43b35c7ff9befe60f6c96f653d15befa0770f5f2ea0ea5cbc5d03a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 18 Jan 2024 07:12:05 GMT
server: nginx
etag: W/"65a8cf45-a585"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 07 Feb 2024 21:43:47 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 486 KB
102 KB 1277ms
1263ms Fetch
text/plain 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dee41596b938141ac6a155ca68d888d1c2671cfa8333c1a93ce31bc33a6d1080

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103886
x-xss-protection: 0
google-lineitem-id: -1,-1,-2,-2,-1,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-2,-2,-1,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://freedomheadlines.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E322 6 KB
3 KB 235ms
78ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:47 GMT
expires: Wed, 05 Feb 2025 21:43:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/ 44 KB
14 KB 66ms
64ms Script
text/javascript 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl_page_level_ads.js?cb=31080925

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5cbbce843ea57fe543404f9774ac5ec92ea3472d68bbe8cfe70bcb04c4a009b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 11:38:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36291
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14223
x-xss-protection: 0
server: cafe
etag: 7777715989155465125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 05 Feb 2025 11:38:56 GMT

GET
H2 200 0718ad3a-0b2c-415c-9131-c46be31a6dc2 Show response
player.ex.co/player/ 458 KB
154 KB 149ms
61ms Script
application/javascript 151.101.2.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

afbcd4b8d081b632dfcd879f6bb9d39f61f903401bca11816d6e026cee30b430

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 21:43:47 GMT
via: 1.1 varnish, 1.1 varnish
age: 0
x-cache: HIT, MISS
content-length: 157406
x-served-by: cache-iad-kcgs7200169-IAD, cache-mia-kmia1760031-MIA
server: nginx
x-timer: S1707255827.177803,VS0,VE28
etag: W/"7285d-3tblOyqYSjCUXYBW3uNUV+uaf7s"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
vary: Accept-Encoding, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 17, 0

POST
H3 200 tshow Show response
api.whizzco.com/dtracking/v1/ 15 B
454 B 147ms
146ms XHR
application/json 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nt3IDKCtuGa7ix2golGL4WHideUOrHdyQ9kJMY3cAbDWsf5mK%2BAWKBFxQ0W%2Fa7zbBt7qmyAeNMiV%2Bfg7r3Rp%2FJdbzoSxkgIFT3Oghz%2F5JVdhu1CBwSvsNUdBIjY7%2B03IixEB7C9Akk9uAXbtdCY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 8516921818154984-MIA
alt-svc: h3=":443"; ma=86400
content-length: 15
priority: u=1,i

OPTIONS
H3 200 tshow
api.whizzco.com/dtracking/v1/ Frame 0
0 126ms
125ms Preflight 2606:4700:3035::6815:faa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:faa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 851692175f184984-MIA
content-length: 0
date: Tue, 06 Feb 2024 21:43:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=1,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vAUKB16HSWxOYmkt%2Fzuy4fHbtQq2gbim%2Bskbi5uZ08dlpBoGQlW155PqWtlN%2BCoQSIlShB6%2F%2BafbwepXoL8s%2FTtHDSJb%2BFXi4WCdZdIu%2BMdHKXn3GFbykTQAxVhpeJlQTC%2BLKVm6eugnnqhW1ug%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
236 B 442ms
144ms XHR
text/plain 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
616 B 191ms
68ms XHR
application/json 54.85.196.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.196.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-196-253.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: e077b71327dd102b0aed5474de657c633188955c88bbef775a1b4392b24df92f

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache
x-server: 10.40.3.220
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 config Show response
player.ex.co/ 2 KB
2 KB 115ms
42ms Fetch
application/javascript 151.101.2.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://player.ex.co/config?sfid=0010J00002G2BxCQAV

Requested by

Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

307c1f999acdb434738d17060d1db2c9cfa91562c8c994b16c43377e2d786ff0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 21:43:47 GMT
via: 1.1 varnish, 1.1 varnish
age: 12425
x-cache: HIT, HIT
content-length: 1701
x-served-by: cache-iad-kiad7000027-IAD, cache-mia-kmia1760086-MIA
server: nginx
x-timer: S1707255827.415376,VS0,VE1
etag: W/"7da-6junp5GTyCL0lmCg/KvmdugD7t0"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
vary: x-pb-domain
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 145, 1

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 238ms
95ms XHR
application/json 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202402050101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

151a348c4f1feb254d056cfda86cdf640ec4acbbe4fa6d3038752c446d625ef3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12154
x-xss-protection: 0

GET
H2 200 / Show response
trends.revcontent.com/api/demand/ 637 B
902 B 182ms
62ms Fetch
application/json 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/api/demand/?w=137741&us_privacy=1---

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-216-2-235.compute-1.amazonaws.com

Software

envoy /

Resource Hash

4f9173c2948eb5db9994e44bbd200c6c9f39d8ce775eceb273cc9c69f85ff8d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:47 GMT
strict-transport-security: max-age=931536000; includeSubDomains
server: envoy
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
content-length: 637

GET
H2 200 sync Show response
trends.revcontent.com/ 62 B
565 B 182ms
63ms Fetch
application/json 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trends.revcontent.com/sync?us_privacy=1---
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 8377eaa51bf580056d59d8fe8dfb625d852ea36c2dc08004240b8a34a8ef8e84

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:47 GMT
server: envoy
etag: "97547ee6-8117-48cc-a21e-8e8967e849ce"
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
p3p: CP="NOI DSP COR NID ADM DEV OUR NOR CNT"
cache-control: max-age=600, private, s-maxage=0, stale-while-revalidate=1800
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
content-length: 62

POST
H2 200 events Show response
collector-1.ex.co/main/ 17 B
155 B 181ms
59ms XHR
application/json 3.226.119.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-1.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.119.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-119-3.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:47 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
790 B 82ms
80ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 21:33:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:47 GMT

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
mcd.ex.co/video/upload/w_800,so_4/v1490095101/ 14 KB
15 KB 258ms
67ms Image
image/webp 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mcd.ex.co/video/upload/w_800,so_4/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 06ebe1954427c09d4400e7e77e9c651b2eb3953e798ba97971d536f4bb398c89

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:43:47 GMT
Cache-Tag: 502941132783428480281542933415069772301,473281262405526930053610213462331028430,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Disposition: inline; filename="landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp"
Connection: keep-alive
Content-Length: 14352
X-Served-By: cache-lga21926-LGA
Last-Modified: Mon, 13 Feb 2023 08:42:01 GMT
Server: cloudinary
X-Timer: S1692208188.633880,VS0,VE99
ETag: "cea3d109186db580c1bb2c32d1905228"
Content-Type: image/webp
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30432888
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H2 200 player.js Show response
cdn.ex.co/player/ap/4.20.0-adde172/ 326 KB
90 KB 255ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 010908273368b864ad0daec7517e84330e51346e50d2265d40d5c138e081a64a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 91404
last-modified: Sun, 04 Feb 2024 08:13:47 GMT
server: AmazonS3
etag: "8f10c7b3255d18d2ff3eb2134e9372c4"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Tue, 13 Feb 2024 21:43:47 GMT

GET
H2

200

pixel_sync
trends.revcontent.com/cm/
Redirect Chain

https://b1sync.zemanta.com/usersync/revcontent/?puid=a31dd66555174ef8b0e87af3c33815c3&cb=https%3A%2F%2Ftrends.revcontent.com%2Fcm%2Fpixel_sync%3Fexchange_uid%3Da31dd66555174ef8b0e87af3c33815c3_2%26...
https://b1sync.zemanta.com/usersync/revcontent/?cb=https%3A%2F%2Ftrends.revcontent.com%2Fcm%2Fpixel_sync%3Fexchange_uid%3Da31dd66555174ef8b0e87af3c33815c3_2%26bidder%3D3%26bidder_uid%3D__ZUID__%26c...
https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3_2&bidder=3&bidder_uid=rqWDE59k90-uLbftfHo5&callback=dspCMCallback&us_privacy=1---

72 B
72 B

62ms
61ms

Image
application/javascript

44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3_2&bidder=3&bidder_uid=rqWDE59k90-uLbftfHo5&callback=dspCMCallback&us_privacy=1---
Protocol: H2
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:47 GMT
x-envoy-upstream-service-time: 3
server: envoy
content-length: 72
vary: Origin
content-type: application/javascript; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:47 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=utf-8
Location: https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3_2&bidder=3&bidder_uid=rqWDE59k90-uLbftfHo5&callback=dspCMCallback&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 210
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

pixel_sync
trends.revcontent.com/cm/
Redirect Chain

https://x.bidswitch.net/sync?ssp=revcontent&us_privacy=1---&rev_dt=1707255827564
https://x.bidswitch.net/ul_cb/sync?ssp=revcontent&us_privacy=1---&rev_dt=1707255827564
https://r.bidswitch.net/sync?bidswitch_ssp_id=revcontent&bsw_custom_parameter=fdd96b06-5a2f-441c-9424-ef70eba3e799
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=fdd96b06-5a2f-441c-9424-ef70eba3e799&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3205&partner_device_id=fdd96b06-5a2f-441c-9424-ef70eba3e799&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=029877f8-4cfa-48db-ab82-06843bb57b4d%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%2525...
https://match.adsrvr.org/track/cmb/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=029877f8-4cfa-48db-ab82-06843bb57b4d%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=21b7045d-c254-48ac-9a8f-1cd489bb1d29&ttd_puid=029877f8-4cfa-48db-ab82-06843bb57b4d%2Chttps%253A%252F%252Fx.bidswitch.net%...
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=revcontent&bsw_param=fdd96b06-5a2f-441c-9424-ef70eba3e799
https://trends.revcontent.com/cm/pixel_sync?bidder=118&bidder_uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&callback=dspCMCallback

90 B
90 B

63ms
62ms

Image
application/javascript

44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=118&bidder_uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&callback=dspCMCallback
Protocol: H2
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:48 GMT
x-envoy-upstream-service-time: 3
server: envoy
content-length: 90
vary: Origin
content-type: application/javascript; charset=utf-8

Redirect headers

Location: //trends.revcontent.com/cm/pixel_sync?bidder=118&bidder_uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&callback=dspCMCallback
Date: Tue, 06 Feb 2024 21:43:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

pixel_sync
trends.revcontent.com/cm/
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=revcontent&ssp_user_id=a31dd66555174ef8b0e87af3c33815c3&us_privacy=1---&rev_dt=1707255827565
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=revcontent&ssp_user_id=a31dd66555174ef8b0e87af3c33815c3&us_privacy=1---&rev_dt=1707255827565
https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3&bidder=154&bidder_uid=e4bafa5f-b293-48d6-8e59-2fadcc029719&callback=dspCMCallback

90 B
90 B

62ms
62ms

Image
application/javascript

44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3&bidder=154&bidder_uid=e4bafa5f-b293-48d6-8e59-2fadcc029719&callback=dspCMCallback
Protocol: H2
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:47 GMT
x-envoy-upstream-service-time: 4
server: envoy
content-length: 90
vary: Origin
content-type: application/javascript; charset=utf-8

Redirect headers

location: //trends.revcontent.com/cm/pixel_sync?exchange_uid=a31dd66555174ef8b0e87af3c33815c3&bidder=154&bidder_uid=e4bafa5f-b293-48d6-8e59-2fadcc029719&callback=dspCMCallback
date: Tue, 06 Feb 2024 21:43:47 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 / Show response
trends.revcontent.com/api/delivery/ 40 KB
21 KB 238ms
238ms Fetch
application/json 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/api/delivery/?is_blocked=undefined&w=137741&width=1600&us_privacy=1---&rev_allow_cookies=1&site_url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&icr_url=&va=0&user_uuid=97547ee6-8117-48cc-a21e-8e8967e849ce&time=1707255827569&up=pc&bn=chrome&bv=121&widget_width=780&style_id=0&an=false&mr=false

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-216-2-235.compute-1.amazonaws.com

Software

envoy /

Resource Hash

106091dee962dc5ace014d7fad2e2c5925080ec67311b954925ca2d16dca4af1

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:47 GMT
strict-transport-security: max-age=931536000; includeSubDomains
content-encoding: gzip
server: envoy
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 180

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 226ms
90ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Feb 2024 21:43:47 GMT

GET
H3 200 fif.html Show response
fundingchoicesmessages.google.com/f/AGSKWxX-4Be3tTVkEJPqxbPOvxsqsFkbEQTmB4tqGyN2yxQq_yq5FCKa6CfpU60ei0M_jmxTTiCA-dE0hs7ZAWGPJGHAhwW7NrnCXfrcxTYwFbo0BZo1VEt_OehVGjP0ndd7qwFtZPxjhGKDhYVfxHQq8p1QOmx93... 54 B
110 B 91ms
90ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX-4Be3tTVkEJPqxbPOvxsqsFkbEQTmB4tqGyN2yxQq_yq5FCKa6CfpU60ei0M_jmxTTiCA-dE0hs7ZAWGPJGHAhwW7NrnCXfrcxTYwFbo0BZo1VEt_OehVGjP0ndd7qwFtZPxjhGKDhYVfxHQq8p1QOmx93eXWK60bSLJCAY2ZO4YeAj_XExnbHx9Y/_flashxx.tv/mktad./adnet./fif.html?s=_overlay_ad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gDtyg6Xl45k.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwVMoQ5RqxYcJkb2cacr7NZd3G9cg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

774543665cbe083d19cec2ee2459e1255c3387efea91d8e4a7efff391413a85f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-qIWf1BqE08N8ch_2BW2dtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-qIWf1BqE08N8ch_2BW2dtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj2sKoxSXF4KchxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ySTw9SWTBBBrAfE7yVdM34B4h48Hy5vw6ax8EdNZ4-qmsxYAMd-66ayG66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYQIP6cOYP1NxD71M9gjQPistvnWOuAWFjuPKs0EAvxcEy-0LWOTeDEzOuzmAEinVCc"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 193ms
64ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:24:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51
x-xss-protection: 0
server: cafe
etag: 16023549773543154165
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 22:24:39 GMT

POST
H3 204 AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 219ms
90ms XHR
text/html 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GDbSNWuJghhn_PpJmt6L_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-GDbSNWuJghhn_PpJmt6L_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmLw1ZBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrCBCX3T7HWgfEwnLnWaWBWIiHY_KFrnVsAhe2frzBDADLhx9G"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 02AC 13 KB
5 KB 64ms
64ms Document
text/html 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 91287
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Feb 2024 20:22:20 GMT
expires: Tue, 04 Feb 2025 20:22:20 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6189 829 B
1 KB 221ms
85ms Document
text/html 2607:f8b0:4006:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7a019dec54a39ded1ba8e40502a460a4b3ef8f7d4ee48d11bbaba4cb24d2bb5e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Tvd7yhuio6MLoCRv4yzTQw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Tvd7yhuio6MLoCRv4yzTQw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:48 GMT
expires: Tue, 06 Feb 2024 21:43:48 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 204 impression
trends.revcontent.com/event/ 0
0 239ms
123ms Fetch 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/event/impression

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-216-2-235.compute-1.amazonaws.com

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-rc-region: us-east-1a
date: Tue, 06 Feb 2024 21:43:48 GMT
strict-transport-security: max-age=931536000; includeSubDomains
server: envoy
vary: Origin
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 7

GET
H2 200 brandWidget~feedWidget.delivery.js Show response
assets.revcontent.com/master/ 65 KB
16 KB 71ms
69ms Script
text/javascript 13.224.214.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/brandWidget~feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-14.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 927e08873a995b50f6c4cc354db6c9aecf306eda046c8b79cb427feed987f623

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 18:07:28 GMT
content-encoding: br
via: 1.1 aa68d5eaf078dffca4154e55039dbb84.cloudfront.net (CloudFront)
last-modified: Tue, 06 Feb 2024 18:07:20 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 12980
etag: W/"1b642f4656d18db8d93f3e1fc50eb072"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: tas7t8t5zr3-lVj-itYKuRiReKBUcnLAh0hq0K9gE7e_2lCfGBXvAg==

GET
H2 200 defaultWidget~feedWidget.delivery.js Show response
assets.revcontent.com/master/ 30 KB
8 KB 74ms
73ms Script
text/javascript 13.224.214.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/defaultWidget~feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-14.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3f57d1b45dbc10d3cbf4f0701bb80a75dd0e9bd214816877599dcdc1f6ae60dd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 18:07:28 GMT
content-encoding: br
via: 1.1 aa68d5eaf078dffca4154e55039dbb84.cloudfront.net (CloudFront)
last-modified: Tue, 06 Feb 2024 18:07:20 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 12980
etag: W/"f8e01a97e44214a538a1713562823c49"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: QUBqEFOnBexo_11Hcrjx5EKaVxKCYq8w0W6doiLx3QcJ7EbyUnDL4w==

GET
H2 200 feedWidget.delivery.js Show response
assets.revcontent.com/master/ 34 KB
10 KB 80ms
79ms Script
text/javascript 13.224.214.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-14.phl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6911b38f91e8b0cfa446e5300f1fcce0e175738ffe60b3dfbf944f33faf415d9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 18:07:28 GMT
content-encoding: br
via: 1.1 aa68d5eaf078dffca4154e55039dbb84.cloudfront.net (CloudFront)
last-modified: Tue, 06 Feb 2024 18:07:20 GMT
server: AmazonS3
x-amz-cf-pop: PHL50-C1
age: 12980
etag: W/"30b0faead2f2ea613e0e9e4b33e2a018"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: fl4fBGmsRbUJmAhvRGwY1UliFXjjec-wwutxw3S6lswyeafkz-TbkA==

GET
H2 200 /
img.revcontent.com/ 1 KB
2 KB 187ms
60ms Image
image/png 13.224.214.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.revcontent.com/?url=https://cdn.revcontent.com/assets/img/full_color.png&static=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.214.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-111.phl50.r.cloudfront.net
Software: envoy /
Resource Hash: 94d3b3f21c82e9004e1a95aba77f256573a3406d0782d451d50ac8e4bb4df7c5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 03 Oct 2023 17:55:57 GMT
via: 1.1 193d4441ee6d312fd234f2d28e48c110.cloudfront.net (CloudFront)
last-modified: Thu, 01 Jun 2023 15:43:57 GMT
server: envoy
x-amz-cf-pop: PHL50-C1
age: 10900071
etag: "a798d6ed9b193888fbc8a4a5bd7b51c236f8aa33"
x-cache: Hit from cloudfront
content-type: image/png
x-envoy-upstream-service-time: 22
alt-svc: h3=":443"; ma=86400
content-length: 1351
x-amz-cf-id: WeFjRDA_7QnI_fjgEBL4_HrOvFWPjqLypHAjarMwu0ce571BeCPVSg==

POST
H3 204 AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 139ms
107ms XHR
text/html 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0n_CoGHbNXlOgUNiOjEnLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0n_CoGHbNXlOgUNiOjEnLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmLw0JBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrCBCX3T7HWgfEwnLnWaWBWIibY8qFrnVsAju2T2YBAKjUHfY"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 02AC 39 KB
15 KB 93ms
65ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 20:23:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 91231
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Feb 2025 20:23:16 GMT

GET
H2 200 cookie_sync.html Show response
cdn.ex.co/sync/0.0.1-7abf705/ Frame 073E 412 B
627 B 66ms
64ms Document
text/html 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/sync/0.0.1-7abf705/cookie_sync.html?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2c8c95f475d5dec0bdc14b70bf400311e6daebb6727d90a75963e324de116f05

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: must-revalidate, proxy-revalidate, max-age=66389, s-maxage=31536000
content-encoding: gzip
content-length: 275
content-type: text/html;charset=utf-8
date: Tue, 06 Feb 2024 21:43:47 GMT
etag: "07dd85d1d0ababd70ae97ea4d60bb6de"
last-modified: Fri, 26 Jan 2024 17:08:03 GMT
server: AmazonS3
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

POST
H2 200 events Show response
collector-1.ex.co/main/ 17 B
154 B 63ms
60ms XHR
application/json 3.226.119.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-1.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.119.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-119-3.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:47 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H2 200 player.js Show response
p.channelexco.com/player/ 31 KB
19 KB 232ms
112ms Script
application/x-javascript 199.115.112.161
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://p.channelexco.com/player/player.js?pv=117.59&p=779297768&cb=17e6cbbd-4796-478f-a81c-89da589a8fe2&d=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&schain=1.0%2C1%21playbuzz.com%2C0010J00002G2BxCQAV%2C1%2C%2C%2Cfreedomheadlines.com&w=780&h=438.8&asr=1&impDetail=1&auction=1&auctionFast=5&publisherType=publisher&gdpr=-GPV_GDPR-&gdpr_consent=-GPV_GDPR_CONSENT-&us_privacy=-GPV_US_PRIVACY-&rv=true&sid=&sid2=default&sid4=4.20.0-adde172&utm_source=sparkpost&utm_medium=email&utm_campaign=regular&pub=1&pageLoadUid=15ed4afe-2f15-484e-92f2-1fb7d6d07e4b
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.115.112.161 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: 3a0badd3b33c15e8579ff4ae7cdeb8d380d0054bc0bd0b15b4fb8ccd168a24d6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: application/x-javascript
date: Tue, 06 Feb 2024 21:43:48 GMT
cache-control: no-cache
content-encoding: gzip
server: openresty
vary: Accept-Encoding
expires: Tue, 06 Feb 2024 21:43:47 GMT

GET
H2 200 d Show response
gpv.ex.co/player/ 2 KB
2 KB 191ms
72ms Fetch
text/plain 18.206.25.207
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://gpv.ex.co/player/d?v=2&b={%22pageLoadUid%22:%2215ed4afe-2f%C4%90-484%C4%979%C4%992-1fb7d6d07e4b%22,%22country%C4%8D%22US%C4%B1%22browser%C4%BBch%C5%82me%C4%BFos%C4%BBwind%C5%83%C5%90%C4%B2networkI%C4%8C%C4%8E1%C4%9E16%C4%90463%C4%BFhu%C4%8D%C4%B8ue%C4%B2p%C4%BB77%C4%A19%C5%B568%C4%BF%C5%A1%22https://fre%C4%92omhe%C4%88l%C5%93es.%C4%B4m%C6%86%C6%88%C6%8Am-%C5%92%C6%88/eye%C5%92t%C5%99ss-to-kil%C6%90ng-of-r%C4%B6-dmc%C6%A6ja%C6%9Amast%C5%86-%C6%BCy%C6%A7e%C6%AD%C6%BBu%C4%B9%C6%A7%C6%8Dn-i-%C5%85%C4%97%C7%85%C7%84u%C7%81-fa%C6%AD/%C4%BF%C7%97%C5%86%C5%A0%C4%BB1ib3cg52e0d%C7%A5v4g%22}

Requested by

Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.206.25.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-206-25-207.compute-1.amazonaws.com

Software

Resource Hash

1313ed15017f4414f93cdd2928139cddd84fca8a19d3b877f12a51b57a865c9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
etag: W/"6cb-mGZ1w1U7GR/bmwwCL0NTkQ"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Accept, Authorization, Content-Type
content-length: 1739

GET
H2 200 5f2323ee0181a1-36616789.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
5 KB 193ms
68ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/5f2323ee0181a1-36616789.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

42365dc229da720d0208a5800f7c4a5003c38736341e1f7b7f7c297a15777f23

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 17:11:19 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 102749
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5021
last-modified: Wed, 12 Jul 2023 15:44:09 GMT
server: Cloudinary
etag: "8562bf1fb34db8e8a6c44ce01672a959"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: T5VqCaz0pPwAW_jcPvjwJGYQFH8OOJ3qUsP7d64BIpOx5I5sjnclUQ==

GET
H2 200 65ae2d75ae1b33-30686853.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
8 KB 201ms
81ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65ae2d75ae1b33-30686853.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

432183dd23ff7a60dc5b5feb1dcae3049f7964723004fe5f95edada41ba97f40

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 11:53:51 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 208197
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7600
last-modified: Fri, 26 Jan 2024 09:38:25 GMT
server: cloudflare
etag: "0d679d6d206f74db2293aa4e514195b9"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8502b7317b9d8298-IAD
timing-allow-origin: *
x-amz-cf-id: cKxysYAZbdLsoYG5omA1zxDDm-R3R3Igq_dIcysv4ccIHrcHqoC7Kw==

GET
H2 200 65b91f9cd613f9-39539708.jpeg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 187ms
71ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65b91f9cd613f9-39539708.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c9ed3b1898dd2498f728e2d0a79ead6d572809f9382f4075640cae44de74973

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 20:45:17 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 262711
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5427
last-modified: Sat, 03 Feb 2024 20:44:54 GMT
server: cloudflare
etag: "703a66e38d9c5ef8a3e6c69e29f1a1f2"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84fd844a8ee5208e-IAD
timing-allow-origin: *
x-amz-cf-id: AkGJBjnz8lmJm2KadZ21cd8taFkYYcY8qjIimi2g6G2SzchX94WpHQ==

GET
H2 200 65bd770d424ed5-70525127.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
7 KB 189ms
76ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65bd770d424ed5-70525127.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5343214e64e51f3da7dccbb43ee1a0652c8de62e16d2716b72a9139bc74f2df

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:20:34 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 260593
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 6877
last-modified: Sat, 03 Feb 2024 12:39:27 GMT
server: cloudflare
etag: "6867417cfd74913866705dbcd4c95d9f"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84fdb7fa1c5a3b59-IAD
timing-allow-origin: *
x-amz-cf-id: E3gbcFILHBjjVD8J1A1lwXhkxlw7TsU-8NwBIoQiuOnhgLA4Cc9lRg==

GET
H2 200 65b99ca26c8598-12431840.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 18 KB
19 KB 236ms
125ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65b99ca26c8598-12431840.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7ef0c2c446634738494f14b0cfa8d0d3845faefaef8bb21a8832e5e0517b9c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 15:07:43 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 455765
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 18602
last-modified: Wed, 31 Jan 2024 16:17:43 GMT
server: cloudflare
etag: "e5f35e3ff94b2c9cd6e3c2fc500363f5"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84eb1b0b4f0c8266-IAD
timing-allow-origin: *
x-amz-cf-id: jqySQrLFtfJyCLzipxMiFWrO9uBOPQMrm0RKOm2vyB6o-NKTF6Y57g==

GET
H2 200 65ba79ed582d21-01397191.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
7 KB 236ms
128ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65ba79ed582d21-01397191.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

009e2261bb66ac257cf8615c0dcaf88897b05436d29f1678aeef5244ec2710f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Fri, 02 Feb 2024 12:33:48 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 378600
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7046
last-modified: Fri, 02 Feb 2024 08:52:17 GMT
server: Cloudinary
etag: "f01481760d4e285673b05eafc379be30"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: yEBCw-MYspml7whWdUTvWASwLlLDYbZEPigeDGL5Gbex8twClUe8Cg==

GET
H2 200 65be8463ee6481-21424753.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
8 KB 126ms
124ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65be8463ee6481-21424753.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f218b70d7cca0a28f552bc7d4908937ebd48e48add3e0e204a9b03ede3730eb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 19:40:44 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 266584
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7611
x-request-id: 061ccc99391ccf7efb45267bd33bf4f1
last-modified: Sat, 03 Feb 2024 19:37:31 GMT
server: cloudflare
etag: "c167e6120a2420864947cb17501086ec"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84fd25b52b7e874c-IAD
timing-allow-origin: *
x-amz-cf-id: 0x90idjjmopVXGKaWCvpenb0PezsC0eT9iKijrE_CwXxLkuKrFjNTQ==

GET
H2 200 65b9d235edebd4-18844384.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 9 KB
9 KB 134ms
132ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65b9d235edebd4-18844384.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74388a2d95209418496e4cc314abf9244378b8728629e59ba58e49ef73519860

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Fri, 02 Feb 2024 00:38:01 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 421547
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 8739
last-modified: Fri, 02 Feb 2024 00:36:50 GMT
server: cloudflare
etag: "b08720d42bd53e71e0a84526d8a2407f"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84ee5e72b9619c49-IAD
timing-allow-origin: *
x-amz-cf-id: 7eyiTv-kkjRpSwGK-knSMWKAArEInAN7xlY3S1f8oBck0ZdwHpXCaA==

GET
H2 200 65b40219157cf0-25907235.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 8 KB
9 KB 140ms
138ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65b40219157cf0-25907235.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ed79307a9bda4ba3a329c07c304278a9062ba4d0e096ca10ea171cb9a309a0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Mon, 05 Feb 2024 03:33:46 GMT
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 151802
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 8456
last-modified: Sun, 28 Jan 2024 12:23:37 GMT
server: cloudflare
etag: "e3af5c33daeb69264e3252a058c6dded"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84ce6a6408a21fdf-IAD
timing-allow-origin: *
x-amz-cf-id: OJnAoe-IIJmO8DNgS_nEiml4aeuprLgIeRg_qwYS-FGFZIZ7_tpSOg==

GET
H2 200 65bb136c8c58d5-52746752.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 9 KB
10 KB 147ms
145ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65bb136c8c58d5-52746752.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3aa127bcbebf0f79c7a12eb1c97f296debfc90fbb32e6bb40006e7e49fc1236f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 10:36:07 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 40061
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 9362
x-request-id: 73e11c6a6f68b011ce7f64b1f5afc1ae
last-modified: Tue, 06 Feb 2024 10:35:46 GMT
server: cloudflare
etag: "42d1216d14cf5a075dc280714b7f1a20"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8512c011baeb3922-IAD
timing-allow-origin: *
x-amz-cf-id: pbCdzFsJMU46GR9hgJY2agyh4YyANlIAP9P0mEN_GIgffzq7FFW0hQ==

GET
H2 200 626544e4743602-34969050.jpeg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
8 KB 152ms
150ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/626544e4743602-34969050.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c4e92b43bc362d7c3b1877528beba2e7de1c5b5d173ae0f2f6c52d12054970f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Sat, 03 Feb 2024 14:49:51 GMT
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 284037
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7217
last-modified: Wed, 12 Jul 2023 14:25:45 GMT
server: cloudflare
etag: "c7be81d499584ac2b289e3269ce199a8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84c1caedaba307d4-IAD
timing-allow-origin: *
x-amz-cf-id: pPzX83ef1E_0SemBQNg00-IRykTDWO0IIkx032YcHaDC_81lND9l-Q==

GET
H2 200 d85e7c0c9ef47181f39d046b08cc60cc.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 168ms
167ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/d85e7c0c9ef47181f39d046b08cc60cc.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

172f2e3528ce88aa0592ea302f95557164e78c8c137566d9c6ebdc2180233390

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 11:13:19 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 124229
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5551
last-modified: Wed, 10 Jan 2024 16:30:32 GMT
server: cloudflare
etag: "34cba645df67223ed82edb11e03007a2"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 850ab93059fd094f-IAD
timing-allow-origin: *
x-amz-cf-id: UqGBGw8PPOVJP4K-h5QanIaJ-gt59zu5t5LTnO90f0SJ9y575HhKFA==

GET
H2 200 65bc5f87e5bfc0-50483651.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
8 KB 191ms
190ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65bc5f87e5bfc0-50483651.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5af2317b67895467a5a441018ffa187e5c8267e81ca44112ad7ad7e0bdf6d94

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 14:37:21 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 25587
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7642
x-request-id: 3e9a02141364e67f609f20b263174905
last-modified: Tue, 06 Feb 2024 14:37:11 GMT
server: cloudflare
etag: "4516bd94d963e85b7e7b94b8b5d8f2b1"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 85142170fa3f05a0-IAD
timing-allow-origin: *
x-amz-cf-id: mqbt9gLS_--A3HhQRUsUoOjILpWH8tPocGtsfIIZ6f_CeLSisSyK6A==

GET
H2 200 65b71bf02a6bd8-67856800.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 10 KB
11 KB 185ms
183ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65b71bf02a6bd8-67856800.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

054aa3b79a94d3dee0a75589fd0b607b99e534341b49d0333283815b5ffe608b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Mon, 05 Feb 2024 19:43:53 GMT
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 93595
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 10432
last-modified: Mon, 29 Jan 2024 18:34:56 GMT
server: Cloudinary
etag: "5b08548dc480a845d3bbf0331cd9379b"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: KxWNTLORgbuNZIZdu6btsnLOtf5RyUEyYWqD9iZd3UwpB-jjHzLAtg==

GET
H2 200 65258846c00cd2-46008427.webp
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 12 KB
13 KB 196ms
195ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65258846c00cd2-46008427.webp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79f8dd869cb82914653f6e281d0abef4a764f9362599e66dc98958cdbf6ac490

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 01:11:39 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 160329
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 12427
last-modified: Tue, 10 Oct 2023 23:21:27 GMT
server: cloudflare
etag: "115fb8ccf654ae810aeb83309e9b8324"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 850747d6e9d4822c-IAD
timing-allow-origin: *
x-amz-cf-id: cIuPmN5S5O0-Sw91DCnPQPmSERVa23j5kY7MMme09Qmw2I70mdz31A==

GET
H2 200 6579d727ba9ff8-37280228.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 8 KB
9 KB 192ms
190ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/6579d727ba9ff8-37280228.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4de4fdd2438e4cf4e9fdfd3cd0bdeea1099ef43bcda72eee19f36918c8526b18

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 18:47:05 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 442603
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 8545
last-modified: Thu, 14 Dec 2023 01:15:13 GMT
server: cloudflare
etag: "f08a47090e2e6c7ec629af3bf0a5eb99"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84ec5c612947065d-IAD
timing-allow-origin: *
x-amz-cf-id: ChM5B_LM2-WT-vnUOeA_0EIt5dLJnmt8OwSMnrYZAyVq-OkhveHu0g==

GET
H2 200 64f0aa928c0db1-25472502.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 13 KB
13 KB 185ms
184ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/64f0aa928c0db1-25472502.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

333ee0fb9b38ada4a28f9c3b0f75e9f7fd8beab63a251cf62e29d7bc021b1daf

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 19:34:34 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 180554
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 13024
last-modified: Fri, 01 Sep 2023 12:47:54 GMT
server: Cloudinary
etag: "a6e4c240783463e4f132fe96c02d5162"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 3i6whM2xEA_KJMTx36I9l2lM3gllYrOyrARANVgAhw-l2s2Adkq6ow==

GET
H2 200 b229a72bcf3963380328cc59a7214a02.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 187ms
186ms Image
image/jpeg 13.224.214.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/b229a72bcf3963380328cc59a7214a02.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.214.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Cloudinary /

Resource Hash

c998551548266a465b8be976506968fda81be63b1d542dfcdf44c4b260f11335

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 13:46:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f44c8fed96046735d6f7ada758945c4e.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 115032
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5378
last-modified: Wed, 10 Jan 2024 16:53:34 GMT
server: Cloudinary
etag: "a007bc5b43a2fd77b2e014633ef39e04"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: dQnBmJGq0zSqtJNS0kza4ECGJABsxNg7qd_crq7Vt8kb9lxlKNsA3w==

GET
H2 200 sync-2435d567.js Show response
cdn.ex.co/sync/0.0.1-7abf705/ Frame 073E 7 KB
3 KB 64ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/cookie_sync.html?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 8bf2c5d28ba5403debe4799fb6519d1541ce1f17e900acf33557b56f766f2a8a

Request headers

Referer: https://cdn.ex.co/sync/0.0.1-7abf705/cookie_sync.html?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Origin: https://cdn.ex.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 2907
last-modified: Fri, 26 Jan 2024 17:08:03 GMT
server: AmazonS3
etag: "7be7bbbe74c5ada528aa3ff559d5c523"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Tue, 13 Feb 2024 21:43:48 GMT

POST
H3 204 AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 90ms
89ms XHR
text/html 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Tb6GXF3MgnLVOrjVosJ10g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Tb6GXF3MgnLVOrjVosJ10g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmJw1JBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrCBCX3T7HWgfEwnLnWaWBWIibY8qFrnVsAjM-vPMGAKfhHqo"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 109ms
108ms XHR
text/html 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVGGrMpHPvpAqNzxllOYQxisYTvVg6ro0hcIRhWfIADbqFoo1rwaUTMtMqT1xnQjQb-vT2R_zGIeZM34juDWNyGyNZ2YoKpn5j95KCt24R75BqFNyabwkRMWoO3ZePesiLiTPHKXQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-COuOH675uT4cmVscsF6M2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-COuOH675uT4cmVscsF6M2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmLw15BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrCBCX3T7HWgfEwnLnWaWBWIibY8qFrnVsAjP-nAkFAKwBHqw"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUOO2eUYQubtb0GgIIBfNoQ8J8BxBcs2fgPgpLhSgobueZaFzmXKNph5UcFT60ThFs9gxXzqjb7zVC_323fyDv0TSmGEJ0LDObbaY32W74x58EjNr63_VHYpIE-bMAXlFq3080xaA== Show response
fundingchoicesmessages.google.com/f/ 8 KB
3 KB 108ms
108ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUOO2eUYQubtb0GgIIBfNoQ8J8BxBcs2fgPgpLhSgobueZaFzmXKNph5UcFT60ThFs9gxXzqjb7zVC_323fyDv0TSmGEJ0LDObbaY32W74x58EjNr63_VHYpIE-bMAXlFq3080xaA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3MjU1ODI4LDExNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vZnJlZWRvbWhlYWRsaW5lcy5jb20vZnJlZWRvbS13aXJlL2V5ZXdpdG5lc3MtdG8ta2lsbGluZy1vZi1ydW4tZG1jcy1qYW0tbWFzdGVyLWpheS10ZWxscy1qdXJ5LXRoZW4taS1zZWUtamF5LWp1c3QtZmFsbC8iLG51bGwsW1s4LCJnRHR5ZzZYbDQ1ayJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6e2f536256e380fd2105133f256f3f11bc92eca6d438e71b32531f074c084f85

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-ZD9dv2b24VTT2_msQb9hLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-ZD9dv2b24VTT2_msQb9hLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj2sKoxSXF4KkhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ySTw9SWTBBBrAfE7yVdM34B4h48Hy5vw6ax8EdNZ4-qmsxYAMd-66ayG66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYQIP6cOYP1NxD71M9gjQPistvnWOuAWFjuPKs0EAtxc0y50LWOTWDDqVuhAM4zUGs"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6189 0
0 122ms
122ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202402050101&jk=639364087958558&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H2 200 cookie_sync Show response
sync.ex.co/v1/ Frame 073E 2 KB
2 KB 183ms
61ms Fetch
application/json 3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.ex.co/v1/cookie_sync?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: ec4b9eafb0647fb378c36a118ee0265ca915d9186968c6221e7d515e6b513515

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: https://cdn.ex.co
date: Tue, 06 Feb 2024 21:43:48 GMT
access-control-allow-credentials: true
content-length: 1770
vary: Origin
content-type: application/json

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 02AC 0
10 B 64ms
63ms Image
text/plain 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?VWk9Sw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 hls.min.js Show response
cdn.ex.co/player/hls/1.4.10-exco/ 267 KB
81 KB 63ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 97fb107f26dfa81080591d1afd85f1f5a9b681a91b98f22e65ad6b2111766fbe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 82759
last-modified: Tue, 31 Oct 2023 13:17:42 GMT
server: AmazonS3
etag: "60aaafdd4d62415ba39125b40f38575c"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Tue, 13 Feb 2024 21:43:48 GMT

GET
H2 204 starti
s-26.channelexco.com/ppx/ 0
109 B 58ms
57ms Image
text/plain 199.115.112.161
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-26.channelexco.com/ppx/starti?sid=&domain=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F&se=30dc1726-fb57-490e-b841-f54269602d2b&pv=117.59&dd=freedomheadlines.com&gpvck=v022845426__780x438______HAR__nil__441&sa=shd&s=0.0&p=779297768&cb=1707255828231
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.115.112.161 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:48 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
server: openresty

GET
H2 200 expb.js Show response
cdn.ex.co/player/pb/2.7.0/ Frame 32B6 609 KB
201 KB 69ms
67ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/pb/2.7.0/expb.js
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 560aa41cac74895f19621ce3d7145eb822db90cee7ced4f6e41b21daa99a3093

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 205608
last-modified: Wed, 31 Jan 2024 12:55:06 GMT
server: AmazonS3
etag: "ced95b78b0305eb6ee6c8a9fa02ef69f"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Tue, 13 Feb 2024 21:43:48 GMT

GET
H3 200 AGSKWxXfGz5rtn5UW5mmWOKOsY7C2ppDneVwP2fYl6sdNF32E8gS2s3K_dOrNHx81mndYbXJdwkUCIw82VEXCuYZtINbna9GZh1o-l3NIr_gWeSpoL6tPZOHBp3qwvWYl5IxSbLWQkKLVw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 111ms
110ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXfGz5rtn5UW5mmWOKOsY7C2ppDneVwP2fYl6sdNF32E8gS2s3K_dOrNHx81mndYbXJdwkUCIw82VEXCuYZtINbna9GZh1o-l3NIr_gWeSpoL6tPZOHBp3qwvWYl5IxSbLWQkKLVw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3MjU1ODI4LDI5NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vZnJlZWRvbWhlYWRsaW5lcy5jb20vZnJlZWRvbS13aXJlL2V5ZXdpdG5lc3MtdG8ta2lsbGluZy1vZi1ydW4tZG1jcy1qYW0tbWFzdGVyLWpheS10ZWxscy1qdXJ5LXRoZW4taS1zZWUtamF5LWp1c3QtZmFsbC8iLG51bGwsW1s4LCJnRHR5ZzZYbDQ1ayJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fc81c553e898cb1e3ac63502b4fe516bb78b271837be00b88bf1466b22048647

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-R5i3BnuHnWsUrbrzN0ZsFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-R5i3BnuHnWsUrbrzN0ZsFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjWsOoxSXF4KchxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ySTw9SWTBBBrAfE7yVdM34B4h48Hy5vw6ax8EdNZ4-qmsxYAMd-66ayG66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYQIP6cOYP1NxCX3T7HWgfEwnLnWaWBWIiHY8qFrnVsAjd2TF7HCACrOU2w"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012401291952000/ Frame 113E 196 KB
56 KB 251ms
65ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401291952000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3eca9711527fe0ef176061b86ddb6380ac65012af5295dc8594e1fd40b43dc4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 15:28:32 GMT
age: 108916
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56077
x-xss-protection: 0
server: sffe
etag: "1ed25d76f90879fd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Feb 2025 15:28:32 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012401291952000/v0/ Frame 113E 15 KB
5 KB 399ms
214ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401291952000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952f4a545636082660a36e042a5fc4f08833978338cb85b731a8c8cdb6a1f9c3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 15:28:32 GMT
age: 108916
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5233
x-xss-protection: 0
server: sffe
etag: "68ac9d88d2f391b8"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Feb 2025 15:28:32 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012401291952000/v0/ Frame 113E 95 KB
28 KB 369ms
184ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401291952000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a577e7fb9faad8a5fdc642832ba0bcf65ae0f6205d7f9ae124b08ecfc8e7e579

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 15:28:32 GMT
age: 108916
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29021
x-xss-protection: 0
server: sffe
etag: "2d02fb878b5fde43"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Feb 2025 15:28:32 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012401291952000/v0/ Frame 113E 5 KB
2 KB 412ms
228ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401291952000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7b5110727771b2c728a77387937413360b7c81afe6b78c2d379f9382d5762f9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 15:28:32 GMT
age: 108916
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1914
x-xss-protection: 0
server: sffe
etag: "705bfb43384be481"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Feb 2025 15:28:32 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012401291952000/v0/ Frame 113E 40 KB
13 KB 399ms
218ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401291952000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04a5eb2c4ba6aebc816c3005f46a65cc24cc3f3c4945cd7ab0b9d47975c7afb7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 15:28:32 GMT
age: 108916
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12961
x-xss-protection: 0
server: sffe
etag: "7c9e2849f5b8f3a3"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Feb 2025 15:28:32 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 113E 14 KB
1 KB 86ms
79ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 20:42:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:48 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 113E 2 KB
2 KB 71ms
64ms Image
image/png 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 07:56:08 GMT
x-content-type-options: nosniff
server: cafe
age: 49660
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Feb 2024 07:56:08 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 113E 295 B
319 B 68ms
64ms Image
image/png 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:17:44 GMT
x-content-type-options: nosniff
server: cafe
age: 33964
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Feb 2024 12:17:44 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/324206174418241846/ Frame 113E 14 KB
14 KB 65ms
64ms Image
image/jpeg 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/324206174418241846/14763004658117789537?w=400&h=209&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d7a771f454cc3f84a64e74c1ddcacf4e053bc7e09057d8c0768db9342cd4693

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires: Fri, 31 Jan 2025 09:42:02 GMT
date: Thu, 01 Feb 2024 09:42:02 GMT
x-content-type-options: nosniff
age: 475306
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14107
x-xss-protection: 0
last-modified: Sat, 29 Jul 2023 01:02:13 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
DATA 200
OK truncated
/ Frame 113E 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 113E 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 113E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 784324d0802a839cdb5e2670db4329a79f9ce07cff79a225349662f6b3c88b60

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 container.html Show response
f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A4E4 6 KB
3 KB 65ms
63ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:47 GMT
expires: Wed, 05 Feb 2025 21:43:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 632B 6 KB
3 KB 70ms
69ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:47 GMT
expires: Wed, 05 Feb 2025 21:43:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8 Show response
mcd.ex.co/video/upload/sp_hd/v1490095101/ 1 KB
2 KB 258ms
65ms XHR
application/x-mpegurl 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/sp_hd/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: a56f5f7194ef81e280190cdf70a6d1289942afaf52231e7900474b312f5c48cf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:43:48 GMT
Cache-Tag: 502941132783428480281542933415069772301,394554537382471183304184472313687845759,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection: keep-alive
Content-Length: 1127
X-Served-By: cache-bwi5061-BWI
Last-Modified: Wed, 09 Jun 2021 12:31:44 GMT
Server: cloudinary
X-Timer: S1638940479.929676,VS0,VE104
ETag: "43c49c5a38361beb99c8bf3dd60047f4"
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30847445
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

OPTIONS
H2 200 page-view
yeet.revcontent.com/yeet/events/ Frame 0
0 65ms
63ms Preflight 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/page-view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: https://freedomheadlines.com
content-length: 0
date: Tue, 06 Feb 2024 21:43:48 GMT
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time: 2
x-rc-region: us-east-1a

OPTIONS
H2 200 widget-loaded
yeet.revcontent.com/yeet/events/ Frame 0
0 73ms
72ms Preflight 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/widget-loaded
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: https://freedomheadlines.com
content-length: 0
date: Tue, 06 Feb 2024 21:43:48 GMT
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time: 8
x-rc-region: us-east-1a

POST
H2 204 page-view
yeet.revcontent.com/yeet/events/ 0
0 65ms
64ms Fetch 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/page-view
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json

Response headers

x-rc-region: us-east-1a
access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:48 GMT
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
server: envoy
vary: Origin

POST
H2 204 widget-loaded
yeet.revcontent.com/yeet/events/ 0
0 63ms
62ms Fetch 44.216.2.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/widget-loaded
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.216.2.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-2-235.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json

Response headers

x-rc-region: us-east-1a
access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:48 GMT
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
server: envoy
vary: Origin

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 113E 33 KB
33 KB 65ms
64ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 18:24:54 GMT
x-content-type-options: nosniff
age: 443934
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 31 Jan 2025 18:24:54 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 54F7 16 KB
6 KB 66ms
66ms Document
text/html 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=72252
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Tue, 06 Feb 2024 21:43:48 GMT
expires: Wed, 07 Feb 2024 17:48:00 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 AGSKWxXzBSyPpwnPwWvW0W-M6QwgFtDdRKBK7YKGOTHzVPnBSwK0LKgb3VX3HcA1h4TR4Mjn6I826QLY_kxb8Ut4pbaj_W0RoHpJOapcVAkfVKOLwg9DsuDp5vUWFKbVTopnSSuyApHBsg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 119ms
117ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXzBSyPpwnPwWvW0W-M6QwgFtDdRKBK7YKGOTHzVPnBSwK0LKgb3VX3HcA1h4TR4Mjn6I826QLY_kxb8Ut4pbaj_W0RoHpJOapcVAkfVKOLwg9DsuDp5vUWFKbVTopnSSuyApHBsg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA3MjU1ODI4LDY4NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9mcmVlZG9taGVhZGxpbmVzLmNvbS9mcmVlZG9tLXdpcmUvZXlld2l0bmVzcy10by1raWxsaW5nLW9mLXJ1bi1kbWNzLWphbS1tYXN0ZXItamF5LXRlbGxzLWp1cnktdGhlbi1pLXNlZS1qYXktanVzdC1mYWxsLyIsbnVsbCxbWzgsImdEdHlnNlhsNDVrIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

024618a1c5b22ae829b8410ad772197362ef3e3800075d6d6b25935f36171c4f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-m1P5AC6R0XbCcm4O6T_DFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-m1P5AC6R0XbCcm4O6T_DFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj2sKoxSXFEKQhxXDe6Q7TdSC-qPKU6SYQ1zI8Y2oF4gfhz5heALGBxnMmCyBm_POCiROI3315ySTw9SWTBBBrAfE7yVdM34B4h48Hy5vw6ax8EdNZ4-qmsxYAMd-66ayG66ezbjkznXUPEMc8n86aAsSLWWewrgbiKYEzWOcAsVP6DNYQIP6cOYP1NxD71s9gjQfistvnWOuAWFjuPKs0EAvxcEy50LWOTeDFsZ43TAAm_lD2"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame A4E4 4 KB
671 B 81ms
80ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 21:12:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:48 GMT

GET
H2 200 73134fbfa16854d24caf7cd541ab86d9.js Show response
www.gstatic.com/mysidia/ Frame 82EE 9 KB
5 KB 210ms
65ms Script
text/javascript 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/73134fbfa16854d24caf7cd541ab86d9.js?tag=client_fast_engine_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d99a3294b83fe3b21e9251c87e7696b7f5ba1651c5d82256db3c0700ead09b57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 476699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4097
x-xss-protection: 0
last-modified: Thu, 25 Jan 2024 03:17:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 01 May 2024 09:18:49 GMT

GET
H2 200 bc7f7aad4239fe322274bd94f062aab7.js Show response
www.gstatic.com/mysidia/ Frame 82EE 174 KB
64 KB 217ms
73ms Script
text/javascript 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/bc7f7aad4239fe322274bd94f062aab7.js?tag=gpa/dynamic_fig_web_banner_v2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64bde18d8671690f9141375afac90d608da3a4e3f55403ce2fcdab5b507006e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:35:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 475725
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65073
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 03:19:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 01 May 2024 09:35:03 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 82EE 7 KB
1 KB 81ms
79ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98ea92621a1e03efc11987fba7aff5dae88cd39ffa85960a627b7c8c7b002e8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 21:19:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:48 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 82EE 2 KB
822 B 67ms
64ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:24:26 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/ Frame 82EE 23 KB
9 KB 68ms
65ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Feb 2024 21:43:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 82EE 3 KB
1 KB 68ms
66ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:24:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 82EE 20 KB
8 KB 70ms
68ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:14:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80988
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:14:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 82EE 205 KB
62 KB 67ms
65ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=44809772

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:32:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 22:32:37 GMT

GET
H2 200 ddb466d8785cb75acd721f17b1b8dd87.js Show response
www.gstatic.com/mysidia/ Frame 82EE 37 KB
15 KB 334ms
195ms Script
text/javascript 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ddb466d8785cb75acd721f17b1b8dd87.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54090d5321bc8e3a05531aacf2ef2b7769f24e94b14f4a0687587375fffa2523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 475891
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15487
x-xss-protection: 0
last-modified: Thu, 25 Jan 2024 03:17:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 01 May 2024 09:32:17 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/elements/html/ Frame A4E4 16 KB
7 KB 77ms
77ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1984c4bb2ce10d00cb478c4ab216301e04502e25f2025b30dbeeb019172beb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:27:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6823
x-xss-protection: 0
server: cafe
etag: 14359709190881042667
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:27:23 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame A4E4 205 B
520 B 202ms
68ms Image
image/png 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:22:00 GMT
x-content-type-options: nosniff
age: 476508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 31 Jan 2025 09:22:00 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame A4E4 604 B
696 B 205ms
72ms Image
image/png 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 06:13:40 GMT
x-content-type-options: nosniff
age: 574208
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 30 Jan 2025 06:13:40 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/elements/html/ Frame A4E4 22 KB
9 KB 85ms
84ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6f8aad2c2e01e81032eb3ce744f73450e33b1718dd95ee9cb968e76b8512f59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:26:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9451
x-xss-protection: 0
server: cafe
etag: 11136001603933606047
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:26:59 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 632B 2 KB
822 B 101ms
101ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:24:26 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/ Frame 632B 23 KB
9 KB 102ms
101ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/abg_lite_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Feb 2024 21:43:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 632B 3 KB
1 KB 109ms
108ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/window_focus_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:24:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 632B 20 KB
8 KB 82ms
80ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:14:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80988
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:14:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 632B 205 KB
62 KB 100ms
99ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=44809772

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:32:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 22:32:37 GMT

GET
H2 200 ddb466d8785cb75acd721f17b1b8dd87.js Show response
www.gstatic.com/mysidia/ Frame 632B 37 KB
15 KB 321ms
210ms Script
text/javascript 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ddb466d8785cb75acd721f17b1b8dd87.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54090d5321bc8e3a05531aacf2ef2b7769f24e94b14f4a0687587375fffa2523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 475891
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15487
x-xss-protection: 0
last-modified: Thu, 25 Jan 2024 03:17:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 01 May 2024 09:32:17 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 632B 25 KB
25 KB 299ms
134ms Image
image/jpeg 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQzI2iW02YeM013T4XiI56AYZfJycGBUmLVfYkdHB4IWZf45mrsXRD7JjSWBcg&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a44525e6aa5c0a89009395cd4be2f63c4387632833f3f9a74aa00b3f60287e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 14:51:42 GMT
x-content-type-options: nosniff
age: 24726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25680
x-xss-protection: 0
last-modified: Thu, 14 Mar 2024 04:30:17 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 05 Feb 2025 14:51:42 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 632B 18 KB
18 KB 321ms
153ms Image
image/jpeg 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcR6ces1VPfemm_Iw1gdW-vW5OHg7fKBXSSfJUn14WeBCpM_3JtDCkBCNNubIA&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3701f7dfa2cff6b71de11a377f226cc617dfb032e3f95cbb9e4aca9cb16cc737

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:35:31 GMT
x-content-type-options: nosniff
age: 475697
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18321
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 04:42:24 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 31 Jan 2025 09:35:31 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 632B 16 KB
17 KB 228ms
63ms Image
image/jpeg 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcRYTM0AvO472ToNZmuc8lJgfMWN7XvYur8JqjiHhutxCVvFBOCFVGPtOl5TTT8&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a61fed920fc2fcf26b049779b81aff9e4b59d94cbcaeeee9f11a4b18707c398

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:37:21 GMT
x-content-type-options: nosniff
age: 475587
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16499
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 11:37:11 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 31 Jan 2025 09:37:21 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 632B 12 KB
12 KB 248ms
84ms Image
image/jpeg 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcTnHONqIFCZN9OiJRQOagyM8U1ariqOZ5UTuYMO_TX4L2sdgGj24TRboy-eHg&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8b4a92a9c35f5398933d57a3dd02e7efe2f6cdcce932d340158a052b7afa1137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 19:35:56 GMT
x-content-type-options: nosniff
age: 94072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12359
x-xss-protection: 0
last-modified: Tue, 04 Jun 2024 08:03:07 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 04 Feb 2025 19:35:56 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 632B 28 KB
29 KB 249ms
82ms Image
image/jpeg 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcQyIjxnD2cSq6rMX8auGAcgbOGJAkk_YajVlVIeJ0L0CJuVw_ItSAi2JO6PSU0&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36f7a6ad20963d2d1e784dd9a7cb26de1edba867bb74f2a374d54a574b3adeb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:31:35 GMT
x-content-type-options: nosniff
age: 475933
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29072
x-xss-protection: 0
last-modified: Wed, 20 Mar 2024 10:50:20 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 31 Jan 2025 09:31:35 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 632B 15 KB
16 KB 232ms
65ms Image
image/jpeg 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRf5hF-0f8xluB6UCUNWaxAdW7mxVllYICOFc4iJwtOb1p1NxidM98vKIHtCg&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

206d3d75bf9a72ab05c682c9cb0c4187afbc25e826927f8eccc86e52504ee4fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 12:25:13 GMT
x-content-type-options: nosniff
age: 465515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15566
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 09:15:09 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 31 Jan 2025 12:25:13 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 632B 16 KB
17 KB 229ms
65ms Image
image/jpeg 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcRZFiHv1nlLaWSvqK-LyKLJQ6jLg57oY3uc-YXuX7u22sNfrn8bZ0pSvsSMUfo&usqp=CAI

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68011e4b257736e003c5773c85ec64878af9b0d7a6d9d92a0413298a0e0d0964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 20:50:16 GMT
x-content-type-options: nosniff
age: 89612
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16793
x-xss-protection: 0
last-modified: Mon, 18 Mar 2024 02:31:57 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 04 Feb 2025 20:50:16 GMT

GET
H3

200

3924125642834448992
tpc.googlesyndication.com/simgad/ Frame 632B
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgODqq4ObwwEQsAkYsAkyCLECC0Vlv8IN
https://tpc.googlesyndication.com/simgad/3924125642834448992

77 KB
77 KB

65ms
65ms

Image
image/png

2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3924125642834448992

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87a92e159459b46d503d7ca9301e076e886bf1eb91abaae349f8b6a69deb2571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires: Fri, 31 Jan 2025 09:11:33 GMT
date: Thu, 01 Feb 2024 09:11:33 GMT
x-content-type-options: nosniff
age: 477135
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79088
x-xss-protection: 0
last-modified: Sat, 08 Apr 2023 13:35:14 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

Redirect headers

date: Tue, 06 Feb 2024 06:14:14 GMT
x-content-type-options: nosniff
server: cafe
age: 55774
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/3924125642834448992
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 07 Mar 2024 06:14:14 GMT

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8 Show response
mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/ 2 KB
2 KB 65ms
65ms XHR
application/x-mpegurl 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 363a2228f397c87b3aeb0e7fc9926e5438c3de511242c5849d0da3d2c76037fd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:43:48 GMT
Cache-Tag: 502941132783428480281542933415069772301,484104238383510269782950376486441993307,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection: keep-alive
Content-Length: 1890
X-Served-By: cache-wdc5553-WDC
Last-Modified: Wed, 09 Jun 2021 12:31:21 GMT
Server: cloudinary
X-Timer: S1638943640.481049,VS0,VE1
ETag: "e3a4d3e4cf55264cd80d76705e1125b3"
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30633353
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 1

POST
H2 204 events
e.channelexco.com/ 0
247 B 221ms
67ms Ping
text/plain 23.19.226.131
LEASEWEB-USA-NYC

General

Check archive.org

Show headers Download Go to

Full URL: https://e.channelexco.com/events
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.19.226.131 New York, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:48 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2

200

/
sync.ex.co/v1/setuid/sovrn/ Frame 073E
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID&sovrn_retry=true
https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IHk3ALZHTKW55wwqS02JoA7V

86 B
393 B

59ms
58ms

Image
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IHk3ALZHTKW55wwqS02JoA7V
Protocol: H2
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:49 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

location: https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IHk3ALZHTKW55wwqS02JoA7V
access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:49 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 0
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 134ms
126ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202402050101&jk=639364087958558&bg=!tLelt_jNAAa8BdJLnAU7ADQBe5WfOL_kAocLTomh9k2hb5JyvWcDVye6Mgb_nVerEnSZD_mn-aQcZs53jFJYdkCm0_BhAgAAAEdSAAAAA2gBB5kCzBuVU3_-j5I1BTEGQ6tG-WYXYPHi0l25lMsz16QD1ud80Mr8rpt8LlwuGHlxcapQihI0uLX1fVScmsgAdLJpbtiV3aN97aBXkeA44L4K_BH9NAcVWliB6hTdZmkudQuU6P-H_ALI9g8XUb4qzz5fnXXP8IkI754DR8qgFXH5Ti41T4XeBmXAveGylm_rXfC2mRDTzgGu5p6ynhA0XzIdnWSUmc_vb5ThTjVs3Iwi5gRMq2X78MZYX66GCTMNj3dtoSOT89rOJCDBABlaZNgbK6cKQnwkUHxLFIpBMyY-NweP9NnjJc5_vKbOMG-IF-xy6H4sucV_QhH13XfN9GMj4qwqBZ-69t6g_QpONoe_t6HjDOghzs6zdXLP6U1-fU1MeFXK99KE0Sh4W9RX6egxufKN-rE2sUYhaNcX732CiZ2ui25BVH0tHs5QDEhn-yCTOSou9JXil82lXASYFntt0uZEqiq553vxdL7Wj2EwA11TPCiXDbuX6ctnWNhjWjlG_DhkFR8UpNFNhZAb3nkG4pGlH84McBDlqH8JFkOMBYdojkWnl27vlnXw7gmsbBc9uxWuQWjTvvaDSa7mya8B8j56ozpjD8y-7J4dNVFuTX4IRD-LRnU-3ce3na4ZAzEZD2YG49ehQgNEcVz-NakyshITNM-B-qrS4RXarpou5CD7ZRGYlOPEyjO5e-b1rZ085nZ3DCVv5OZvL0VK9dmIscVlrlbwDh81vcbBYP2AiZMeH4qU-BueXXwUCXJ7oWjVsLMecA31H765x_KuXye55KJdVz33PAR79mgZJubuF-cEWhOgYXIdcUYjTUOHw4toP3ZUpF0uK4ICyjZiaAbbd2C9kPOITEM9CWzU-QLnlgi2tqM63I3Skt8nUc2lX29SWuqGsjn9lKK_331g3sFvPz1bnBgAWA3m0qsvTDCMXNQ6etmdkSsQ-OHNYRLA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 54F7 5 KB
6 KB 177ms
57ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=22039350&p=158554&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 3bb9b76d68240ad1095d12eca008c51472f9fd135a2ea9479331835afbc43fdc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 21:43:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 113E 2 KB
2 KB 99ms
98ms Image
image/png 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 07:56:08 GMT
x-content-type-options: nosniff
server: cafe
age: 49660
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Wed, 07 Feb 2024 07:56:08 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 113E 295 B
319 B 100ms
99ms Image
image/png 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:17:44 GMT
x-content-type-options: nosniff
server: cafe
age: 33964
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 07 Feb 2024 12:17:44 GMT

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/ 88 KB
89 KB 85ms
84ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: f164b39a16618e24f0fd121a274768bc24760f8778d4a3b5457a5e03ddd0c53f

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=0-90239

Response headers

Date: Tue, 06 Feb 2024 21:43:48 GMT
Cache-Tag: 502941132783428480281542933415069772301,201691703795562271966273117828695354966,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 0-90239/1475048
Connection: keep-alive
Content-Length: 90240
X-Served-By: cache-wdc5558-WDC
Last-Modified: Wed, 09 Jun 2021 07:23:15 GMT
Server: cloudinary
X-Timer: S1638943722.002762,VS0,VE0
ETag: "bc1d05ae5b7f824a9cd6a30d8f4abbc9"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30633270
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 1

POST
H3 204 AGSKWxVtxKgRlNVmDF9tK6M9Fg6-JktOH9SRo0cKVMZlpi_vyA9j-dmqe7NMJDrfCGPfWjRi2yC7SKynuJIWafrInTELXL6sn38Y_pRmhJ0zDTN0EcXVTGcc27vHeJ2hfs8Wmzuul6fndw== Show response
fundingchoicesmessages.google.com/el/ 0
29 B 88ms
88ms XHR
text/html 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVtxKgRlNVmDF9tK6M9Fg6-JktOH9SRo0cKVMZlpi_vyA9j-dmqe7NMJDrfCGPfWjRi2yC7SKynuJIWafrInTELXL6sn38Y_pRmhJ0zDTN0EcXVTGcc27vHeJ2hfs8Wmzuul6fndw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0jFDemDaLN4vGmbw8GOREw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0jFDemDaLN4vGmbw8GOREw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctHikmLw0ZBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hy5TAGaxzgNgpfQZrCBCX3T7HWgfEwnLnWaWBWIiHY8qFrnVsAgd6n-5hBgDJ-B7m"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 632B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 030f61e531ab2f349e300c7a05c8e3a48db18b5f65f98130f40b8185f35ce902

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 113E 0
0 134ms
134ms Image
text/html 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C67JcE6jCZdzECL20wNYP5Zy_4AzWgtLZc8T32aOSEmQQASD7zfeVAWDJhoCA3KPEEKABsaS7vynIAQngAgCoAwHIAwqqBJsDT9BBq8FGmt64WFXH427nmt73JP7f_pcV0ukOufLWn-Fuc4Uhs74a8eSqhJZqA999QL6lFqc84W2sBno604ut_QvCQZLAibe-eeXLcIhkzQPLML6mm-8M1feVa02RnKTZjP2eAdWKpd09l35t_Vm6FUO2fQyoXHKsJNbA-YIW_F6mEasBxmzUTMfNOgz0LIT17ruTYS15DlpAya5Iu4p5q8VTHc4eTMfcRqhMigj0SywtxNj1g4XVKsYIW4x2qSXZ-Sx-31vrIEdgEKtU4ecIM0gUr2AN2FKxJ4XN-yUt8lUZCCF3DjMvISobs4PxZx5nptzB9pwQLHDflV2THyrJfNp_uFH5LkIsyBx14Fny4cLiSASh_Zl51uZ4-fb82-UQLiTU2kPcZkw2tPqQRdiY7r4rfp0mf5pWRKY0cNUQgX7bOquPOyXLGTyVz07GxRSU5Kymsci4lYtux-XHBEAARuVnObMgPiGmFPljmR77rmx353s8wZBdMDzhks9kpt--qMHtL4uhLH1KX9Rg0c8mcMf4etAZTGOU-7htwASwq5H5ygTgBAGIBZKmhIhMkgUECAQYAZIFBAgFGASgBi6AB7Hci58EqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQ5vo-0ggkCIBhEAEYHTICigI6CYBAgMCAgICACEi9_cE6WNC89cjXl4QDmglzaHR0cHM6Ly9vZmZpY2lhbG5hbm9zcGFya2xlLmNvbS9hdXRvY2FyZS9zY3JhdGNoZXMucGhwP2FmZklkPUVCM0U4Rjc4JmMxPXVzJmMyPW1qX2N1c3RvbWt3X3BsYWNlbWVudHNfcHJvZF9hZGNvbWJvMYAKAcgLAdoMEAoKEJDM9MKw6tfMNBICAQPiDRMI56z2yNeXhAMVPRrQBB1lzg_M2BMM0BUBmBYBgBcBshcfCh0IABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYuN-aAQ&sigh=Lg2D9DnE2Y8&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTgAvHhf_P66Mxtbz3-PJUQOy4KeCT9gyrct74e6vTSY_eKcuQ3mZOhkee37rq3dmwUs-D_AAYabqiBtHkTtQafXoafxp4oDhyo8EfGq4DhgB&template_id=5000&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame BF9A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

81ms
81ms

Document
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 06 Feb 2024 21:43:49 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: MZA1BQKXDZ47WM5FDTJ9

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:49 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 7W6C8SQDMJD9SCWHR8EK

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E7D8
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=cff4de14-c538-11ee-9e3f-3352cae3ab6e

42 B
322 B

68ms
65ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=cff4de14-c538-11ee-9e3f-3352cae3ab6e
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
content-type: image/gif
date: Tue, 06 Feb 2024 21:43:49 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=cff4de14-c538-11ee-9e3f-3352cae3ab6e
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6AAF
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBbFFrN0xoVkFBQUJKTE5fM0tzUQ&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://sync.technoratimedia.com/services?uid=AAAlQk7LhVAAABJLN_3KsQ&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Csas%252Cpm%26bee_sync_cu...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2
https://bh.contextweb.com/bh/rtset?ev=AAAlQk7LhVAAABJLN_3KsQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_par...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AAAlQk7LhVAAABJLN_3KsQ&pid=558502&do=add&gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAAlQk7LhVAAABJLN_3KsQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=4192948985614939915&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAlQk7LhVAAABJLN_3KsQ&gdpr=0&gdpr_consent=

42 B
279 B

59ms
59ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAlQk7LhVAAABJLN_3KsQ&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:05:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:50 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAAlQk7LhVAAABJLN_3KsQ&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D5D4
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8266047830043511900&gdpr=0&gdpr_consent=

42 B
218 B

67ms
64ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8266047830043511900&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: c5338631-4d32-437b-a2c9-399d871a201b
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8266047830043511900&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 6C3D 0
337 B 177ms
56ms Document
image/gif 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Tue, 06 Feb 2024 21:43:48 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: c

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 95BB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
235 B

60ms
59ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZcKoFQAC_XKBTwBK
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760024-MIA
x-timer: S1707255829.210108,VS0,VE26

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Tue, 06 Feb 2024 21:43:49 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZcKoFQAC_XKBTwBK
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760024-MIA
x-timer: S1707255829.147769,VS0,VE28

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1F72
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://a.clickcertain.com/px/img/bidswitch/?bidswitch_ssp_id=pubmatic&bs_uid=fdd96b06-5a2f-441c-9424-ef70eba3e799
https://a.usbrowserspeed.com/cs?puid=b61aea63-904a-5e4a-941e-b8ea263139bd&pid=lc&r=https%3a%2f%2fmatch%2eprod%2ebidr%2eio%2fcookie%2dsync%2ffivebyfive%3fr%3dhttps%253a%252f%252fa%252eclickcertain%2...
https://match.prod.bidr.io/cookie-sync/fivebyfive?r=https%3a%2f%2fa%2eclickcertain%2ecom%2fpx%2fimg%2fbidswitch%2f%3fdone%3dtrue%26bidswitch_ssp_id%3dpubmatic
https://a.usbrowserspeed.com/cs?puid=AAAlQk7LhVAAABJLN_3KsQ&pid=beeswax&r=https%3A%2F%2Fa.clickcertain.com%2Fpx%2Fimg%2Fbidswitch%2F%3Fdone%3Dtrue%26bidswitch_ssp_id%3Dpubmatic
https://a.clickcertain.com/px/img/bidswitch/?done=true&bidswitch_ssp_id=pubmatic
https://x.bidswitch.net/sync?dsp_id=179&user_id=7b049487-1045-4278-8db4-bbdf449c5cb1&expires=5&user_group=0&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fdd96b06-5a2f-441c-9424-ef70eba3e799&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
167 B

65ms
64ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fdd96b06-5a2f-441c-9424-ef70eba3e799&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:50 GMT
Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=fdd96b06-5a2f-441c-9424-ef70eba3e799&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F65B
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:oafJSOnG1Rxtel5&gdpr=0&gdpr_consent=

42 B
220 B

69ms
66ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:oafJSOnG1Rxtel5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:48 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:oafJSOnG1Rxtel5&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-801-g0076fb7#rel-ec2-master i-01a6dd57eee03fc89@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame C562
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=q1CXzfxdxcqwVsHMrFXZyaUGxMuwVJKcq1Cnuq2f

42 B
422 B

215ms
61ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=q1CXzfxdxcqwVsHMrFXZyaUGxMuwVJKcq1Cnuq2f
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 20:52:02 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Tue, 06 Feb 2024 21:43:49 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=q1CXzfxdxcqwVsHMrFXZyaUGxMuwVJKcq1Cnuq2f
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 4A34
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=469b92bc-4c4e-488a-96dd-e52b81d98ba1&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D8375F6E-2B48-40AF-BB63-004D839E5C66

42 B
493 B

70ms
65ms

Document
image/gif

3.211.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D8375F6E-2B48-40AF-BB63-004D839E5C66
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-27-57.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Tue, 06 Feb 2024 21:43:49 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Tue, 06 Feb 2024 21:43:49 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=D8375F6E-2B48-40AF-BB63-004D839E5C66
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 87FC 43 B
363 B 188ms
57ms Document
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:48 GMT
expires: Tue, 06 Feb 2024 00:00:00 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 253606
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame B4C8
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1813050729409154703

42 B
273 B

139ms
62ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1813050729409154703
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:26:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:49 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1813050729409154703
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 30EF
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=75VtjvQJUThyUo15rWbu4SaEdkQ&gdpr=0&gdpr_consent=

42 B
378 B

65ms
64ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=75VtjvQJUThyUo15rWbu4SaEdkQ&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Feb 2024 21:43:49 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=75VtjvQJUThyUo15rWbu4SaEdkQ&gdpr=0&gdpr_consent=

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame A0A6
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
418 B

117ms
115ms

Document
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 8516922508edda83-MIA
content-length: 43
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 851692244facda83-MIA
content-type: text/html
date: Tue, 06 Feb 2024 21:43:49 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 2743

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 4B96
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=886166000890

42 B
208 B

89ms
65ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=886166000890
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=886166000890

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 15ED 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0255
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3b4365c2-a815-4b00-a220-bc8d503f5683&gdpr=0&gdpr_consent=

42 B
210 B

71ms
65ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3b4365c2-a815-4b00-a220-bc8d503f5683&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 06 Feb 2024 21:43:49 GMT
Expires: Tue, 06 Feb 2024 21:43:48 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1469 c412d14 master ord ord-pixel-x5 config_version:"2993"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3b4365c2-a815-4b00-a220-bc8d503f5683&gdpr=0&gdpr_consent=

GET
H2 200 / Show response
sync.ex.co/v1/setuid/pubmatic/ Frame BEF6 0
298 B 64ms
57ms Document
text/html 3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.ex.co/v1/setuid/pubmatic/?gdpr=0&gdpr_consent=&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin
content-length: 0
content-type: text/html
date: Tue, 06 Feb 2024 21:43:49 GMT
vary: Origin

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 54F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2DdfbitIQK-7YwBNg55cZg%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

354ms
352ms

Image
text/html

23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Protocol: H2
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:49 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=72251
accept-ranges: bytes
content-length: 5622
expires: Wed, 07 Feb 2024 17:48:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 54F7
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=D8375F6E-2B48-40AF-BB63-004D839E5C66
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D029877f8-4cfa-48db-ab82-06843bb57b4d%252C%252C
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fpixel.tapad.com%252Fidsync%252Fex%252Freceive%253Fpartner_id%253DAPPNEXUS%2526partner_device_id%253D%2524UID%2526pt%253D029877f8-4cfa...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6053676651067766727&pt=029877f8-4cfa-48db-ab82-06843bb57b4d%2C%2C

95 B
124 B

59ms
59ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6053676651067766727&pt=029877f8-4cfa-48db-ab82-06843bb57b4d%2C%2C

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:49 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
an-x-request-uuid: 2ffac246-d8a6-40dd-8200-02206383c4fd
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=6053676651067766727&pt=029877f8-4cfa-48db-ab82-06843bb57b4d%2C%2C
x-proxy-origin: 38.132.118.68; 38.132.118.68; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame 54F7 0
0 193ms
60ms Image
text/html 40.76.134.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%20D8375F6E-2B48-40AF-BB63-004D839E5C66&rnd=RND
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame 54F7
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
355 B

61ms
61ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RDgzNzVGNkUtMkI0OC00MEFGLUJCNjMtMDA0RDgzOUU1QzY2&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
245 B

137ms
58ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:40:40 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFOQ8Op6ytW3blEy67TswRA&google_cver=1

42 B
346 B

137ms
59ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFOQ8Op6ytW3blEy67TswRA&google_cver=1
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:41:25 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFOQ8Op6ytW3blEy67TswRA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1

42 B
402 B

206ms
60ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:40:18 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Tue, 06 Feb 2024 21:43:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 05 Feb 2024 21:43:49 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=

42 B
542 B

208ms
63ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=
date: Tue, 06 Feb 2024 21:43:49 GMT
server: Kestrel
content-length: 355

GET
H2 200 D8375F6E-2B48-40AF-BB63-004D839E5C66
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 54F7 43 B
602 B 189ms
62ms Image
image/gif 2600:1f18:4e9:5a05:c89c:b2af:dcc6:f0ac
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/D8375F6E-2B48-40AF-BB63-004D839E5C66?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:c89c:b2af:dcc6:f0ac Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JT_za6VE2uV7b_t6bolhESNylkcXdkI-~A&gdpr=0

0
260 B

179ms
57ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JT_za6VE2uV7b_t6bolhESNylkcXdkI-~A&gdpr=0
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JT_za6VE2uV7b_t6bolhESNylkcXdkI-~A&gdpr=0
date: Tue, 06 Feb 2024 21:43:49 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=4d0c2158-e5c9-4d72-89a6-012d679159ca&gdpr=0&gdpr_consent=

1 B
255 B

67ms
65ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=4d0c2158-e5c9-4d72-89a6-012d679159ca&gdpr=0&gdpr_consent=
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=4d0c2158-e5c9-4d72-89a6-012d679159ca&gdpr=0&gdpr_consent=
Date: Tue, 06 Feb 2024 21:43:49 GMT
Connection: keep-alive
X-CI-RTID: a0bbf9f0-c977-46e5-bd95-11b96566bf1e
Content-Length: 205
Content-Type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=73276de831aa12c5&is_secure=true&networkId=17100&version=1&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGqxr2Lu930ANoDZ6qAAAAAAA&expiration=1707342229&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&...

42 B
296 B

65ms
64ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGqxr2Lu930ANoDZ6qAAAAAAA&expiration=1707342229&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&is_secure=true&gdpr_consent=&gdpr=0
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:47 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGqxr2Lu930ANoDZ6qAAAAAAA&expiration=1707342229&nuid=D8375F6E-2B48-40AF-BB63-004D839E5C66&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3090034077542768983&gdpr=0&gdpr_consent=&us_privacy=

1 B
200 B

66ms
66ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3090034077542768983&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3090034077542768983&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 54F7 0
285 B 198ms
63ms Image
text/plain 34.200.159.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.159.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-159-21.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:49 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 54F7
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1107AD62F_816E4E88&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

73ms
71ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-390260629; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:48 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-390260629; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e130cb64-156d-4581-9b09-6b9221f627d0-65c2a815-5553&gdpr=0&gdpr_consent=

42 B
342 B

61ms
57ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e130cb64-156d-4581-9b09-6b9221f627d0-65c2a815-5553&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:26:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e130cb64-156d-4581-9b09-6b9221f627d0-65c2a815-5553&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1

42 B
427 B

66ms
65ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:50 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT, Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 82EE 0
234 B 430ms
142ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lsaw1gmt&c=7528245875401&slotId=3764122937700.5&qqid=CKqd-MjXl4QDFT0a0AQdZc4PzA&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ssc&ulv=1&ua_e=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/bc7f7aad4239fe322274bd94f062aab7.js?tag=gpa/dynamic_fig_web_banner_v2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hq1.jpg
i1.ytimg.com/vi/Gk75h39TTB8/ Frame 82EE 9 KB
9 KB 89ms
68ms Image
image/jpeg 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.ytimg.com/vi/Gk75h39TTB8/hq1.jpg

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79f0b699495fe1e459c57c1bfec3805ecbbfe90062739d1025532377ca790ebf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 20:10:32 GMT
x-content-type-options: nosniff
age: 5597
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9327
x-xss-protection: 0
server: sffe
etag: "0"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 06 Feb 2024 22:10:32 GMT

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8 Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 2 KB
2 KB 65ms
65ms XHR
application/x-mpegurl 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 66ea107d118b1b3df1a171897b0856a9dc8095854221a9345e360588063b4560

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection: keep-alive
Content-Length: 1898
X-Served-By: cache-wdc5553-WDC
Last-Modified: Tue, 08 Jun 2021 12:48:19 GMT
Server: cloudinary
X-Timer: S1638943641.320886,VS0,VE119
ETag: "8e79bd0c564573ae09a73296fcab7df8"
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30945954
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H/1.1 206
Partial Content videoplayback
rr4---sn-q4fl6nsy.googlevideo.com/ Frame 82EE 1024 KB
1 MB 234ms
72ms Media
video/mp4 2607:f8b0:4000:e::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr4---sn-q4fl6nsy.googlevideo.com/videoplayback?expire=1707284628&ei=FKjCZcTBBbP6xtYPla-R4AQ&ip=2001:550:1d05:1::12&id=1a4ef9877f534c1f&itag=18&source=youtube&requiressl=yes&xpc=Eghovf3BOnoBAQ==&mh=ZU&mm=31&mn=sn-q4fl6nsy&ms=au&mv=m&mvi=4&pl=48&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=30.650&lmt=1658878443420137&mt=1707255183&cpn=pQbPe8W2D2SNat4e&txp=6310224&sparams=expire,ei,ip,id,itag,source,requiressl,xpc,susc,acao,ctier,mime,vprv,dur,lmt&sig=AJfQdSswRgIhAIbOnDVwFL-ifK1RynWhdVtMk6tWwV6id2UQcIF-2g2aAiEAzBrGlJbjBMdF1Ewwkb5WwI5O2IQgWpxfxOGYecJ5r8E=&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgfW6DVJo0xcqTMdF8E1AXm5QVDEdYifG9Ndr39s5PGJMCICs8VfZJHTtmB8-IrqVI24dSRdX4U73JAH6ASDAuzvj1

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4000:e::9 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

dd970099dfc716237f7ca402a8295963e39df29855be4d99f6ad72bbad16f9cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 26 Jul 2022 23:34:03 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-1048252/1048253
Cache-Control: private, max-age=28499
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 1048253
Expires: Tue, 06 Feb 2024 21:43:49 GMT

GET
H2 200 sync Show response
ssbsync-global.smartadserver.com/api/ Frame 9B5D 601 B
805 B 188ms
65ms Document
text/html 23.105.12.171
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.171 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 21e490c413235c13bb98cbf365722929e2a439ef2d97223ff0ca14be041b12df

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 601
content-type: text/html
date: Tue, 06 Feb 2024 21:43:48 GMT

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 267ms
136ms Preflight
text/html 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CILuiE6jCZYbQCL20wNYP5Zy_4AyJqajedbLJgPW2EmQQASD7zfeVAWDJhoCA3KPEEKABocCY8SjIAQngAgCoAwHIA8sEqgSjA0_QvF47yq2SQjWEO3x2vJ5O5kuLdC7kFSusa-TYXTbFmJ1SuYcOrc3OBNEBIHHw1tZ1MVLRg2c7zwudYV3epapJLHhxYAkTBT0fzif1VGzmhkBtmq5fnG_KItF7DNwbZn8hafKEE3-wUMNOVca-3ycj2nIxwP_8ByaBXJpydYQoxRjueq-S6ETTbIAa0ENDgWbjJXPPCC8LAXTisVpRmJuQtSW1r_Cj8WpcTZxwVkTQvHRLy7I0zRTbUaPBqSgi3X45om-pGr89HX3jRQFN9lBiQQGsyXtsXMu8e7GT5qbVeUEXBW93FKHw6-qefDXblWOyvYPkfntd-u-3go1e3SC4CYGE4EEDv-mYf4jRHu709va5yaqbAiVRc4zhk35vcdCvwzC2Z45XKpLg2ewJSjdHkL5rq5jBstojQlAZd2iHMokrHjl6smXmp_4Wu7GYdYXSLrxb7ZA_v9VurEoPGKLwQomvWPg322lOJBamalTd1C8Vy2JfrE7oeQrVQMXvweQ4am_SM9fxsSnauOovPxocyyrRk1HcHcQ2_galVT7iH_OPwASxku2q2wTgBAGIBZ3kxZNOkgUECAQYAZIFBAgFGASgBi6AB7Xft54EqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpr4b2AcA8gcEEOfaHNIIJAiAYRABGB0yAooCOgmAQIDAgICAgAhIvf3BOljQvPXI15eEA5oJ_wFodHRwczovL3d3dy50ZW11LmNvbS9rdWlwZXIvdW4xLmh0bWw_c3Viaj1mZWVkLXVuJl9iZ19mcz0xJl9wX21hdDFfdHlwZT0xJl9wX2p1bXBfaWQ9NzI1Jl94X3ZzdF9zY2VuZT1hZGcmbG9jYWxlX292ZXJyaWRlPTIxMX5lbn5VU0QmZ29vZHNfaWQ9NjAxMDk5NTExODkzODM0Jl9wX3Jmcz0xJl94X2Fkc19jaGFubmVsPWdvb2dsZSZfeF9hZHNfc3ViX2NoYW5uZWw9b3RoZXImX3hfYmdfYWRpZD1nZDI2MzEwNjEtMSZ0b3BpY19jbGFzc2lmeT0xMTSACgHICwHaDBEKCxCQ3q6-yKGu0NQBEgIBA-INEwjrrPbI15eEAxU9GtAEHWXOD8zYEwvQFQGAFwGyFx8KHQgAEhRwdWItODg5ODA3NjQyMzYwMDM1Mhi435oB&sigh=1VvBpSn7K7Q&uach_m=%5BUACH%5D&ase=2&cid=CAQSTgAvHhf_P66Mxtbz3-PJUQOy4KeCT9gyrct74e6vTSY_eKcuQ3mZOhkee37rq3dmwUs-D_AAYabqiBtHkTtQafXoafxp4oDhyo8EfGq4DhgB&template_id=494&cbvp=2&vis=1&nis=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 632B
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CILuiE6jCZYbQCL20wNYP5Zy_4AyJqajedbLJgPW2EmQQASD7zfeVAWDJhoCA3KPEEKABocCY8SjIAQngAgCoAwHIA8sEqgSjA0_QvF47yq2SQjWEO3x2vJ5O5kuLdC7kFSusa-TYXTbF...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xf353932da09ceb5c0000000000000000%22,%222%22:%220xf386e80f81154dba0000000000000000%22,%223%22:%220xce2d9d...

0
0

216ms
88ms

Fetch
text/css

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xf353932da09ceb5c0000000000000000%22,%222%22:%220xf386e80f81154dba0000000000000000%22,%223%22:%220xce2d9d824e537d550000000000000000%22,%224%22:%220xfcd5c8bd4c6001300000000000000000%22,%225%22:%220x6c50e3c48a08c8190000000000000000%22},%22debug_key%22:%226097613286722958324%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2202-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221151277588403465265%22}&andc=true

Protocol

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:50 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xf353932da09ceb5c0000000000000000","2":"0xf386e80f81154dba0000000000000000","3":"0xce2d9d824e537d550000000000000000","4":"0xfcd5c8bd4c6001300000000000000000","5":"0x6c50e3c48a08c8190000000000000000"},"debug_key":"6097613286722958324","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["02-06"],"6":["true"]},"priority":"500","source_event_id":"1151277588403465265"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 06 Feb 2024 21:43:50 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 06 Feb 2024 21:43:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xf353932da09ceb5c0000000000000000","2":"0xf386e80f81154dba0000000000000000","3":"0xce2d9d824e537d550000000000000000","4":"0xfcd5c8bd4c6001300000000000000000","5":"0x6c50e3c48a08c8190000000000000000"},"debug_key":"6097613286722958324","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["02-06"],"6":["true"]},"priority":"500","source_event_id":"1151277588403465265"}&andc=true
access-control-allow-origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 AQAQeYtzTrql21gmUfHv2Md-TtOjltGIaj9_D2yS7lg.js Show response
pagead2.googlesyndication.com/bg/ Frame 5E4A 50 KB
19 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AQAQeYtzTrql21gmUfHv2Md-TtOjltGIaj9_D2yS7lg.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

010010798b734ebaa5db582651f1efd8c77e4ed3a396d1886a3f7f0f6c92ee58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:32:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 475883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19642
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 Jan 2025 09:32:26 GMT

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 110 KB
111 KB 71ms
71ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 5b62cb992309ab60c5e228f8591d6a54ca4a507039d8fe3af1b68f9af567731b

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=0-112987

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 0-112987/1662860
Connection: keep-alive
Content-Length: 112988
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129014
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
BLOB 200
OK abda6075-74e7-4df0-8b27-2ff9847ec681
https://freedomheadlines.com/ 267 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://freedomheadlines.com/abda6075-74e7-4df0-8b27-2ff9847ec681
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1042d1b60174a99afa3cbafdeec59701e6930ee129d5a837b7001538df09414d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 273447
Content-Type: text/javascript

GET
H2 200 /
sync.ex.co/v1/setuid/smartadserver/ Frame 9B5D 86 B
466 B 77ms
75ms Image
image/png 3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/smartadserver/?gdpr=0&gdpr_consent=&uid=4192948985614939915
Requested by: Host: ssbsync-global.smartadserver.com
URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync-global.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:49 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 9B5D
Redirect Chain

https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/smartadserver?zcc=1&cb=1707255829567
https://ad.turn.com/r/cs?pid=45&rndcb=1334358050
https://sync.1rx.io/usersync/turn/3090034077542768983?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-d3f7ecf4-2...
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005

43 B
514 B

58ms
57ms

Image
image/gif

23.105.12.121
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005
Requested by: Host: ssbsync-global.smartadserver.com
URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Protocol: HTTP/1.1
Server: 23.105.12.121 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync-global.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005
date: Tue, 06 Feb 2024 21:43:50 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXd3f7ecf42a194daea3f8a869ac0cc090005
content-type: text/html

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 9B5D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=

43 B
425 B

189ms
58ms

Image
image/gif

23.105.12.121
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync-global.smartadserver.com
URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Protocol: HTTP/1.1
Server: 23.105.12.121 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync-global.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=
date: Tue, 06 Feb 2024 21:43:49 GMT
server: Kestrel
content-length: 299

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 9B5D
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir?partneruserid=AAAlQk7LhVAAABJLN_3KsQ&partnerid=127&gdpr=0

43 B
412 B

188ms
58ms

Image
image/gif

23.105.12.121
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAAlQk7LhVAAABJLN_3KsQ&partnerid=127&gdpr=0
Requested by: Host: ssbsync-global.smartadserver.com
URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Protocol: HTTP/1.1
Server: 23.105.12.121 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync-global.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAAlQk7LhVAAABJLN_3KsQ&partnerid=127&gdpr=0
Date: Tue, 06 Feb 2024 21:43:49 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 9B5D
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7e50cf2d-e27b-4b5b-8f52-a5ddf27f3031&gdpr_consent=null&gdpr=0

43 B
466 B

58ms
57ms

Image
image/gif

23.105.12.121
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7e50cf2d-e27b-4b5b-8f52-a5ddf27f3031&gdpr_consent=null&gdpr=0
Requested by: Host: ssbsync-global.smartadserver.com
URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Protocol: HTTP/1.1
Server: 23.105.12.121 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync-global.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:49 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7e50cf2d-e27b-4b5b-8f52-a5ddf27f3031&gdpr_consent=null&gdpr=0
date: Tue, 06 Feb 2024 21:43:49 GMT
server: _
content-length: 0

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 143 KB
143 KB 70ms
70ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: e8842bdd078dfe00ec34ae593138c9bb396f06001d12de8a43bb7dd369978b80

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=112988-259063

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 112988-259063/1662860
Connection: keep-alive
Content-Length: 146076
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129014
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H3 200 AQAQeYtzTrql21gmUfHv2Md-TtOjltGIaj9_D2yS7lg.js Show response
pagead2.googlesyndication.com/bg/ Frame ED15 50 KB
19 KB 64ms
63ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AQAQeYtzTrql21gmUfHv2Md-TtOjltGIaj9_D2yS7lg.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

010010798b734ebaa5db582651f1efd8c77e4ed3a396d1886a3f7f0f6c92ee58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:32:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 475883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19642
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 Jan 2025 09:32:26 GMT

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 135 KB
136 KB 65ms
64ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 297c3d80eaffad29f1f39fb6ed7bcd3595e66918fcd32e644ca1e2f96ccc10d5

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=259064-397807

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 259064-397807/1662860
Connection: keep-alive
Content-Length: 138744
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129014
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 242ms
90ms Preflight
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 21:43:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 95 KB
96 KB 66ms
65ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: cb1f088186fa01b914e378618c159629360013dc7a470c2eaa20862d6b5b0fad

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=397808-495191

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 397808-495191/1662860
Connection: keep-alive
Content-Length: 97384
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129014
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 104 KB
104 KB 65ms
65ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 411b7002d4308199491626b3b22842c487649f62f1dabcabd8be9dcc3d2cb9c4

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=495192-601223

Response headers

Date: Tue, 06 Feb 2024 21:43:49 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 495192-601223/1662860
Connection: keep-alive
Content-Length: 106032
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129014
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 113E 42 B
64 B 127ms
126ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuTmeKRUSLFW5XV9XkoZSGiTtcKLRpupeTKMWFlc6TTwuLwPPhFuPusuMbDdRFT_zrfPrC0-4ifc-GoYHCB6n8Rq5iAnk8ADGduqyabQ0VOx6UQJE423uyb4Ryj5txj5v-de5r2psUvS99UmeBItKJt8ZyiSQUu3fI&sai=AMfl-YTKAaxJC4ui3yueH0-Vasn4Omd6IW6e1mOZsUNEfkNOHHhGFgC_qoTfibscGmT-YlQp2ruSVt4rKWBhFifQ4FqlIDrksmX0cEGs4_L9FiprBsxQ97WSox5cv6KWDBG51EBGstXOKsinxNGd9POs&sig=Cg0ArKJSzO4WF7hgoDXREAE&cid=CAQSTgAvHhf_P66Mxtbz3-PJUQOy4KeCT9gyrct74e6vTSY_eKcuQ3mZOhkee37rq3dmwUs-D_AAYabqiBtHkTtQafXoafxp4oDhyo8EfGq4DhgB&id=ampim&o=298,1080&d=1005,124&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=659&tls=1661&g=70.16128897666931&h=100&tt=1661&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 5911
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=190719&cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1

2 KB
995 B

85ms
84ms

Document
text/html

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15298e07fb954d92d5c1a2ccb9ddeef25571ac98a1d1dd59b96a7ab419c7a2a5

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8516922b39058da3-MIA
content-encoding: br
content-type: text/html
date: Tue, 06 Feb 2024 21:43:50 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FKQtS2ySla8WhxDYOMwm7L0h%2BIeqlEDGHw4Rn3heHcYouS7R9yE22cuODwrGWIGEFuIYxUa%2F6WYGV61ltc5ntyHE%2BfbvFCMV60oTTmeQ2S8pzZ2bGRfrjkeau%2FuQja1JL61lBG1TtI%2Fdkw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8516922ab8048da3-MIA
content-length: 0
date: Tue, 06 Feb 2024 21:43:50 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U9dOC34nY1VCF75iaTP10080yLg%2FlYnu9ET%2BzN20JjXP5AGfRjp5GmmxZaSsVZimyElvEptLhZu9QVbMW%2FDj3161eNITYAtYqu9OpbhCPafmlQFDPp22UPOWlJQIYUXSwLn0ow7ohMHUiw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 632B 42 B
174 B 127ms
126ms Fetch
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstSAhE6DDBAzujHFhChGK-JpvBYifF9cMbH-1HcvBgg1L9iDGBRfvUc6VJqLlApi2oBMeGUIS1VbhU9LU4snrl9u7xvxOtpY0ZeGUw_zFtSbSguK6K2yZVJpyYPWFAroOqPOtRP6hdJgaPUSO3aCOKOzS2FadsButg&sai=AMfl-YTxYgAHCcjKQEc0gA1SPNZhcWhdDXtHw_kTeNEiCSftLC4DdBfGnIcyRSQfjV2LB8KZ1kfWpmCl5bGXhDdONOlHh_5SHOicb-H3q0VSLRh7f2maRrm_gm3At5pZ8QYqz9GgJ2Ja6OG2b24FC0fX&sig=Cg0ArKJSzFeVUizV1_gdEAE&cid=CAQSTgAvHhf_P66Mxtbz3-PJUQOy4KeCT9gyrct74e6vTSY_eKcuQ3mZOhkee37rq3dmwUs-D_AAYabqiBtHkTtQafXoafxp4oDhyo8EfGq4DhgB&id=lidar2&mcvt=1000&p=843,246,933,974&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3340313678&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=318862800&rst=1707255828450&rpt=754&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=44809772

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 events Show response
collector-1.ex.co/main/ 17 B
154 B 60ms
60ms XHR
application/json 3.226.119.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-1.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.119.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-119-3.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:50 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5911
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZcKoFppxku0Afot76.WELgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELrCVOIt195kruxXZbC1C7I&google_cver=1&google_hm=2

43 B
733 B

77ms
77ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELrCVOIt195kruxXZbC1C7I&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QmfbJdD394Afxt%2F3JzbR5UuATb%2BRmG1vrBuHoDxgR%2FdExKz4rKwkQsyauGeEhsq1RyR4y7R4DHxrDWc5jTkvlymphsiPR1cM8RV0VMz0dV83vlbt0jO%2Fp8prpN1DffPPyNrOu6MQARFZlw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8516922cdb0f6dc7-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELrCVOIt195kruxXZbC1C7I&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 5911
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZcKoFppxku0Afot76-WELgAACxsAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEC7YZJ2d_7rtmRjGBV-_t3o&google_cver=1

43 B
766 B

81ms
81ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEC7YZJ2d_7rtmRjGBV-_t3o&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JEoB5hUNxVVjWyoy9XWN98R8TVHihC8sFSytfiKcjb1pfZkGWiWHVQfQuLBS%2FbGaqcjqAVsSJ1cIxUYDT6%2BEArYMWac1SFK0CGL9AHKdigvuGeiKAQAPWTBfes6ATEmI2bSGuyB4M63s5w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8516922c4a966dc7-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEC7YZJ2d_7rtmRjGBV-_t3o&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

usersync.aspx
dis.criteo.com/dis/ Frame 5911
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZcKoFppxku0Afot76.WELgAA%262843&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZcKoFppxku0Afot76.WELgAA%262843&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=1bae3dd13e93473fad05cf82815fe3b0
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

43 B
362 B

57ms
56ms

Image
image/gif

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 302157
expires: Tue, 06 Feb 2024 00:00:00 GMT

Redirect headers

Location: https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
Date: Tue, 06 Feb 2024 21:43:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 2

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 5911 43 B
855 B 67ms
64ms Image
image/gif 52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZcKoFppxku0Afot76-WELgAACxsAAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:50 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 23J3HWRANGAKVFKWANG4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5911
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662066459881630

43 B
733 B

74ms
74ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662066459881630
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tHtPizU%2Fs56F9qFdHVo79HTmaV0CiMbvjU1OVBIWG6mZsfEqiST4CClOqROKSYF%2BS%2FqwaT8sAXD8FFhBDSI1Xns2W80oftUhZc%2BR9XWpIddZVSzdbksaNpl1dxgy5Lqi4GaiL7uWSoView%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8516922c8ad36dc7-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 1602
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662066459881630
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8516922bccd3da83-MIA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5911
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1722980630&external_user_id=8c74adcb-4689-40ff-826c-7292aaf9c0ea

43 B
736 B

76ms
76ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1722980630&external_user_id=8c74adcb-4689-40ff-826c-7292aaf9c0ea
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s2cYdttpOIjmsN5GR8RfY%2FefygCEiarmJ1wbszXVzG1ndXmp%2Bpd%2FRSX%2BYEEjhLCCNN0V0wj7uauxYE6OrCEOiC4MmC1Y%2FWFwnunTOC5maDIWGb5fPaTco3WWrSTrgyfSDzt7GmZ%2BqJi1Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8516922cbaf56dc7-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Tue, 06 Feb 2024 21:43:50 GMT
via: 1.1 google
access-control-allow-methods: GET,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *.casalemedia.com
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1722980630&external_user_id=8c74adcb-4689-40ff-826c-7292aaf9c0ea
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 157

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 5911
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=6D9yZ78yIGDzOSRm7zo8Y-ZpIWHzO3c26D_8Hcou

43 B
344 B

120ms
118ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=6D9yZ78yIGDzOSRm7zo8Y-ZpIWHzO3c26D_8Hcou
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d0ymY6K5FL%2FxxefSrZ7dkcBu%2B9HpSiCZ3o4K%2FcsyHU044uTLrqipGX94QFHeUd9g62XYlNUHcmQ%2FUYJT6LTX8BaTq4pg%2BkinyckC4nzuNc%2BkSz7l%2BAmDa2FN6%2F4DtKglqDlGQzLdC0pN0w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8516922c3b0d8da3-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=6D9yZ78yIGDzOSRm7zo8Y-ZpIWHzO3c26D_8Hcou
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200 user-registering
ads.stickyadstv.com/ Frame 5911 43 B
655 B 214ms
71ms Image
image/gif 63.251.28.233
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=1025&userId=ZcKoFppxku0Afot76-WELgAACxsAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.251.28.233 Secaucus, United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1707255830526015-1148

GET
H2 200 /
sync.ex.co/v1/setuid/ix/ Frame 5911 86 B
544 B 59ms
58ms Image
image/png 3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/ix/?gdpr=0&gdpr_consent=&uid=ZcKoFppxku0Afot76.WELgAA%262843
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:50 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

POST
H2 204 csi
csi.gstatic.com/ Frame 82EE 0
45 B 142ms
141ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lsaw1gn1&c=7528245875401&slotId=3764122937700.5&qqid=CKqd-MjXl4QDFT0a0AQdZc4PzA&umsem=0&ple=1&ape=1&met.4=vil.lsaw1gxp~vfl.lsaw1h4z
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/bc7f7aad4239fe322274bd94f062aab7.js?tag=gpa/dynamic_fig_web_banner_v2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:50 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame A7CC
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17136_2&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east

281 B
555 B

207ms
67ms

Document
text/html

23.56.163.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.163.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-163-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 21:43:51 GMT
ETag: "280524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 06 Feb 2024 21:43:50 GMT
location: https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east
server: AkamaiGHost

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 54F7 0
128 B 63ms
60ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158554&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 09:40:04 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame A7CC 39 KB
11 KB 64ms
64ms Script
text/html 23.56.163.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.163.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-163-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 6515fd1cfd49b9d2e98e9b19fc2a912496047894f3636398027cd7582f563be7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:43:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 Feb 2024 01:17:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=12767
Connection: keep-alive
Content-Length: 10920
Expires: Wed, 07 Feb 2024 01:16:38 GMT

GET
H2

200

envelope Show response
lexicon.33across.com/v1/ Frame 32B6
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&gpp=&gpp_sid=
https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&gpp=&gpp_sid=&b=1&g=0C2c34mmiPE9ZpUxwxdoAMvtovBE7JIu%2B43n1JhhR1s%3D

42 B
138 B

62ms
61ms

Fetch
application/json

35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&gpp=&gpp_sid=&b=1&g=0C2c34mmiPE9ZpUxwxdoAMvtovBE7JIu%2B43n1JhhR1s%3D
Protocol: H2
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:50 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Tue, 06 Feb 2024 21:43:50 GMT
via: 1.1 google
referrer-policy: unsafe-url
vary: origin
access-control-allow-origin: https://freedomheadlines.com
location: https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&gpp=&gpp_sid=&b=1&g=0C2c34mmiPE9ZpUxwxdoAMvtovBE7JIu%2B43n1JhhR1s%3D
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 32B6 136 B
421 B 145ms
144ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

22cd820b748bdabf96448ca563642ddc782ba91756d5428113a23392839752ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:50 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 204 envelope Show response
api.rlcdn.com/api/identity/ Frame 32B6 0
282 B 146ms
73ms Fetch 34.107.165.188
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=13963
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.165.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 188.165.107.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:51 GMT
via: 1.1 google
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame 32B6 108 B
746 B 60ms
60ms Fetch
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=343asog&fmt=json
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: b14e05eb4aa41e1322997161fd678f0074472947a44a3fc92047a5c6f90622ab

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:51 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Thu, 07 Mar 2024 21:43:51 GMT

POST
H2 200 auction Show response
rtb.ex.co/openrtb2/ Frame 32B6 118 B
271 B 188ms
67ms Fetch
application/json 3.228.195.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.ex.co/openrtb2/auction
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.195.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-195-99.compute-1.amazonaws.com
Software: /
Resource Hash: 5eb613c6f5d92c251214a5acf4f2057bd8bc9c5d3b3ce2e559b818a070d329ef

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:51 GMT
access-control-allow-credentials: true
content-length: 118
vary: Origin
content-type: application/json

GET
H2

200

/
sync.ex.co/v1/setuid/openx/ Frame 073E
Redirect Chain

https://u.openx.net/w/1.0/cm?id=f0686912-7fb3-48f6-be19-4d168ad880c0&r=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fopenx%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D
https://u.openx.net/w/1.0/cm?cc=1&id=f0686912-7fb3-48f6-be19-4d168ad880c0&r=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fopenx%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D
https://sync.ex.co/v1/setuid/openx/?gdpr=0&gdpr_consent=&uid=70550cf6-83bd-4e59-9f2b-cce1d3c14d49

86 B
623 B

59ms
59ms

Image
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/openx/?gdpr=0&gdpr_consent=&uid=70550cf6-83bd-4e59-9f2b-cce1d3c14d49
Protocol: H2
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:51 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

date: Tue, 06 Feb 2024 21:43:51 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://sync.ex.co/v1/setuid/openx/?gdpr=0&gdpr_consent=&uid=70550cf6-83bd-4e59-9f2b-cce1d3c14d49
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 32B6 33 B
280 B 445ms
143ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

669592b1ed26ffd8c48dd35e98a21903e6e315409b6228b77941df013b4f7653

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:51 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2

200

/
sync.ex.co/v1/setuid/unruly/ Frame 073E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Funruly%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3346731785
https://sync.1rx.io/usersync/tradedesk/21b7045d-c254-48ac-9a8f-1cd489bb1d29
https://sync.targeting.unrulymedia.com/csync/RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005?redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Funruly%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DRX-d3f7ecf4-2a...
https://sync.ex.co/v1/setuid/unruly/?gdpr=0&gdpr_consent=&uid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005

86 B
708 B

59ms
58ms

Image
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/unruly/?gdpr=0&gdpr_consent=&uid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005
Protocol: H2
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:51 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

location: https://sync.ex.co/v1/setuid/unruly/?gdpr=0&gdpr_consent=&uid=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005
date: Tue, 06 Feb 2024 21:43:51 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXd3f7ecf42a194daea3f8a869ac0cc090005
content-type: text/html

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 94 KB
94 KB 89ms
88ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: a52dc0e8cb4811fa99f99179520a911342ebb59342896ae63b9dec7af7b08fb3

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=601224-697103

Response headers

Date: Tue, 06 Feb 2024 21:43:51 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 601224-697103/1662860
Connection: keep-alive
Content-Length: 95880
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129012
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame A7CC 7 B
796 B 247ms
59ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1---
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
Expires: 0

GET
H2

200

setuid Show response
sync.ex.co/v1/ Frame 525C
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3684&gdpr=0&gdpr_consent=
https://sync.ex.co/v1/setuid?bidder=freewheel&gdpr=0&gdpr_consent=&uid=8bc2e0bf78c720bb7afcfb846ae2f33

86 B
785 B

62ms
62ms

Document
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.ex.co/v1/setuid?bidder=freewheel&gdpr=0&gdpr_consent=&uid=8bc2e0bf78c720bb7afcfb846ae2f33
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin
content-length: 86
content-type: image/png
date: Tue, 06 Feb 2024 21:43:52 GMT
vary: Origin

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:51 GMT
Location: https://sync.ex.co/v1/setuid?bidder=freewheel&gdpr=0&gdpr_consent=&uid=8bc2e0bf78c720bb7afcfb846ae2f33
Pragma: no-cache
Server: nginx
x-sticky-vk: 1707255831917072-244

POST
H2 200 1235.json Show response
id5-sync.com/g/v2/ Frame 32B6 663 B
1 KB 438ms
148ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1235.json

Requested by

Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

3e8c981ee52329a201b2416726094aa5f005c820e0dfca1e2715f9ab23f6b121

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:51 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 54F7 2 KB
3 KB 58ms
57ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=3556157&p=158554&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 011f9fdedb0fbcbfc9e005843c941c9960629726310379a7a8f7442b815564c3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 21:43:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A6FA
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

65ms
64ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Tue, 06 Feb 2024 21:43:52 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 06E4
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU3570204f96444312948ac909cd28d01e

42 B
357 B

59ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU3570204f96444312948ac909cd28d01e
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU3570204f96444312948ac909cd28d01e
pragma: no-cache
server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame A943
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=TUy3AIwDDWSBAv9iGKjCZQ

42 B
309 B

58ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=TUy3AIwDDWSBAv9iGKjCZQ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 09:40:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=TUy3AIwDDWSBAv9iGKjCZQ
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0BF0
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=5750424730
https://sync.1rx.io/usersync3/mediamathtest/1508/3b4365c2-a815-4b00-a220-bc8d503f5683?zcc=0&sspret=1
https://sync.targeting.unrulymedia.com/csync/RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005

42 B
332 B

65ms
64ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-type: text/html
date: Tue, 06 Feb 2024 21:43:52 GMT
etag: RXd3f7ecf42a194daea3f8a869ac0cc090005
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-d3f7ecf4-2a19-4dae-a3f8-a869ac0cc090-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame F8C3 43 B
360 B 143ms
71ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Tue, 06 Feb 2024 21:43:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 2FE0 43 B
280 B 675ms
175ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Tue, 06 Feb 2024 21:43:52 GMT
Vary: Accept-Encoding
X-adserver-worker: leviathan-dfd66d1974d5@version_1.583
X-core-time: 0ms
X-server-arch: v2

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame E508 0
0 474ms
156ms Document
text/plain 162.55.120.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.55.120.196 Friedberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.196.120.55.162.clients.your-server.de

Software

nginx/1.23.3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Date: Tue, 06 Feb 2024 21:43:52 GMT
Server: nginx/1.23.3
Strict-Transport-Security: max-age=15768000

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E0EF
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1&gdpr=0&gdpr_consent=

1 B
53 B

64ms
64ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Tue, 06 Feb 2024 21:43:52 GMT
expires: Mon, 05 Feb 2024 21:43:52 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:3D73E86F3FA34461AD86F9585A54B5A1&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A91B
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7605422321657833951&uid=Q760542232165783...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7605422321657833951

42 B
95 B

65ms
64ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7605422321657833951
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=71281
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Tue, 06 Feb 2024 21:43:52 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7605422321657833951
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H2 200 / Show response
sync.ex.co/v1/setuid/pubmatic/ Frame E45B 0
685 B 59ms
58ms Document
text/html 3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.ex.co/v1/setuid/pubmatic/?gdpr=0&gdpr_consent=&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin
content-length: 0
content-type: text/html
date: Tue, 06 Feb 2024 21:43:52 GMT
vary: Origin

GET
H2

200

insync
thrtle.com/ Frame 54F7
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=D8375F6E-2B48-40AF-BB63-004D839E5C66&vxii_pid=12&vxii_pid1=10067&vxii_rcid=13ec2d1c-0206-428a-89b8-931171020608

43 B
296 B

62ms
62ms

Image
image/gif

3.224.184.174
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=D8375F6E-2B48-40AF-BB63-004D839E5C66&vxii_pid=12&vxii_pid1=10067&vxii_rcid=13ec2d1c-0206-428a-89b8-931171020608
Protocol: H2
Server: 3.224.184.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-184-174.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Tue, 06 Feb 2024 21:43:52 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=D8375F6E-2B48-40AF-BB63-004D839E5C66&vxii_pid=12&vxii_pid1=10067&vxii_rcid=13ec2d1c-0206-428a-89b8-931171020608
date: Tue, 06 Feb 2024 21:43:52 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame 54F7 43 B
163 B 58ms
55ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 Martin
crb.kargo.com/api/v1/dsync/ Frame 54F7 43 B
359 B 184ms
59ms Image
image/gif 3.229.60.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.229.60.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-229-60-255.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
x-accel-expires: 0
vary: Origin
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame 54F7 0
425 B 240ms
62ms Image
text/plain 52.6.216.119
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.216.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-216-119.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 06 Feb 2024 21:43:51 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1744205177370640382

42 B
468 B

64ms
63ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1744205177370640382
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:51 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1744205177370640382
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 54F7
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:60b2c46e-076a-40a9-9dc1-1b62efd34037&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

66ms
63ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:60b2c46e-076a-40a9-9dc1-1b62efd34037&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 06 Feb 2024 21:43:52 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:60b2c46e-076a-40a9-9dc1-1b62efd34037&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Tue, 06 Feb 2024 21:43:52 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2

200

/
sync.ex.co/v1/setuid/appnexus/ Frame 073E
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fappnexus%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://sync.ex.co/v1/setuid/appnexus/?gdpr=0&gdpr_consent=&uid=6053676651067766727

86 B
859 B

60ms
59ms

Image
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/appnexus/?gdpr=0&gdpr_consent=&uid=6053676651067766727
Protocol: H2
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:52 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
an-x-request-uuid: 5534f436-7e4e-4a93-82eb-dab063f684d1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://sync.ex.co/v1/setuid/appnexus/?gdpr=0&gdpr_consent=&uid=6053676651067766727
x-proxy-origin: 38.132.118.68; 38.132.118.68; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
sync.ex.co/v1/ Frame A7CC
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17136_2&us_privacy=1---&khaos=LSAW1IVL-1S-KWQ5
https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LSAW1IVL-1S-KWQ5&us_privacy=1---

86 B
927 B

61ms
61ms

Image
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LSAW1IVL-1S-KWQ5&us_privacy=1---
Protocol: H2
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:52 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LSAW1IVL-1S-KWQ5&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A7CC
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1---
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MzcyYmIxODNiNDlkZDE4Mzg4YTZmMzdhOTU1NDNiZmQ0MzRhZjBhMA&us_privacy=1---

170 B
188 B

85ms
84ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MzcyYmIxODNiNDlkZDE4Mzg4YTZmMzdhOTU1NDNiZmQ0MzRhZjBhMA&us_privacy=1---

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MzcyYmIxODNiNDlkZDE4Mzg4YTZmMzdhOTU1NDNiZmQ0MzRhZjBhMA&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5e07703167439847c6c49a939083c0fd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7CC
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=&expires=30

42 B
889 B

233ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=&expires=30
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=21b7045d-c254-48ac-9a8f-1cd489bb1d29&gdpr=0&gdpr_consent=&expires=30
date: Tue, 06 Feb 2024 21:43:52 GMT
server: Kestrel
content-length: 289

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame A7CC 43 B
855 B 525ms
222ms Image
image/gif 67.220.226.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1---

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.226.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:52 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QVCXMGQE3C1ZP57ANDGG
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A7CC
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1---
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFNBVzFJVkwtMVMtS1dRNQ==&us_privacy=1---
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEdJqQvz94TM5Mg26VKOkd8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFNBVzFJVkwtMVMtS1dRNQ==&google_push=

170 B
188 B

83ms
82ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFNBVzFJVkwtMVMtS1dRNQ==&google_push=

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFNBVzFJVkwtMVMtS1dRNQ==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A7CC
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1---
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=llZyHoWLRdWCtzhEj6AI6A&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=llZyHoWLRdWCtzhEj6AI6A

43 B
479 B

69ms
65ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=llZyHoWLRdWCtzhEj6AI6A

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:52 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: GDNRVC3YBJF1BN55TXTD
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=llZyHoWLRdWCtzhEj6AI6A
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7CC
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1---
https://pr-bh.ybp.yahoo.com/sync/rubicon/bWNnByDcCk2g2ujMgEtzrcn5EUdSAgOZEtemQ7w0kco?csrc=&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-eUQsgY1E2oLWfIMwZgufyiNx7JhjPU.yNWLC9g--~A

42 B
889 B

111ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-eUQsgY1E2oLWfIMwZgufyiNx7JhjPU.yNWLC9g--~A
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 06 Feb 2024 21:43:52 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-eUQsgY1E2oLWfIMwZgufyiNx7JhjPU.yNWLC9g--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A7CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1---
https://s.amazon-adsystem.com/ecm3?id=LSAW1IVL-1S-KWQ5&ex=d-rubiconproject.com&status=ok&us_privacy=1---

43 B
479 B

65ms
65ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LSAW1IVL-1S-KWQ5&ex=d-rubiconproject.com&status=ok&us_privacy=1---

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:52 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZME8ADN0KF925BJV6PYE
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LSAW1IVL-1S-KWQ5&ex=d-rubiconproject.com&status=ok&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7CC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELQ_gy8V4EFJZs4ZGx2bf2c&google_cver=1

42 B
889 B

212ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELQ_gy8V4EFJZs4ZGx2bf2c&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELQ_gy8V4EFJZs4ZGx2bf2c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame A7CC
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1---
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LSAW1IVL-1S-KWQ5&us_privacy=1---

0
512 B

213ms
142ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LSAW1IVL-1S-KWQ5&us_privacy=1---
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 7E9409EA76654B96AF615B272A53FEFE Ref B: MIAEDGE2717 Ref C: 2024-02-06T21:43:52Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYQvXlv1NufpkADargYeg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LSAW1IVL-1S-KWQ5&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7CC
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAlQk7LhVAAABJLN_3KsQ&expires=30

42 B
889 B

232ms
58ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAlQk7LhVAAABJLN_3KsQ&expires=30
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAAlQk7LhVAAABJLN_3KsQ&expires=30
Date: Tue, 06 Feb 2024 21:43:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

pixel
capi.connatix.com/us/ Frame A7CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1---
https://capi.connatix.com/us/pixel?puid=LSAW1IVL-1S-KWQ5&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1---
https://capi.connatix.com/us/pixel?puid=LSAW1IVL-1S-KWQ5&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1---&final=true

82 B
82 B

85ms
84ms

Image
image/gif

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LSAW1IVL-1S-KWQ5&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1---&final=true
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:52 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 85169239995d228a-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 06 Feb 2024 21:43:52 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://capi.connatix.com/us/pixel?puid=LSAW1IVL-1S-KWQ5&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1---&final=true
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 85169239085e228a-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame A7CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1---
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LSAW1IVL-1S-KWQ5&us_privacy=1---
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LSAW1IVL-1S-KWQ5
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LSAW1IVL-1S-KWQ5&ckls=true&ci=t7UaZAI2b0&nc=false&trid=1343600630

43 B
1 KB

235ms
108ms

Image
image/gif

13.224.214.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LSAW1IVL-1S-KWQ5&ckls=true&ci=t7UaZAI2b0&nc=false&trid=1343600630
Protocol: H2
Server: 13.224.214.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-214-95.phl50.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:53 GMT
via: 1.1 55d59f6fe20d812e375923d2e18ac7fc.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
x-cache: Miss from cloudfront
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: 4A-UZGNNWl2FE7lFNRBRAgk9NeyPaRhwzyB1YCECDofVuydVUKEhJg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
via: 1.1 7b684daf68830c24a645afbee86b35aa.cloudfront.net (CloudFront)
x-amz-cf-pop: MIA3-C5
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LSAW1IVL-1S-KWQ5&ckls=true&ci=t7UaZAI2b0&nc=false&trid=1343600630
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: QH6iTcFHP_oYPOsABe37z4FEo6zXlv3otxTVIqM5QtKlG2bOlkxACw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame A7CC
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1&us_privacy=1---
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LSAW1IVL-1S-KWQ5&us_privacy=1---

95 B
124 B

51ms
51ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LSAW1IVL-1S-KWQ5&us_privacy=1---

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:52 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LSAW1IVL-1S-KWQ5&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 29af2665c43893332e84c235bac366c1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

merge
ce.lijit.com/ Frame A7CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&us_privacy=1---
https://ce.lijit.com/merge?pid=80&3pid=LSAW1IVL-1S-KWQ5&us_privacy=1---

43 B
483 B

190ms
59ms

Image
image/gif

54.236.130.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LSAW1IVL-1S-KWQ5&us_privacy=1---
Protocol: H2
Server: 54.236.130.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-130-106.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
content-type: image/gif

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LSAW1IVL-1S-KWQ5&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1df09169f58a071f2a391dff1b3307b
Expires: 0

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame A7CC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&us_privacy=1---
https://prebid.a-mo.net/setuid/magnite?uid=LSAW1IVL-1S-KWQ5&us_privacy=1---

0
451 B

196ms
61ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LSAW1IVL-1S-KWQ5&us_privacy=1---
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:52 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LSAW1IVL-1S-KWQ5&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A7CC
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4d0c2158-e5c9-4d72-89a6-012d679159ca&expires=30&us_privacy=1---

42 B
889 B

59ms
59ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4d0c2158-e5c9-4d72-89a6-012d679159ca&expires=30&us_privacy=1---
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=4d0c2158-e5c9-4d72-89a6-012d679159ca&expires=30&us_privacy=1---
Date: Tue, 06 Feb 2024 21:43:52 GMT
Connection: keep-alive
X-CI-RTID: 77a2eee1-9056-4ed4-af56-d1299921ab01
Content-Length: 164
Content-Type: text/html; charset=utf-8

GET
H2

200

/
sync.ex.co/v1/setuid/sundaysky/ Frame 073E
Redirect Chain

https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsundaysky%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7Bssky_uuid%7D
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsundaysky%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7Bssky_uuid%7D&_cvt=t
https://sync.ex.co/v1/setuid/sundaysky/?gdpr=0&gdpr_consent=&uid=d6.d90cbc4eb052486e9ed7b38a7155d62d

86 B
1008 B

59ms
58ms

Image
image/png

3.226.186.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/sundaysky/?gdpr=0&gdpr_consent=&uid=d6.d90cbc4eb052486e9ed7b38a7155d62d
Protocol: H2
Server: 3.226.186.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-186-188.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
date: Tue, 06 Feb 2024 21:43:52 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

location: https://sync.ex.co/v1/setuid/sundaysky/?gdpr=0&gdpr_consent=&uid=d6.d90cbc4eb052486e9ed7b38a7155d62d
date: Tue, 06 Feb 2024 21:43:52 GMT
x-content-type-options: nosniff
content-length: 0
x-frame-options: DENY

POST
H2 204 events
e.channelexco.com/ 0
246 B 67ms
67ms Ping
text/plain 23.19.226.131
LEASEWEB-USA-NYC

General

Check archive.org

Show headers Download Go to

Full URL: https://e.channelexco.com/events
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.19.226.131 New York, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:52 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 54F7 0
128 B 59ms
59ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=158554&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:54 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 88 KB
89 KB 66ms
65ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 8a96da33a7d75326969fff34c14feb881b5b181eb2405168a3be3c7257548e79

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=697104-787719

Response headers

Date: Tue, 06 Feb 2024 21:43:55 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 697104-787719/1662860
Connection: keep-alive
Content-Length: 90616
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129008
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

POST
H2 200 events Show response
collector-1.ex.co/main/ 17 B
154 B 65ms
61ms XHR
application/json 3.226.119.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-1.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.119.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-119-3.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:56 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

POST
H2 200 events Show response
collector-1.ex.co/main/ 17 B
154 B 76ms
74ms XHR
application/json 3.226.119.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-1.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.119.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-119-3.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:56 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H2 200 wrapper.html Show response
wrappers.geoedge.be/ 3 KB
4 KB 248ms
65ms Fetch
text/html 2600:9000:25c8:7000:2:d490:4d80:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://wrappers.geoedge.be/wrapper.html
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25c8:7000:2:d490:4d80:93a1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 68de9947c014ba26a1d48132dc5a94697f4c575972d2944da8e496f5780fd7b2

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 05 Feb 2024 22:15:22 GMT
x-amz-version-id: SIv.6LiuODikErkt8hGkZr.zJWI3NFp8
via: 1.1 09271a32d559aa027d52f6c914ebff78.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL51-P1
age: 84516
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 3527
last-modified: Tue, 19 Dec 2023 13:15:23 GMT
server: AmazonS3
etag: "6a6d57dbabaa297544a761a67d32156f"
access-control-allow-methods: GET
content-type: text/html
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: vNPup4-7KXXcNndE1FDCGH2G91a7mSvgxnGfGWuzWY31IYNkWu5Vng==

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/c2f70d6c-41d6-4133-8d0e-bd5fbd5557b5/ 690 KB
226 KB 250ms
76ms Script
text/javascript 2600:9000:247b:6c00:4:b37b:9440:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/c2f70d6c-41d6-4133-8d0e-bd5fbd5557b5/grumi.js
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:6c00:4:b37b:9440:93a1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1dcc8475a2104d34d327e884cbd54e9fddba70de71131aa7d695d42047fa1bb8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:39:59 GMT
x-amz-version-id: hT_DxuiKyzWBq63H.hGfdi9.6XRtUloN
content-encoding: br
via: 1.1 38385695b10551583d750b943a475982.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P2
age: 239
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 06 Feb 2024 21:18:51 GMT
server: AmazonS3
etag: W/"1e2e924324ef88e10c83a54527ff88ea"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
timing-allow-origin: *
x-amz-cf-id: ByZIsrpGj14r7ZP7XhMp9FZxlIvdie7AgjVWzeWrQC2k00-yGNcBzQ==

GET

b
c3.a-mo.net/
Redirect Chain

https://id.a-mx.com/sync/?tagId=&ref=null&u=https://freedomheadlines.com/freedom-wire/eyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall/?utm_medium=email&utm_sour...
https://c3.a-mo.net/b?uid=e7d46c0d-a65a-4425-a238-00a0537c0761&sh=id.a-mx.com&

0
0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 254 B
1 KB 136ms
135ms Fetch
application/json 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

118badcbb4d5ae6ab17afc35807665d479f1602dbb456f05c33e7ec384eab517

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:57 GMT
an-x-request-uuid: 85fa0a7d-86ad-4c35-870e-126d43ec2be4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 254
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
119 B 204ms
67ms Fetch 104.36.115.111

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:56 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
199 B 196ms
81ms Fetch 74.119.119.129

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.17.0&cb=25346576690&lsavail=1

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.129 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:56 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
252 B 150ms
48ms Fetch
text/plain 35.227.252.103

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 047636d2152e78f27f74a5ff03c8ac76131fa4ded2aef7d4bd61a52a7c083e00

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:57 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H/1.1 200
OK hb Show response
cpm.vuukle.net/ 219 B
501 B 240ms
68ms Fetch
application/json 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://cpm.vuukle.net/hb?zone=180530&v=1.6
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 5b8ecf134c4d2b51e7fa53fbc230ab20da565f4f24006327cf5bb89f8ba77361

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 06 Feb 2024 21:43:57 GMT
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://freedomheadlines.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 219

POST
H2 200 bid Show response
ap.lijit.com/rtb/ 24 B
590 B 61ms
60ms Fetch
application/json 3.224.33.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_8.17.0
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.33.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-33-5.compute-1.amazonaws.com
Software: /
Resource Hash: 437710f4926173b4c855ea36110fcf936b0364e96dff64a55ede81288763e465

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:57 GMT
vary: Accept-Encoding, User-Agent
access-control-allow-methods: GET, POST, DELETE, PUT
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 24

POST
H2 200 c Show response
prebid.a-mo.net/a/ 918 B
725 B 85ms
84ms Fetch
application/json 147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: c40dd4d3e08c2f92c1df1e98dae0a5cb6f27a1a3636e2b35eeb2ba9ff4e00f9f

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 06 Feb 2024 21:43:56 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
content-length: 458

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 155 KB
23 KB 542ms
541ms Fetch
text/plain 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=639364087958558&correlator=4330935735238701&eid=31079956%2C31080782%2C95323523%2C31080339%2C31080925%2C44807747%2C31079525%2C31080115&output=ldjh&gdfp_req=1&vrg=202402050101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=213794966%3A21770807447%2Cvuukle-widget%2Cfreedomheadlines.com%2Cfreedomheadlines.com-2&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3&prev_iu_szs=250x250%7C300x250%7C320x100%7C320x50%7C336x280%7C400x300%2C250x250%7C300x250%7C320x100%7C320x50%7C336x280%7C400x300&ifi=10&didk=2180070807~2180070806&sfv=1-0-40&eri=4&sc=1&cookie=ID%3D782a09762c378a37%3AT%3D1707255827%3ART%3D1707255827%3AS%3DALNI_Ma8PcVxcKrmz4g-wSrRRuVPYnnVpw&gpic=UID%3D00000a0bc98f4aec%3AT%3D1707255827%3ART%3D1707255827%3AS%3DALNI_MZbBM568W1z0pESSrWuS5P5HofqhQ&abxe=1&dt=1707255837286&adxs=485%2C485&adys=1703%2C3068&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3%7C4&ucis=a%7Cb&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&vis=1&psz=250x330%7C250x330&msz=250x0%7C250x0&fws=4%2C4&ohw=250%2C250&ga_vid=1766293042.1707255827&ga_sid=1707255827&ga_hid=1426236456&ga_fc=true&a3p=EhoKDWNyd2RjbnRybC5uZXQSABibmIKD2DFIABIbCgwzM2Fjcm9zcy5jb20Yv5SCg9gxSABSAghkEhkKCnB1YmNpZC5vcmcY85WCg9gxSABSAghqEhcKCHJ0YmhvdXNlGNuWgoPYMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRi_lIKD2DFIAFICCGQSGQoKdWlkYXBpLmNvbRi_lIKD2DFIAFICCGQSFAoFb3BlbngY9pWCg9gxSABSAghvEhsKDGlkNS1zeW5jLmNvbRi3mYKD2DFIAFICCGo.&cbidsp=Ct8BCAESGQoIYXBwbmV4dXMQjwEgAlIIYXBwbmV4dXMSGQoIcHVibWF0aWMQ0AEgAlIIcHVibWF0aWMSFQoGY3JpdGVvEMoBIAJSBmNyaXRlbxITCgVvcGVueBCaASACUgVvcGVueBIZCghhZGtlcm5lbBD0ASACUghhZGtlcm5lbBISCgVzb3ZybhBBIAJSBXNvdnJuEg4KA2FteBBZIAJSA2FteBgCIiRkMzZkYjczMS1jYzQ0LTQ1ZGItYmQ0OS1hNjFiM2RhMDg5ZDUqBAgDIAAyB3Y4LjE3LjBA3AtKAA..~Ct8BCAESGQoIYXBwbmV4dXMQjwEgAlIIYXBwbmV4dXMSGQoIcHVibWF0aWMQ0AEgAlIIcHVibWF0aWMSFQoGY3JpdGVvEMoBIAJSBmNyaXRlbxITCgVvcGVueBCaASACUgVvcGVueBIZCghhZGtlcm5lbBD0ASACUghhZGtlcm5lbBISCgVzb3ZybhBBIAJSBXNvdnJuEg4KA2FteBBZIAJSA2FteBgCIiQwMjY1ODVhOC1kZmZiLTQ0NWItOWMzNC05M2Q4NzM4ODE1ZDcqBAgDIAAyB3Y4LjE3LjBA3AtKAA..&dlt=1707255825481&idt=1090&prev_scp=adInView%3D0-24%2525%26impressionViewable%3D0%26refreshIteration%3D0%7CadInView%3D0-24%2525%26impressionViewable%3D0&cust_params=isArticleBrandSafe%3Dnull%26url%3Dhttps%253A%252F%252Ffreedomheadlines.com%252Ffreedom-wire%252Feyewitness-to-killing-of-run-dmcs-jam-master-jay-tells-jury-then-i-see-jay-just-fall%252F%253Futm_medium%253Demail%2526utm_source%253Dsparkpost%2526utm_campaign%253Dregular%26words%3Dfreedom%252Cwire%252Ceyewitness%252Cto%252Ckilling%252Cof%252Crun%252Cdmcs%252Cjam%252Cmaster%252Cjay%252Ctells%252Cjury%252Cthen%252Ci%252Csee%252Cjay%252Cjust%252Cfall%26commit%3Db80395ae89cc5d151fdb686b38478c248d9fba9f%26unblockia%3D0%26source%3Ddirect_internal%26CMP_accepted%3D1%26geo%3DUS%26device%3DDesktop%26utm_source%3Dsparkpost%26utm_medium%3Demail%26utm_campaign%3Dregular%26order%3D7%26api_key%3D92fd8992-dbb2-4d42-9cc3-1b8101c44b9b&adks=2278928111%2C596273846&frm=20&eo_id_str=ID%3D0dbfd087b9d3e7a7%3AT%3D1707255827%3ART%3D1707255827%3AS%3DAA-AfjaFFQGH4i3qGeVtExt4yNXn

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3a424758b4b5e89d7701ef58b095994581f990b212599fb0afb95e46e96fe8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:57 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23803
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 events Show response
collector.ex.co/main/ 17 B
155 B 201ms
66ms XHR
application/json 52.54.129.37

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.129.37 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:57 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H3 200 container.html Show response
f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C86B 6 KB
3 KB 64ms
64ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 10
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:47 GMT
expires: Wed, 05 Feb 2025 21:43:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7FE6 6 KB
3 KB 63ms
63ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402050101/pubads_impl.js?cb=31080925

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 10
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:43:47 GMT
expires: Wed, 05 Feb 2025 21:43:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame C86B 8 KB
750 B 79ms
79ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 20:36:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:57 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/ Frame C86B 15 KB
3 KB 66ms
63ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.css

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f9ca7029ca2c95d204079575a3e5f737ef4d322614225344c5aeadd51bfb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 05:49:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57250
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2939
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 02:36:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 05:49:47 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/ Frame C86B 378 KB
132 KB 69ms
66ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

325f25191af82345cc615c820126c663f55ee865ccb8c6f033e11ee57085617a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:15:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 476937
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134582
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 02:36:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 31 Jan 2025 09:15:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame C86B 20 KB
8 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:14:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80997
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:14:00 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame C86B 24 KB
6 KB 66ms
66ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:16:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 476858
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 31 Jan 2025 09:16:19 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7FE6 8 KB
751 B 79ms
79ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 21:43:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 19:55:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 21:43:57 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/ Frame 7FE6 15 KB
3 KB 194ms
191ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.css

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f9ca7029ca2c95d204079575a3e5f737ef4d322614225344c5aeadd51bfb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 05:49:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57250
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2939
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 02:36:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 05:49:47 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/ Frame 7FE6 378 KB
132 KB 194ms
192ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

325f25191af82345cc615c820126c663f55ee865ccb8c6f033e11ee57085617a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:15:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 476937
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134582
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 02:36:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 31 Jan 2025 09:15:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 7FE6 20 KB
8 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0899097f526aab0c82c4332c8dd24d4041cb5fbde0638d98e883e159ecbe2a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 23:14:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80997
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8501
x-xss-protection: 0
server: cafe
etag: 9351358253902147912
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Feb 2024 23:14:00 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7FE6 0
0 83ms
82ms Image
text/html 2607:f8b0:4006:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQZooZbsgJyxz3--AcX8MOSYm0guxo9oI_1io28Rbuo7DM8zh-tExQg7I4UKW0BVZRegv7csd1c8l_FobunjgMfB6Hb7w
Requested by: Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 7FE6 24 KB
6 KB 68ms
67ms Script
text/javascript 2607:f8b0:4006:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 09:16:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 476858
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 31 Jan 2025 09:16:19 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C86B 0
17 B 144ms
143ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lsaw1nm5&c=8738326723654&slotId=4369163361827&qqid=CIO36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C86B 15 KB
16 KB 65ms
65ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 16:28:28 GMT
x-content-type-options: nosniff
age: 18930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 16:28:28 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C86B 15 KB
15 KB 67ms
66ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 04:14:19 GMT
x-content-type-options: nosniff
age: 581379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jan 2025 04:14:19 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C86B 0
20 B 124ms
124ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CDNqdHajCZcO0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAcgDAqoEwwJP0IgMGTWVNwHlda3Apw7sVgWYAUhP76IY5FyQmm6gdznx5Oe4-9w5BTZTOnAVw-MSj6Sn0a0KoPoynB6AukTNW5jPHDJYyMVMbJLkdSQybq2WzqLOlKgtIJiJtRep6woILlMb8LmpbPz7Rd2bUheoUJ5oTd5WHKSNC3XOsV9y9YF3GjdT5AszmnCzl5-MgyQwVkTqJTI1_-VkeWQQYdOLQWoBieSC-jusUPvj0KEyNR2zjur8GOFC235GM-2feTsLLquzNkXY97bEsDGpCsmIHHm9SGVpDbVlSp8PkMyE76t4VNgz7p6br1z4GRSrEynEZnbIlZOBJvDaUWKvzkLNFmxdA_zoXb4PL4eK7BTrYQzGlvmTDeJCzIWGtoD3EUD8bFGCwrPt3aEqVYC0KEkWC1-OHfTo2huf9i4j1TVy9Q2XgOAEAYAGho6IuO7566uQAaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCCIIgGEQATICigI6CYBAgMCAgICACEi9_cE6WKT-5s3Xl4QD-gsCCAGADAHiDRMI88rnzdeXhAMVBQ_QBB1RJgG00BUBgBcB&eventType=clickstring&clientTime=1707255838173&ai=CDNqdHajCZcO0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAcgDAqoEwwJP0IgMGTWVNwHlda3Apw7sVgWYAUhP76IY5FyQmm6gdznx5Oe4-9w5BTZTOnAVw-MSj6Sn0a0KoPoynB6AukTNW5jPHDJYyMVMbJLkdSQybq2WzqLOlKgtIJiJtRep6woILlMb8LmpbPz7Rd2bUheoUJ5oTd5WHKSNC3XOsV9y9YF3GjdT5AszmnCzl5-MgyQwVkTqJTI1_-VkeWQQYdOLQWoBieSC-jusUPvj0KEyNR2zjur8GOFC235GM-2feTsLLquzNkXY97bEsDGpCsmIHHm9SGVpDbVlSp8PkMyE76t4VNgz7p6br1z4GRSrEynEZnbIlZOBJvDaUWKvzkLNFmxdA_zoXb4PL4eK7BTrYQzGlvmTDeJCzIWGtoD3EUD8bFGCwrPt3aEqVYC0KEkWC1-OHfTo2huf9i4j1TVy9Q2XgOAEAYAGho6IuO7566uQAaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCCIIgGEQATICigI6CYBAgMCAgICACEi9_cE6WKT-5s3Xl4QD-gsCCAGADAHiDRMI88rnzdeXhAMVBQ_QBB1RJgG00BUBgBcB

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C86B 0
17 B 143ms
142ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lsaw1nmn&c=8738326723654&slotId=4369163361827&qqid=CIO36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.p0&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast.php Show response
ads.us.criteo.com/delivery/r/0.1/ Frame C86B 15 KB
8 KB 187ms
70ms XHR
text/xml 2620:100:a001::24

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/0.1/vast.php?z=ZcKoHQAF2kME0A8FAAEmUdhy7jrPYBQWRrIAHg&u=%7CtFUEeHyoGwBggOxkG6kWPGPem6OXzItV8Nj3ZlgTRJI%3D%7C&c1=f2W0RUnQkd6rCVE6Tntl32jl-mPPyuUuyQZonjyXDKlD0b1dfK7poBRhKM_JesoPMAjnihU6wS2a3_Z0yq468ElusM1tNpUm6qzBtxVgOGSiCLR03-st3fJkCsiC9AsdQ7xtveWhpz3u3LO7BSJckPyxR6AkDSG09DgOpZjiRcOwknUnCt5qIi1mvRVDmmBjhNhxaLeaRuYI8ZRHwvPdwTa3JqB6twytItq4VFQ7uMEbrHpTfq3J34z5miTsow9xtsZk5JGTfnf6Q0PzydG3v7E_MKzfGQESO14qmaN8u2DXnnCwixuibGYmfjC05RAsvrWXBi7A1k3wa-KBjhpM5C5DjFFLgl3pknh3uXREGkWz0B2q8WS9cgB1iAKvBw93kLH1mTzVCkXXrygdLtX8Ab_1aLAZeIol-uXb2Xl4URLzz8rG_k501Wj0wWzJLE0pi-3hIqfsfzK4HuBuUSYYZ5UemDY86gu-0rgEVz62mvrfhTXJCCMk9zTcPL564JdltSqqZPeNLJuhm3JVU-GcwUEVhkabYYLfECx6zQQ0LoCo_4ypbTsOKPX7nJXz1VjiuRRYJM4IuFQASXm0FkH8gDbiS6HDtQ-5c1ZFrEhGZCwF-7N6if9Hl4Sf-M4SGps4GDMN679kFnnk3FpCmJgTpzYmRgdZ8YuoKHdGqIhnERw&ct0=https://googleads.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDNqdHajCZcO0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAcgDAqoEwwJP0IgMGTWVNwHlda3Apw7sVgWYAUhP76IY5FyQmm6gdznx5Oe4-9w5BTZTOnAVw-MSj6Sn0a0KoPoynB6AukTNW5jPHDJYyMVMbJLkdSQybq2WzqLOlKgtIJiJtRep6woILlMb8LmpbPz7Rd2bUheoUJ5oTd5WHKSNC3XOsV9y9YF3GjdT5AszmnCzl5-MgyQwVkTqJTI1_-VkeWQQYdOLQWoBieSC-jusUPvj0KEyNR2zjur8GOFC235GM-2feTsLLquzNkXY97bEsDGpCsmIHHm9SGVpDbVlSp8PkMyE76t4VNgz7p6br1z4GRSrEynEZnbIlZOBJvDaUWKvzkLNFmxdA_zoXb4PL4eK7BTrYQzGlvmTDeJCzIWGtoD3EUD8bFGCwrPt3aEqVYC0KEkWC1-OHfTo2huf9i4j1TVy9Q2XgOAEAYAGho6IuO7566uQAaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCCIIgGEQATICigI6CYBAgMCAgICACEi9_cE6WKT-5s3Xl4QD-gsCCAGADAHiDRMI88rnzdeXhAMVBQ_QBB1RJgG00BUBgBcB%26num%3D1%26sig%3DAOD64_14jnPZF4VoPgPLUyYi_6R9bYeEtQ%26client%3Dca-pub-3494520468788589%26adurl%3D

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

c24291973bdabd5ca608f2b9a7f6ce83d38a845d865855e1ab024f0ed9d7b715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
p3p: CP='CUR ADM OUR NOR STA NID'
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4246769
pragma: no-cache
server: Kestrel
access-control-max-age: 1000
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/xml
access-control-allow-origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
vary: Origin,Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 78E8 1 KB
643 B 65ms
64ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 572
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:34:26 GMT
etag: 48472445140208031
expires: Wed, 07 Feb 2024 21:34:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C86B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc0a6244294990f3dd1fea09ab6c822113c6d590d4a6f219fdd753e6400752b1

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 csi
csi.gstatic.com/ Frame 7FE6 0
17 B 143ms
143ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lsaw1nnv&c=5160731835731&slotId=2580365917865.5&qqid=CIS36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 7FE6 15 KB
16 KB 65ms
64ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 16:28:28 GMT
x-content-type-options: nosniff
age: 18930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 16:28:28 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 7FE6 15 KB
15 KB 89ms
89ms Font
font/woff2 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 04:14:19 GMT
x-content-type-options: nosniff
age: 581379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Jan 2025 04:14:19 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7FE6 0
20 B 125ms
125ms Image
image/gif 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=C6oZdHajCZcS0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAcgDAqoExQJP0Di9qvBC_tdBgNwND397CAS-KNztkMedaR-2S7c8mUvstLcJI_O7ByojIEiLHa8ce0N6FhYOe0BkTaB_Pkcw8OPouT87BZSLgKMog6pv1-NldX5Jq5nEwFzB0P-3aTECfOYL9j5bps6L7-7knY5_mJKg_j5Aow-O2xxWKP8Li0KL4DXdFBQCp8F6ioxsEEQOpEGaNmn29FDRu18Kvivpwi0FQKKl4eWMuGYJZC8SjJMAI7cZeodTrKNlE0cWDl9eNHYLmrKxYsNHdYSv_-ncJzqZkQN2AVmCqN5RXAmO_BlRtjRwn2G4J4upD27lzh6f1tBGWeKecpvVmorjD0JJSSIlqoxaEHpMaNdSTrHbWrNUH5kxeIPY6mq9pKSeUQ0_8Q5OoFpuSiasiYIjDIIZzb4P6L1PkPSxa02uHwzLEIOUwKDw4AQBgAaGjoi47vnrq5ABoAYqqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIIgiAYRABMgKKAjoJgECAwICAgIAISL39wTpYpP7mzdeXhAP6CwIIAYAMAeINEwj0yufN15eEAxUFD9AEHVEmAbTQFQGAFwE&eventType=clickstring&clientTime=1707255838229&ai=C6oZdHajCZcS0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAcgDAqoExQJP0Di9qvBC_tdBgNwND397CAS-KNztkMedaR-2S7c8mUvstLcJI_O7ByojIEiLHa8ce0N6FhYOe0BkTaB_Pkcw8OPouT87BZSLgKMog6pv1-NldX5Jq5nEwFzB0P-3aTECfOYL9j5bps6L7-7knY5_mJKg_j5Aow-O2xxWKP8Li0KL4DXdFBQCp8F6ioxsEEQOpEGaNmn29FDRu18Kvivpwi0FQKKl4eWMuGYJZC8SjJMAI7cZeodTrKNlE0cWDl9eNHYLmrKxYsNHdYSv_-ncJzqZkQN2AVmCqN5RXAmO_BlRtjRwn2G4J4upD27lzh6f1tBGWeKecpvVmorjD0JJSSIlqoxaEHpMaNdSTrHbWrNUH5kxeIPY6mq9pKSeUQ0_8Q5OoFpuSiasiYIjDIIZzb4P6L1PkPSxa02uHwzLEIOUwKDw4AQBgAaGjoi47vnrq5ABoAYqqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIIgiAYRABMgKKAjoJgECAwICAgIAISL39wTpYpP7mzdeXhAP6CwIIAYAMAeINEwj0yufN15eEAxUFD9AEHVEmAbTQFQGAFwE

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 7FE6 0
17 B 142ms
142ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lsaw1no6&c=5160731835731&slotId=2580365917865.5&qqid=CIS36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.qd&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast.php Show response
ads.us.criteo.com/delivery/r/0.1/ Frame 7FE6 15 KB
8 KB 187ms
114ms XHR
text/xml 2620:100:a001::24

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/0.1/vast.php?z=ZcKoHQAF2kQE0A8FAAEmUSNGxm55MdDFxx-RcQ&u=%7CtFUEeHyoGwA0sRBU44nTuG0EQOg08q9hClvs6nKYRJo%3D%7C&c1=f2W0RUnQkd6rCVE6Tntl32jl-mPPyuUuyQZonjyXDKlD0b1dfK7poBRhKM_JesoPMAjnihU6wS2a3_Z0yq468ElusM1tNpUm6qzBtxVgOGSiCLR03-st3fJkCsiC9Asdlm-NrqWVNyZRbvclxtgzJ03jRg4no4o9Q-kKtWNtxDljI2TOYQyvEOtKdWMFAJeCAm7sN1-mzJoO8q6EcxI5uwWMWy9_Vm3QL1ro0Tx-Nod4-L6yZm2h0H9b2jlrwoXQ4p7-CrCMlhVti6OMkEt-7eaPpVCaCkkfBEKOM30Nzs3LS9E2_OX7XboTV5kPZv4U_wfQ_du22pVCTJ_LTELo2Bm82zw_SeuDbxp_MoZr70vmxj2uZuPP3k2hVPazI4lTWBFT4hHFDxjoi4w6Jd18mNph8uocOSwFyiJTuJ6MhDhR7HCTQncqu3ZZTo87JmhECtBFKbwxWqJD2c69ThUJK_lqBadVa7we0HQ2hkKI1l5YfAFooqcxq67e2NP6cDGv49Q--4yxMnMNh-pONdjH8sH19333cnVOSwEZnY3KuabJ_yhSf6aeE9zGS6lLHm9QbeD47HwSN6F457HFyHUjFuaVuobbJpgus2koQIBAQ1t3AoiJYoyIlMEIawK6aN0Jdi_5rBjT7ljUaRjo9m51aXUOfi18NLvTva7e3w9pgDU&ct0=https://googleads.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC6oZdHajCZcS0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAcgDAqoExQJP0Di9qvBC_tdBgNwND397CAS-KNztkMedaR-2S7c8mUvstLcJI_O7ByojIEiLHa8ce0N6FhYOe0BkTaB_Pkcw8OPouT87BZSLgKMog6pv1-NldX5Jq5nEwFzB0P-3aTECfOYL9j5bps6L7-7knY5_mJKg_j5Aow-O2xxWKP8Li0KL4DXdFBQCp8F6ioxsEEQOpEGaNmn29FDRu18Kvivpwi0FQKKl4eWMuGYJZC8SjJMAI7cZeodTrKNlE0cWDl9eNHYLmrKxYsNHdYSv_-ncJzqZkQN2AVmCqN5RXAmO_BlRtjRwn2G4J4upD27lzh6f1tBGWeKecpvVmorjD0JJSSIlqoxaEHpMaNdSTrHbWrNUH5kxeIPY6mq9pKSeUQ0_8Q5OoFpuSiasiYIjDIIZzb4P6L1PkPSxa02uHwzLEIOUwKDw4AQBgAaGjoi47vnrq5ABoAYqqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIIgiAYRABMgKKAjoJgECAwICAgIAISL39wTpYpP7mzdeXhAP6CwIIAYAMAeINEwj0yufN15eEAxUFD9AEHVEmAbTQFQGAFwE%26num%3D1%26sig%3DAOD64_0QXhKc34h7nMD8yoTfPk4P2RjSAg%26client%3Dca-pub-3494520468788589%26adurl%3D

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

ddf0038256356dc1579747c72140cc8437710cf9dfb087876af0d5f080c2033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:57 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
p3p: CP='CUR ADM OUR NOR STA NID'
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 8459354
pragma: no-cache
server: Kestrel
access-control-max-age: 1000
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/xml
access-control-allow-origin: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
vary: Origin,Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 69BA 1 KB
643 B 64ms
63ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 572
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 21:34:26 GMT
etag: 48472445140208031
expires: Wed, 07 Feb 2024 21:34:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7FE6 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d56ee8b6f65d343a376aa3ebd86a1b17678d609863faa6947bf5be5a759de32a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78E8
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WmNLb0ZRQUNfWEtCVHdCSw==&google_gid=CAESEH8a3IHgtxdldlR8V1k8Z2I&google_cver=1&google_push=AXcoOmQe6foKbO6uBoGh_n4NQDJyJfYmtT...

170 B
188 B

92ms
91ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WmNLb0ZRQUNfWEtCVHdCSw==&google_gid=CAESEH8a3IHgtxdldlR8V1k8Z2I&google_cver=1&google_push=AXcoOmQe6foKbO6uBoGh_n4NQDJyJfYmtTFy_pshP_-NLjFedD8H76Xz8bKNR7YUWO9L-GLv35dHWZqUw_7HNX9LrpH_zq0OG-E

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-mia-kmia1760024-MIA
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1707255838.301179,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WmNLb0ZRQUNfWEtCVHdCSw==&google_gid=CAESEH8a3IHgtxdldlR8V1k8Z2I&google_cver=1&google_push=AXcoOmQe6foKbO6uBoGh_n4NQDJyJfYmtTFy_pshP_-NLjFedD8H76Xz8bKNR7YUWO9L-GLv35dHWZqUw_7HNX9LrpH_zq0OG-E
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78E8
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEA1QAwpwCRtE0PLdHymQ3YE&google_cver=1&google_push=AXcoOmSHrQHmOYD8x3r9SHP_HKxOkgUPPf7AG3ZQbp7fSp6clGB5iK97LPAtYLi95Eq4pzPPoAC6DWNhXlHYsDURs_Cq...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSHrQHmOYD8x3r9SHP_HKxOkgUPPf7AG3ZQbp7fSp6clGB5iK97LPAtYLi95Eq4pzPPoAC6DWNhXlHYsDURs_CqP7TqE6o&google_hm=_dlrBlovRByUJO9w66PnmQ==

170 B
188 B

93ms
93ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSHrQHmOYD8x3r9SHP_HKxOkgUPPf7AG3ZQbp7fSp6clGB5iK97LPAtYLi95Eq4pzPPoAC6DWNhXlHYsDURs_CqP7TqE6o&google_hm=_dlrBlovRByUJO9w66PnmQ==

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmSHrQHmOYD8x3r9SHP_HKxOkgUPPf7AG3ZQbp7fSp6clGB5iK97LPAtYLi95Eq4pzPPoAC6DWNhXlHYsDURs_CqP7TqE6o&google_hm=_dlrBlovRByUJO9w66PnmQ==
Date: Tue, 06 Feb 2024 21:43:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78E8
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmQhOR76DCmDRQxYJaoZhKWF_m5oITHIltEWluw0xJfv8lw1AyKybilSX0RWXm6AYbl-05aX62a8Xe8s9GvhA...
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&googl...

170 B
188 B

93ms
93ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmQhOR76DCmDRQxYJaoZhKWF_m5oITHIltEWluw0xJfv8lw1AyKybilSX0RWXm6AYbl-05aX62a8Xe8s9GvhAw12ODWhkQ

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmQhOR76DCmDRQxYJaoZhKWF_m5oITHIltEWluw0xJfv8lw1AyKybilSX0RWXm6AYbl-05aX62a8Xe8s9GvhAw12ODWhkQ
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT, Tue, 06 Feb 2024 21:43:58 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78E8
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEOiJ1bF8qhe2qxio9y0PHC0&google_cver=1&google_push=AXcoOmSYVvq-5qWwj7CZnKNGleHA57WZzwB0w2wYjTrSJgHqUF1gSmvIHEruT2cXClPb8PRg2Hye72nEp980bDxWutKQO_iDuw
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSYVvq-5qWwj7CZnKNGleHA57WZzwB0w2wYjTrSJgHqUF1gSmvIHEruT2cXClPb8PRg2Hye72nEp980bDxWutKQO_iDuw&google_hm=76VZu0UBztMKm0a86Ok0ZA==

170 B
188 B

83ms
82ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSYVvq-5qWwj7CZnKNGleHA57WZzwB0w2wYjTrSJgHqUF1gSmvIHEruT2cXClPb8PRg2Hye72nEp980bDxWutKQO_iDuw&google_hm=76VZu0UBztMKm0a86Ok0ZA==

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSYVvq-5qWwj7CZnKNGleHA57WZzwB0w2wYjTrSJgHqUF1gSmvIHEruT2cXClPb8PRg2Hye72nEp980bDxWutKQO_iDuw&google_hm=76VZu0UBztMKm0a86Ok0ZA==
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 227

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78E8
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESEBOQH6XLcJJITQBcim4gFSY&google_cver=1&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9gg...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9ggbT1P8Sft65bV4x_vAmghow&google_hm=WmNLb0g4Q284...

170 B
188 B

93ms
92ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9ggbT1P8Sft65bV4x_vAmghow&google_hm=WmNLb0g4Q284WXNBQU1LZktsc0FBQUFB

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Tue, 06 Feb 2024 21:43:59 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=google_ebda&google_gid=CAESEBOQH6XLcJJITQBcim4gFSY&google_cver=1&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9ggbT1P8Sft65bV4x_vAmghow","cluster_id":0,"gdpr":false,"ipv4":"38.132.118.68","key":"ZcKoH8Co8YsAAMKfKlsAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad1029"}
X-SO-Key: ZcKoH8Co8YsAAMKfKlsAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad1029
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=AXcoOmTrk5Q6g9XEdakOKN-rL6UOVNLpvIwX2y2xnFR8slhB_9LsSUzc-LbvLV3xoVP6PiO2_H9ggbT1P8Sft65bV4x_vAmghow&google_hm=WmNLb0g4Q284WXNBQU1LZktsc0FBQUFB
Cache-Control: private
X-SO-HostName: m-ad1029.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 1
Content-Length: 0
X-SO-LB-Hostname: m-tgng39.dc4p.scaleout.jp
X-SO-IP: 38.132.118.68

GET
H2

200

cm
ams.creativecdn.com/adx/ Frame 78E8
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmS3xLPZrpepUW05YijnU2xM0iD8N5KWzL34676mYTU26BrOMIyWa4unoW2A0-czioS8rVVxUGfLcod_7W_tq...
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&googl...
https://cm.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5
https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5

42 B
260 B

175ms
147ms

Image
image/gif

185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5
Protocol: H2
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT, Tue, 06 Feb 2024 21:43:58 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 42
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5
date: Tue, 06 Feb 2024 21:43:58 GMT
content-length: 0
vary: Accept-Encoding

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78E8
Redirect Chain

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEKIQfftu4pHnUH8uWi_GGQA&google_cver=1&google_push=AXcoOmRnQxA0GbVAEujHh_rkzj1bG5XUa9IJAj-dLypkJsGnkI5eWXtLLGieLPRjgD9t-SdWzoyBz...
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmRnQxA0GbVAEujHh_rkzj1bG5XUa9IJAj-dLypkJsGnkI5eWXtLLGieLPRjgD9t-SdWzoyBzdj0ZF6cQ0aHH6JKQ0H2XcNW&google_hm=cnFXREU1OWs5MC11...

170 B
188 B

82ms
82ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmRnQxA0GbVAEujHh_rkzj1bG5XUa9IJAj-dLypkJsGnkI5eWXtLLGieLPRjgD9t-SdWzoyBzdj0ZF6cQ0aHH6JKQ0H2XcNW&google_hm=cnFXREU1OWs5MC11TGJmdGZIbzU=

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:58 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmRnQxA0GbVAEujHh_rkzj1bG5XUa9IJAj-dLypkJsGnkI5eWXtLLGieLPRjgD9t-SdWzoyBzdj0ZF6cQ0aHH6JKQ0H2XcNW&google_hm=cnFXREU1OWs5MC11TGJmdGZIbzU=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 240
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 78E8 0
12 B 81ms
80ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JAbSyB64YDOoYJdQbzSixYs075j536Ge-pWKD_Y4ArKSy9C6BvnYEkhoi25kUNAb3JdG5Gx5A

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 i.match
a.tribalfusion.com/ Frame 69BA 43 B
697 B 114ms
111ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEK_M1GYVcNBFZQJ_c9dSmEQ&google_cver=1&google_push=AXcoOmQbaBr640-FET0DVthLpZ4XXrtwCqz0A4M1rxiNhsqRWgNjvqfQ7Mj3vtL2SU_22lTRoA3txYbRTKOkvPanb8sKihNEqt0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQbaBr640-FET0DVthLpZ4XXrtwCqz0A4M1rxiNhsqRWgNjvqfQ7Mj3vtL2SU_22lTRoA3txYbRTKOkvPanb8sKihNEqt0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8516925dafd0dae5-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69BA
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEGUdXpGFnvaBl2gHwTm7ZzQ&google_cver=1&google_push=AXcoOmR-gwZkgvppCfbr5WCPzoHCG0hCPPajWosEUP-tWSbobjCsUrw7D1LPaos8WtilbxEQMHalJXWrQbzrDG9mbiobVAOVjJ0
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3D73E86F3FA34461AD86F9585A54B5A1&google_push=AXcoOmR-gwZkgvppCfbr5WCPzoHCG0hCPPajWosEUP-tWSbobjCsUrw7D1LPaos8WtilbxEQMHalJXWrQbzrDG9...

170 B
188 B

82ms
82ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3D73E86F3FA34461AD86F9585A54B5A1&google_push=AXcoOmR-gwZkgvppCfbr5WCPzoHCG0hCPPajWosEUP-tWSbobjCsUrw7D1LPaos8WtilbxEQMHalJXWrQbzrDG9mbiobVAOVjJ0

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3D73E86F3FA34461AD86F9585A54B5A1&google_push=AXcoOmR-gwZkgvppCfbr5WCPzoHCG0hCPPajWosEUP-tWSbobjCsUrw7D1LPaos8WtilbxEQMHalJXWrQbzrDG9mbiobVAOVjJ0
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 05 Feb 2024 21:43:58 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69BA
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECfA0HllUIIRnz-3NTPbqBQ&google_cver=1&google_push=AXcoOmS998rP0nw3aSjsLPutL2n6g11bRd3rCMN8fnMkqvlJDXHDEP9cOLmfBIm9T8LtzQOvjiz5vur4moQRIgFREPgnr3Q...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmS998rP0nw3aSjsLPutL2n6g11bRd3rCMN8fnMkqvlJDXHDEP9cOLmfBIm9T8LtzQOvjiz5vur4moQRIgFREPgnr3Q0Pkn7&google_hm=eS1BcG51SGxoRTJwRWYzND...

170 B
188 B

94ms
94ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmS998rP0nw3aSjsLPutL2n6g11bRd3rCMN8fnMkqvlJDXHDEP9cOLmfBIm9T8LtzQOvjiz5vur4moQRIgFREPgnr3Q0Pkn7&google_hm=eS1BcG51SGxoRTJwRWYzNDdFNFhZVGpQNkhHcmN0X2QzWX5B

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmS998rP0nw3aSjsLPutL2n6g11bRd3rCMN8fnMkqvlJDXHDEP9cOLmfBIm9T8LtzQOvjiz5vur4moQRIgFREPgnr3Q0Pkn7&google_hm=eS1BcG51SGxoRTJwRWYzNDdFNFhZVGpQNkhHcmN0X2QzWX5B
content-length: 0

GET
H/1.1 200
200 asr
aid.send.microad.jp/g/ Frame 69BA 43 B
464 B 804ms
214ms Image
image/gif 202.233.84.1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aid.send.microad.jp/g/asr?google_gid=CAESEPXX0je40-ei2DA5Ee2EPPA&google_cver=1&google_push=AXcoOmTsc5NyiJQRIVSPVuTsH4lnnEE1XqS2qc7khpbnmntme1F7uyf9LCHiVXJ83CgUVrcyihNEevfOOPkX1c6Bw87QzNfBEnU

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

202.233.84.1 -, , ASN (),

Reverse DNS

Software

Apache /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:43:59 GMT
Strict-Transport-Security: max-age=3600
Server: Apache
P3P: policyref="http://www.microad.jp/w3c/p3p.xml",CP="NOI DSP COR NID DEVo PSAo OUR STP STA PRE"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Connection: close
Access-Control-Allow-Headers: origin, x-requested-with, If-Modified-Since, content-type, Pragma, Cache-Control
Content-Length: 43

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 69BA
Redirect Chain

https://dsum-sec.casalemedia.com/cma?google_gid=CAESEC7YZJ2d_7rtmRjGBV-_t3o&google_cver=1&google_push=AXcoOmR-_pCRDfBzuKoLUPSf_ppHf4IbT2g3j7onxKi0sZlYZA_C1ysCai7Lg4zLd0UzWuQHf-Z5MV_0uFa3vJu2JnZ6vHl...
https://rtb.adentifi.com/CookieIndex
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=188&external_user_id=cuid_d00bd1a0-c538-11ee-bf6c-121a6d1d7927

43 B
736 B

86ms
86ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=188&external_user_id=cuid_d00bd1a0-c538-11ee-bf6c-121a6d1d7927
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2XtKTDPLxJC08GzTg7zdyyPEZShatNw7WzePLQ%2FHijo%2FtTsphi3KZ0A2Ya7fWidDzreBemQ7BFAmUVMlY72Ymd%2F3VS2aK0JS7h%2FHqp76v%2F48ebQYQN1I8zhPEeZbPFl0hFS%2FyYrsuZdNdg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8516925e8e516dc7-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=188&external_user_id=cuid_d00bd1a0-c538-11ee-bf6c-121a6d1d7927
date: Tue, 06 Feb 2024 21:43:58 GMT
content-type: text/plain

GET
H2

200

cm
ams.creativecdn.com/adx/ Frame 69BA
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&google_cver=1&google_push=AXcoOmR1GApMU3DA0iQr7SyqUcFUM1VgpVJEFJjA-MQlSJKZfSq1N9nphkte45jv6eEmVrxdDtsIdLc35jFl1wB5N...
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=OPccnyLAQoWe03RBwvHEYsW15fapbzlD3QB--KPy2Yw&pi=adx&tdc=ams&pi=adxab&google_gid=CAESEHKv92NY7wNUHFV8VeRkIBA&googl...
https://cm.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5
https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5

42 B
260 B

174ms
146ms

Image
image/gif

185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5
Protocol: H2
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT, Tue, 06 Feb 2024 21:43:58 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 42
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://ams.creativecdn.com/adx/cm?v=2&pi=adx&tdc=ams&pi=adxab&google_error=5
date: Tue, 06 Feb 2024 21:43:58 GMT
content-length: 0
vary: Accept-Encoding

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 69BA
Redirect Chain

https://gtrace.mediago.io/ju/cs/google?google_gid=CAESEO-sO-w0BpF9CLQlk4gdKkc&google_cver=1&google_push=AXcoOmQszwEbFSW1f8473X4Dps7g-GYsvruxXbLyYXkrGvD8lWkE2uNZu6MRQLSZXZunS7mvRB8Ks8EZQtgvXwW_5ZQ6R...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQszwEbFSW1f8473X4Dps7g-GYsvruxXbLyYXkrGvD8lWkE2uNZu6MRQLSZXZunS7mvRB8Ks8EZQtgvXwW_5ZQ6R8gaz8vL4w&google_hm=1a43c5a55649...

170 B
188 B

92ms
92ms

Image
image/png

142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQszwEbFSW1f8473X4Dps7g-GYsvruxXbLyYXkrGvD8lWkE2uNZu6MRQLSZXZunS7mvRB8Ks8EZQtgvXwW_5ZQ6R8gaz8vL4w&google_hm=1a43c5a5564954692ydhll00lsaw1nvx

Protocol

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 06 Feb 2024 21:43:58 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQszwEbFSW1f8473X4Dps7g-GYsvruxXbLyYXkrGvD8lWkE2uNZu6MRQLSZXZunS7mvRB8Ks8EZQtgvXwW_5ZQ6R8gaz8vL4w&google_hm=1a43c5a5564954692ydhll00lsaw1nvx
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 69BA 0
12 B 82ms
79ms Image
text/html 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IP4j010ei6yScn5j0usgQchIS8_VfrkouVvk-sNIBxybY6ej3Puippx5TUVxf-LogSCTvPHQ

Requested by

Host: f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com
URL: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C86B 0
0 129ms
127ms Image
text/html 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CuJTjHajCZcO0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAaoEwAJP0IgMGTWVNwHlda3Apw7sVgWYAUhP76IY5FyQmm6gdznx5Oe4-9w5BTZTOnAVw-MSj6Sn0a0KoPoynB6AukTNW5jPHDJYyMVMbJLkdSQybq2WzqLOlKgtIJiJtRep6woILlMb8LmpbPz7Rd2bUheoUJ5oTd5WHKSNC3XOsV9y9YF3GjdT5AszmnCzl5-MgyQwVkTqJTI1_-VkeWQQYdOLQWoBieSC-jusUPvj0KEyNR2zjur8GOFC235GM-2feTsLLquzNkXY97bEsDGpCsmIHHm9SGVpDbVlSp8PkMyE76t4VNgz7p6br1z4GRSrEynEZnbIlZOBJvDaUWKvzkLNFmxdA_zoXb4PL4eK7BTrYQzGlvmTDeJCzIWG9ILXg4ZBhysLKYw5UZjN8TG7AEA4E5sV7o5hE6WB2jaiEaFLEuAEAYAGho6IuO7566uQAaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCCIIgGEQATICigI6CYBAgMCAgICACEi9_cE6WKT-5s3Xl4QDgAoD-gsCCAGADAHiDRMI88rnzdeXhAMVBQ_QBB1RJgG00BUBgBcBshccChoSFHB1Yi0zNDk0NTIwNDY4Nzg4NTg5GIanJQ&sigh=qOAhx624CFw&uach_m=%5BUACH%5D&cid=CAQSOwAvHhf_64NqoguO7zLl4ZGr-mBgydeJfDqqWVGYnYL6OQIy4Titff1h95RiqI2yqJo8680YhfRERrxZGAE&vt=10&cbvp=2&vis=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7FE6 0
0 128ms
127ms Image
text/html 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CReBYHajCZcS0F4WewNYP0cyEoAucge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMzQ5NDUyMDQ2ODc4ODU4OcgBBeACAKgDAaoEwgJP0Di9qvBC_tdBgNwND397CAS-KNztkMedaR-2S7c8mUvstLcJI_O7ByojIEiLHa8ce0N6FhYOe0BkTaB_Pkcw8OPouT87BZSLgKMog6pv1-NldX5Jq5nEwFzB0P-3aTECfOYL9j5bps6L7-7knY5_mJKg_j5Aow-O2xxWKP8Li0KL4DXdFBQCp8F6ioxsEEQOpEGaNmn29FDRu18Kvivpwi0FQKKl4eWMuGYJZC8SjJMAI7cZeodTrKNlE0cWDl9eNHYLmrKxYsNHdYSv_-ncJzqZkQN2AVmCqN5RXAmO_BlRtjRwn2G4J4upD27lzh6f1tBGWeKecpvVmorjD0JJSSIlqoxaEHpMaNdSTrHbWrNUH5kxeIPY6mq9pKTcUy2tN7Ol2tOFdfIgsGWHvY0xxJAXLCa86n141VOCB40PhLpz4AQBgAaGjoi47vnrq5ABoAYqqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIIgiAYRABMgKKAjoJgECAwICAgIAISL39wTpYpP7mzdeXhAOACgP6CwIIAYAMAeINEwj0yufN15eEAxUFD9AEHVEmAbTQFQGAFwGyFxwKGhIUcHViLTM0OTQ1MjA0Njg3ODg1ODkYhqcl&sigh=-lzM77WxiR4&uach_m=%5BUACH%5D&cid=CAQSOwAvHhf_64NqoguO7zLl4ZGr-mBgydeJfDqqWVGYnYL6OQIy4Titff1h95RiqI2yqJo8680YhfRERrxZGAE&vt=10&cbvp=2&vis=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:809::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

POST
H3 204 csi
csi.gstatic.com/ Frame C86B 0
17 B 141ms
140ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lsaw1nn3&c=8738326723654&slotId=4369163361827&qqid=CIO36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&vast_v=3.0&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=AdChoices&icdi=15x19&vmfc=1&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame C86B 2 KB
1 KB 167ms
56ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 31 Jan 2025 21:43:58 GMT

GET
H2 206 98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4
static.criteo.net/design/dt/109331/5124221/ Frame C86B 33 KB
0 277ms
175ms Media
video/mp4 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/109331/5124221/98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 21 Nov 2023 04:41:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "655c350b-3c02ed"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-3932908/3932909
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 3932909
expires: Fri, 31 Jan 2025 21:43:58 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 7FE6 0
17 B 142ms
141ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lsaw1nod&c=5160731835731&slotId=2580365917865.5&qqid=CIS36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&vast_v=3.0&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=AdChoices&icdi=15x19&vmfc=1&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 7FE6 2 KB
1 KB 341ms
260ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 31 Jan 2025 21:43:58 GMT

GET
H2 206 98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4
static.criteo.net/design/dt/109331/5124221/ Frame 7FE6 32 KB
0 191ms
116ms Media
video/mp4 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/109331/5124221/98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 21 Nov 2023 04:41:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "655c350b-3c02ed"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-3932908/3932909
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 3932909
expires: Fri, 31 Jan 2025 21:43:58 GMT

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 273ms
273ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 07 Feb 2024 21:43:58 GMT

GET
H2 206 98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4
static.criteo.net/design/dt/109331/5124221/ Frame 7FE6 33 KB
33 KB 184ms
183ms Media
video/mp4 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/109331/5124221/98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

4b743344c22713afd3066c55d85a6d665eaf662363d08a35abf18e7eaa5ee451

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=3899392-

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 21 Nov 2023 04:41:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "655c350b-3c02ed"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 3899392-3932908/3932909
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 33517
expires: Fri, 31 Jan 2025 21:43:58 GMT

GET
H2 206 98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4
static.criteo.net/design/dt/109331/5124221/ Frame C86B 33 KB
33 KB 159ms
157ms Media
video/mp4 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/109331/5124221/98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

4b743344c22713afd3066c55d85a6d665eaf662363d08a35abf18e7eaa5ee451

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=3899392-

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 21 Nov 2023 04:41:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "655c350b-3c02ed"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 3899392-3932908/3932909
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 33517
expires: Fri, 31 Jan 2025 21:43:58 GMT

POST
H2 204 events
e.channelexco.com/ 0
246 B 67ms
67ms Ping
text/plain 23.19.226.131
LEASEWEB-USA-NYC

General

Check archive.org

Show headers Download Go to

Full URL: https://e.channelexco.com/events
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/4.20.0-adde172/player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.19.226.131 New York, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:58 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 206 98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4
static.criteo.net/design/dt/109331/5124221/ Frame 7FE6 3 MB
0 56ms
56ms Media
video/mp4 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/109331/5124221/98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=32768-

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 21 Nov 2023 04:41:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "655c350b-3c02ed"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 32768-3932908/3932909
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 3900141
expires: Fri, 31 Jan 2025 21:43:58 GMT

GET
H2 206 98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4
static.criteo.net/design/dt/109331/5124221/ Frame C86B 3 MB
0 205ms
205ms Media
video/mp4 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/109331/5124221/98154313eea54f12898e6cd7c5908ece_6d0ba1f1-c46f-41c1-ae6f-e25f77ca2dd1.mp4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=32768-

Response headers

date: Tue, 06 Feb 2024 21:43:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 21 Nov 2023 04:41:47 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "655c350b-3c02ed"
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 32768-3932908/3932909
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
Content-Length: 3900141
expires: Fri, 31 Jan 2025 21:43:58 GMT

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 3648 1 KB
2 KB 369ms
66ms Document
text/html 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=180530&us_privacy=1---&r=%2F%2Fcpm.vuukle.net%2Fuser-synced%3Fzone%3D180530%26uid%3D%7BUID%7D
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: af180c2935ba49622fb9991461ba672f596021440eb83aeade08d5b7cac8f21d

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 1481
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Feb 2024 21:43:59 GMT
Server: nginx

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 8AA7 52 KB
17 KB 333ms
33ms Document
text/html 151.101.1.108

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 58839
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 06 Feb 2024 21:43:59 GMT
ETag: W/"623de86a-cf34"
Expires: Sun, 04 Feb 2024 05:27:09 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 305, 154232
X-Served-By: cache-lga13626-LGA, cache-mia-kmia1760041-MIA
X-Timer: S1707255840.600876,VS0,VE0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 32D0 16 KB
6 KB 74ms
74ms Document
text/html 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158524&us_privacy=1---
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=72241
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
expires: Wed, 07 Feb 2024 17:48:00 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 isyn Show response
sync.a-mo.net/ Frame 3888 2 KB
833 B 358ms
59ms Document
text/html 147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=Cs8BShRmcmVlZG9taGVhZGxpbmVzLmNvbVILYWFzLTU1NDM5ZGVaCHBiYTEuMy4zahRmcmVlZG9taGVhZGxpbmVzLmNvbfoBBjguMTcuMOgCAYgDndCKrgaoAzjqAyQ3NjVkY2M2NS1lZjQ0LTRhYTUtYWU2MC1mMzVjN2NjZDUwN2SqBANEQ0iyBQNVU0TSBQkxMDUxOTk0MTbYBQHgBQHqBQdkZXNrdG9w-gUEZGMxM6oHA3dlYsoHFGZyZWVkb21oZWFkbGluZXMuY29t4AcB
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 580ca8bec1634b1c2462ccd0dd564a155eff3bc8753a3535c352a0c693d1180e

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 684
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:59 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H2 200 pd Show response
vuukle-d.openx.net/w/1.0/ Frame 3B2B 880 B
850 B 87ms
49ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: f0f83d21a3f4b5d81caf1f17d0ed8b3ca8fb818bab7f941c03f6b7c95a83543e

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 546
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

POST
H3 204 csi
csi.gstatic.com/ Frame C86B 0
17 B 142ms
141ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lsaw1nsj&c=8738326723654&slotId=4369163361827&qqid=CIO36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&gpm_i=1&gpm_c=1&gpm_a=1&smb=Infinity&mt=video%2Fmp4&vs=1280x720&msm=1&aits=0&webm=0&vp9=0&vamt=video%2Fmp4&hvmf=false&vms=1&bit=0&hcn=0&met.4=arp_a_e.un~vil.1fo&ua_e=1&umsem=0&ape=1&ple=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 7FE6 0
17 B 142ms
141ms Ping
image/gif 2a00:1450:4009:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lsaw1nto&c=5160731835731&slotId=2580365917865.5&qqid=CIS36c3Xl4QDFQUP0AQdUSYBtA&fb=outstream-lima&gpm_i=1&gpm_c=1&gpm_a=1&smb=Infinity&mt=video%2Fmp4&vs=1280x720&msm=1&aits=0&webm=0&vp9=0&vamt=video%2Fmp4&hvmf=false&vms=1&bit=0&hcn=0&met.4=arp_a_e.vq~vil.1b4&ua_e=1&umsem=0&ape=1&ple=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20240117_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4009:81e::2003 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://f2d591578f08631f733c1eb439afb51f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 auction Show response
rtb.ex.co/openrtb2/ Frame 32B6 170 B
322 B 76ms
75ms Fetch
application/json 3.228.195.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.ex.co/openrtb2/auction
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/pb/2.7.0/expb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.195.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-195-99.compute-1.amazonaws.com
Software: /
Resource Hash: e63b74eeb5628bcffa26de64fe9c9afdf0d95a3da44319489432d42886ed7692

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Tue, 06 Feb 2024 21:43:59 GMT
access-control-allow-credentials: true
content-length: 170
vary: Origin
content-type: application/json

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3B2B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZcKoFQAC_XKBTwBK

43 B
61 B

53ms
53ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZcKoFQAC_XKBTwBK
Requested by: Host: vuukle-d.openx.net
URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vuukle-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by: cache-mia-kmia1760024-MIA
pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1707255840.599085,VS0,VE0
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZcKoFQAC_XKBTwBK
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 a434b5c3-7c2b-e5b4-dd38-1cfec4a7c397
pr-bh.ybp.yahoo.com/sync/openx/ Frame 3B2B 43 B
601 B 64ms
64ms Image
image/gif 2600:1f18:4e9:5a05:c89c:b2af:dcc6:f0ac
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/a434b5c3-7c2b-e5b4-dd38-1cfec4a7c397?gdpr=0

Requested by

Host: vuukle-d.openx.net
URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:c89c:b2af:dcc6:f0ac Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vuukle-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 3B2B 43 B
855 B 66ms
65ms Image
image/gif 52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=6825affa-f02d-cc07-2ce1-889c53c3c53e

Requested by

Host: vuukle-d.openx.net
URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vuukle-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 21:43:59 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: V209NF3RTT78HHJJQZ6E
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3B2B
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=30f3d387-ec87-77fd-ecef-0a0b3bf00ede&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=21b7045d-c254-48ac-9a8f-1cd489bb1d29&ttd_puid=30f3d387-ec87-77fd-ecef-0a0b3bf00ede&gdpr=0&gdpr_consent=

43 B
62 B

51ms
50ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=21b7045d-c254-48ac-9a8f-1cd489bb1d29&ttd_puid=30f3d387-ec87-77fd-ecef-0a0b3bf00ede&gdpr=0&gdpr_consent=
Requested by: Host: vuukle-d.openx.net
URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vuukle-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=21b7045d-c254-48ac-9a8f-1cd489bb1d29&ttd_puid=30f3d387-ec87-77fd-ecef-0a0b3bf00ede&gdpr=0&gdpr_consent=
date: Tue, 06 Feb 2024 21:43:59 GMT
server: Kestrel
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 3B2B 170 B
188 B 93ms
92ms Image
image/png 142.250.80.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MWM5YzAwNGQtMjVmMC0yOTU5LWY5MGYtNTBiMmYxMTJjMGJl

Requested by

Host: vuukle-d.openx.net
URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vuukle-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3B2B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrv9P6PF_3e7Dkv6cRu4n4&google_cver=1

43 B
61 B

48ms
47ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrv9P6PF_3e7Dkv6cRu4n4&google_cver=1
Requested by: Host: vuukle-d.openx.net
URL: https://vuukle-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vuukle-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDrv9P6PF_3e7Dkv6cRu4n4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 32D0 692 B
1007 B 57ms
57ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=22709644&p=158524&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158524&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e2ff73513ef6be62db001f45ae8d15c20d399f8f56b2776c191bdfd26f1a66e1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 06 Feb 2024 21:43:58 GMT
content-length: 692
content-type: text/html; charset=UTF-8

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 8AA7 0
919 B 70ms
69ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
an-x-request-uuid: 1e98e5ca-387e-483e-8849-d00270398554
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 3888 16 KB
7 KB 129ms
43ms Script
text/javascript 2606:4700::6813:9f13

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: sync.a-mo.net
URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=Cs8BShRmcmVlZG9taGVhZGxpbmVzLmNvbVILYWFzLTU1NDM5ZGVaCHBiYTEuMy4zahRmcmVlZG9taGVhZGxpbmVzLmNvbfoBBjguMTcuMOgCAYgDndCKrgaoAzjqAyQ3NjVkY2M2NS1lZjQ0LTRhYTUtYWU2MC1mMzVjN2NjZDUwN2SqBANEQ0iyBQNVU0TSBQkxMDUxOTk0MTbYBQHgBQHqBQdkZXNrdG9w-gUEZGMxM6oHA3dlYsoHFGZyZWVkb21oZWFkbGluZXMuY29t4AcB
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: a79e82fb537b0621dd3cad7ccff489e28d71450ae91ee4e27b85c5e0f0fd26d9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
via: 1.1 4c3d8e28c41258b22a9e9534d51ead58.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 352
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 25 Jan 2024 17:28:00 GMT
server: cloudflare
etag: W/"d458c9c4d04e49d089648ee8a1473ba4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 851692667a394c14-MIA
x-amz-cf-id: yNp7SDCT3f-4KMtsIBH5uq11QiF-yQkAcmFuReFJl2WMXi_WCTaoiw==
expires: Tue, 06 Feb 2024 22:43:59 GMT

GET
H/1.1

200
OK

user-sync
sync.adkernel.com/ Frame 3648
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D583257%26t%3Dimage%26uid%3D%24%7BBSW_UUID%7D%26us_privacy%3D1---
https://sync.adkernel.com/user-sync?zone=180530&dsp=583257&t=image&uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&us_privacy=1---

42 B
326 B

320ms
67ms

Image
image/gif

174.137.133.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?zone=180530&dsp=583257&t=image&uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&us_privacy=1---
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=180530&us_privacy=1---&r=%2F%2Fcpm.vuukle.net%2Fuser-synced%3Fzone%3D180530%26uid%3D%7BUID%7D
Protocol: HTTP/1.1
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.adkernel.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:44:00 GMT
Cache-Control: no-store
Server: nginx
Connection: close
Content-Length: 42
Content-Type: image/gif

Redirect headers

Location: https://sync.adkernel.com/user-sync?zone=180530&dsp=583257&t=image&uid=fdd96b06-5a2f-441c-9424-ef70eba3e799&us_privacy=1---
Date: Tue, 06 Feb 2024 21:43:59 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 vuukle Show response
sync.quantumdex.io/usersync/ Frame 1EC2 5 KB
1 KB 174ms
80ms Document
text/html 2606:4700:10::6816:2460

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/vuukle
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=180530&us_privacy=1---&r=%2F%2Fcpm.vuukle.net%2Fuser-synced%3Fzone%3D180530%26uid%3D%7BUID%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 995c6611f5323653166e36b57795165be345f47f7a5266e82548055373aff184

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 851692669e497425-MIA
content-encoding: br
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
server: cloudflare

GET
H2

200

7e908545a85d1a3e
ads.us.e-planning.net/uspd/1/ Frame E7C8
Redirect Chain

https://ads.us.e-planning.net/uspd/1/7e908545a85d1a3e?ruidm=1&du=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D687665%26t%3Diframe%26uid%3D%24UID%26us_privacy%3D1---
https://ads.us.e-planning.net/uspd/1/7e908545a85d1a3e?ct=1&ruidm=1&du=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D687665%26t%3Diframe%26uid%3D%24UID%26us_privacy%3D1---

4 KB
2 KB

60ms
59ms

Document
text/html

172.98.26.246

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/7e908545a85d1a3e?ct=1&ruidm=1&du=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D687665%26t%3Diframe%26uid%3D%24UID%26us_privacy%3D1---
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=180530&us_privacy=1---&r=%2F%2Fcpm.vuukle.net%2Fuser-synced%3Fzone%3D180530%26uid%3D%7BUID%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 -, , ASN (),
Reverse DNS
Software: openresty /
Resource Hash

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
expires: Tue, 06 Feb 2024 21:43:59 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1214

Redirect headers

content-type: text/html; charset=iso-8859-1
date: Tue, 06 Feb 2024 21:43:59 GMT
location: /uspd/1/7e908545a85d1a3e?ct=1&ruidm=1&du=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D687665%26t%3Diframe%26uid%3D%24UID%26us_privacy%3D1---
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1214

GET

/
hde.tynt.com/deb/ Frame 13FD
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001eeJhsAAE&ru=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D602159%26t%3Diframe%26uid%3D33XUSERID33X%26us_privacy%3D1---
https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001eeJhsAAE&ru=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D602159%26t%3Diframe%26uid%3D33XUSERID33X%26us_privacy%3D1---
https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001eeJhsAAE&ru=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D602159%26t%3Diframe%26uid%3D33XUSERID33X%26us_privacy%3D1---&b=1

0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2E5A 16 KB
6 KB 65ms
64ms Document
text/html 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=161387&userIdMacro=PM_UID&predirect=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D574339%26t%3Diframe%26uid%3DPM_UID%26us_privacy%3D1---
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=180530&us_privacy=1---&r=%2F%2Fcpm.vuukle.net%2Fuser-synced%3Fzone%3D180530%26uid%3D%7BUID%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=72241
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
expires: Wed, 07 Feb 2024 17:48:00 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 32D0 0
198 B 312ms
182ms Image
text/plain 18.238.55.15

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.15 -, , ASN (),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
via: 1.1 a5ec1cc448d0ca618712f253b7a7adba.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK52-P4
content-length: 0
x-amz-cf-id: GWiI0N9O1qHof00xazd226AyzbmLOWbUcy1OcQEjafhfzUY01h30hQ==
x-cache: Error from cloudfront

GET

db_sync
px.ads.linkedin.com/ Frame 32D0
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=
https://idsync.rlcdn.com/1000.gif?memo=CPy7KxIwCiwIARCFpQoaJEQ4Mzc1RjZFLTJCNDgtNDBBRi1CQjYzLTAwNEQ4MzlFNUM2NhAAGg0In9CKrgYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=882140a80c928748292cde1af6c7d724e2e4390a64578eb3bc2686e6b922fd2a791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=882140a80c928748292cde1af6c7d724e2e4390a64578eb3bc2686e6b922fd2a791426b5417dce21&rand=03698495

0
0

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=D8375F6E-2B48-40AF-BB63-004D839E5C66/gdpr=0/ Frame 32D0 49 B
265 B 69ms
68ms Image
image/gif 54.85.196.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=D8375F6E-2B48-40AF-BB63-004D839E5C66/gdpr=0/gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.196.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-196-253.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.14.153
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 32D0 95 B
124 B 53ms
53ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=D8375F6E-2B48-40AF-BB63-004D839E5C66&gdpr=0&gdpr_consent=

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/ 80 KB
81 KB 65ms
64ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_480,h_270,vc_h264:baseline:3.0,br_800k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: b163747850fddae26a3744f783b8fd142edff9f201675e23028011ff42b26161

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=787720-870063

Response headers

Date: Tue, 06 Feb 2024 21:43:59 GMT
Cache-Tag: 502941132783428480281542933415069772301,367740830352960595415805974629789749672,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 787720-870063/1662860
Connection: keep-alive
Content-Length: 82344
X-Served-By: cache-iad-kjyo7100028-IAD
Last-Modified: Tue, 10 Oct 2023 19:19:36 GMT
Server: cloudinary
Surrogate-Reporting: width=480,height=270,abps=27153,fps=25.0,du=61.24,vc="h264",bytes=1662860
X-Timer: S1698284483.419360,VS0,VE262
ETag: "a05717edc3659135499740054ba4c3eb"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31129004
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H/1.1 204
No Content user-sync
sync.adkernel.com/ Frame D8EC 0
0 181ms
66ms Document
text/plain 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=180530&dsp=574339&t=iframe&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=161387&userIdMacro=PM_UID&predirect=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D574339%26t%3Diframe%26uid%3DPM_UID%26us_privacy%3D1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 06 Feb 2024 21:43:59 GMT
Server: nginx

GET match
ads.betweendigital.com/ Frame 1EC2 0
0

GET

setuid
sync.quantumdex.io/ Frame 1EC2
Redirect Chain

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dinmobi%26uid%3D%7BID5UID%7D
https://sync.quantumdex.io/setuid?bidder=inmobi&uid=ID5-00cdn1_5PK82vbh8Oh35yr89jxw9PlE2ueYs1Ds9Hg

0
0

GET

setuid
sync.quantumdex.io/ Frame 1EC2
Redirect Chain

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=39779bea-e14e-4748-b5b8-9b367b06830e

0
0

GET
H2 204 /
s.ad.smaato.net/c/ Frame 1EC2 0
243 B 402ms
66ms Image
text/plain 2600:9000:2209:b600:1b:5138:8a40:93a1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=p&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsmaato%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:b600:1b:5138:8a40:93a1 -, , ASN (),
Reverse DNS
Software: CloudFront /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:29 GMT
via: 1.1 3f65d34f6010e326e59d2f311de6e202.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-P1
age: 31
x-cache: Hit from cloudfront
cache-control: no-cache, must-revalidate
x-amz-cf-id: TsN9xR44I5zqWeHJZGDHko4Jtbvl5GdWtfKPcnbC52_9lL1bNxRVXw==

GET
H2

200

setuid
sync.quantumdex.io/ Frame 1EC2
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=6053676651067766727

43 B
95 B

79ms
79ms

Image
image/gif

2606:4700:10::6816:2460

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=6053676651067766727
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Server: 2606:4700:10::6816:2460 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8516926798907425-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
an-x-request-uuid: fa3c51aa-cd75-48b0-b02a-b7d1ae22b092
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=6053676651067766727
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame 1EC2
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsovrn%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=sovrn&uid=IHk3ALZHTKW55wwqS02JoA7V

43 B
106 B

76ms
75ms

Image
image/gif

2606:4700:10::6816:2460

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=sovrn&uid=IHk3ALZHTKW55wwqS02JoA7V
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Server: 2606:4700:10::6816:2460 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 85169267886d7425-MIA
alt-svc: h3=":443"; ma=86400
content-length: 43
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=sovrn&uid=IHk3ALZHTKW55wwqS02JoA7V
access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:43:59 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 0
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H/1.1 200
OK user-sync
sync.adkernel.com/ Frame 1EC2 42 B
326 B 290ms
66ms Image
image/gif 174.137.133.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?dsp=61&t=image&uid=dceb7014-eeb2-49af-b946-fbc5eb529ae9
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 21:44:00 GMT
Cache-Control: no-store
Server: nginx
Connection: close
Content-Length: 42
Content-Type: image/gif

GET
H3 200 usermatch
ssum-sec.casalemedia.com/ Frame DA7F 1 KB
1 KB 76ms
75ms Document
text/html 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8516926728eb6dc7-MIA
content-encoding: br
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ou4ABsMzk5TyjCXw3XPLAV7FNVMLKkvAtQak%2BQo8H6HWUYfOHKcz24c2rRzAz%2FsX8KSTS%2F2K7jy2BLyvjDi7%2BQJCtWTpTpW8i6Ik2zYgbVqQUiRFlt3GBnEw4Ru0KLW1uodGtzhUK1BFvw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 sync
eb2.3lift.com/ Frame FAA9 1 KB
2 KB 60ms
59ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1343
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 21:43:59 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

setuid
sync.quantumdex.io/ Frame 4AD8
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%5BRX_UUID%5D
https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=

43 B
0

76ms
75ms

Document
image/gif

2606:4700:10::6816:2460

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 851692691bf17425-MIA
content-length: 43
content-type: image/gif
date: Tue, 06 Feb 2024 21:44:00 GMT
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html
date: Tue, 06 Feb 2024 21:44:00 GMT
etag: OPTOUT
expires: 0
location: https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=
pragma: no-cache

GET
H/1.1 200
OK user-sync
sync.adkernel.com/ Frame 9592 341 B
641 B 102ms
67ms Document
text/html 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=185416&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 341
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Feb 2024 21:43:59 GMT
Server: nginx

GET
H/1.1 200
OK user-sync
sync.adkernel.com/ Frame CA6D 341 B
641 B 192ms
67ms Document
text/html 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=148144&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 341
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Feb 2024 21:44:00 GMT
Server: nginx

GET
H/1.1 200
OK user-sync
sync.adkernel.com/ Frame 92E3 609 B
1 KB 198ms
68ms Document
text/html 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=149271&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 609
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Feb 2024 21:44:00 GMT
Server: nginx

GET
H2 200 sync-iframe
cs-server-s2s.yellowblue.io/ Frame 2CB8 3 KB
0 384ms
61ms Document
text/html 3.232.247.195

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Drise%26uid%3D%7BpartnerId%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 3.232.247.195 -, , ASN (),
Reverse DNS
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://sync.quantumdex.io/
content-type: text/html
date: Tue, 06 Feb 2024 21:44:00 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame EA61 16 KB
6 KB 65ms
65ms Document
text/html 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=72241
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Tue, 06 Feb 2024 21:43:59 GMT
expires: Wed, 07 Feb 2024 17:48:00 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK user-sync
sync.adkernel.com/ Frame EA91 342 B
642 B 192ms
67ms Document
text/html 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=184388&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxap-184388%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 342
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Feb 2024 21:44:00 GMT
Server: nginx

GET
H2 200 /
onetag-sys.com/usync/ Frame 99E3 2 KB
0 383ms
69ms Document
text/html 51.222.239.230

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 -, , ASN (),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 /
onetag-sys.com/usync/ Frame D5DF 2 KB
0 380ms
68ms Document
text/html 51.222.239.230

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Donetag-pbs%26uid%3D%24%7BUSER_TOKEN%7D

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/vuukle

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 -, , ASN (),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 771
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 204
No Content user-sync
sync.adkernel.com/ Frame 1ACB 0
0 74ms
68ms Document
text/plain 174.137.133.32

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=180530&dsp=574339&t=iframe&uid=D8375F6E-2B48-40AF-BB63-004D839E5C66&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=161387&userIdMacro=PM_UID&predirect=%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D180530%26dsp%3D574339%26t%3Diframe%26uid%3DPM_UID%26us_privacy%3D1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 06 Feb 2024 21:44:00 GMT
Server: nginx

GET
H2 200 idl.js
assets.a-mo.net/js/ Frame 3888 3 KB
2 KB 44ms
43ms Script
application/javascript 2606:4700::6813:9f13

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=freedomheadlines.com&e=27&uid=58931442-874e-4388-af38-614ae9f9ca68
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:44:00 GMT
via: 1.1 50d46662b214cb2923f288d3ad4f9dec.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: MIA3-C3
age: 132
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 02 Nov 2023 21:08:31 GMT
server: cloudflare
etag: W/"771a6a92588a8fb45e42a04fa3fe9ddd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 85169268cd694c14-MIA
x-amz-cf-id: fleMLN2ckxG0WLRkONKJcSyaPZQhfRkRrY8QwQBCzCyttaQ5T_ye0A==
expires: Tue, 06 Feb 2024 22:44:00 GMT

GET

b
c3.a-mo.net/ Frame 3888
Redirect Chain

https://id.a-mx.com/sync?tao=1&&do=freedomheadlines.com
https://c3.a-mo.net/b?uid=e7d46c0d-a65a-4425-a238-00a0537c0761&sh=id.a-mx.com&

0
0

GET
H/1.1

200
OK

usync.html
eus.rubiconproject.com/ Frame F56B
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-adaptmx
https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx

0
0

72ms
69ms

Document
text/html

23.56.163.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.163.106 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-163-106.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Referer: https://sync.a-mo.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 21:44:00 GMT
ETag: "280524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 06 Feb 2024 21:44:00 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
server: AkamaiGHost

GET

sync
odr.mookie1.com/t/v2/ Frame 3888
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=58931442-874e-4388-af38-614ae9f9ca68&gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=fdd96b06-5a2f-441c-9424-ef70eba3e799&ssp=adaptmx&gdpr=0&gdpr_consent=

0
0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame 3888
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?uid=58931442-874e-4388-af38-614ae9f9ca68
https://prebid.a-mo.net/setuid/yahoo?uid=y-aRwjWj9E2uE5yqUxo6wROlAUmXAoYdNCUR1Xlnc-~A

0
115 B

62ms
62ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-aRwjWj9E2uE5yqUxo6wROlAUmXAoYdNCUR1Xlnc-~A
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-aRwjWj9E2uE5yqUxo6wROlAUmXAoYdNCUR1Xlnc-~A
date: Tue, 06 Feb 2024 21:44:00 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
sync.a-mo.net/ Frame 3888
Redirect Chain

https://id.a-mx.com/u?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Damx_com%26uid%3D
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=amx_com&uid=e7d46c0d-a65a-4425-a238-00a0537c0761

0
111 B

61ms
59ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=amx_com&uid=e7d46c0d-a65a-4425-a238-00a0537c0761
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=amx_com&uid=e7d46c0d-a65a-4425-a238-00a0537c0761
date: Tue, 6 Feb 2024 21:43:59 GMT
content-length: 0

GET
H2

204

setuid
sync.a-mo.net/ Frame 3888
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=1---_e&r=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dopenx%26uid%3D%24%7BUID%7D
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=openx&uid=092d5c48-5518-4414-8763-ca1ebaabcc53

0
123 B

60ms
59ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=openx&uid=092d5c48-5518-4414-8763-ca1ebaabcc53
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:44:00 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=openx&uid=092d5c48-5518-4414-8763-ca1ebaabcc53
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 152

GET cookie
cm.adform.net/ Frame 3888 0
0

GET

SPug
image4.pubmatic.com/AdServer/ Frame 3888
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&us_privacy=1---_e&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252...
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dpubmatic%26uid%3DD8375F6E-2B48-40AF-BB6...

0
0

GET
H2

204

setuid
sync.a-mo.net/ Frame 3888
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---_e&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dindex_rtb%2...
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=index_rtb&uid=ZcKoFppxku0Afot76.WELgAA%262843

0
113 B

62ms
61ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=index_rtb&uid=ZcKoFppxku0Afot76.WELgAA%262843
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:44:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDGuEodqAkMqh6QbieoPgAmimO7F61E8p%2BKNIoB6HsvtrBUDG5%2BYAKaG2XhOdN4nsDlid7kB11CH2Wlg1y8d%2BDg8WHAWNVVxqEJ5jGBFs3mevsuI0QXUt9uarJurlT%2BnuyQIbbY7"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=index_rtb&uid=ZcKoFppxku0Afot76.WELgAA%262843
cache-control: no-cache
cf-ray: 85169268dc278da3-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 pixel
ap.lijit.com/ Frame 3888 0
174 B 61ms
58ms Image
text/plain 3.224.33.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dsovrn%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.33.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-33-5.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 06 Feb 2024 21:44:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H2

204

setuid
sync.a-mo.net/ Frame 3888
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D58931442-874e-4388-af38-614ae9f9ca68%26bidder%3Dappnexus%26uid%3D%24UID
https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=appnexus&uid=6053676651067766727

0
114 B

61ms
60ms

Image
text/plain

147.28.129.140
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=appnexus&uid=6053676651067766727
Protocol: H2
Server: 147.28.129.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:44:00 GMT
an-x-request-uuid: 966b757c-a094-491f-bf08-4c244ae10e0e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://sync.a-mo.net/setuid?A=58931442-874e-4388-af38-614ae9f9ca68&bidder=appnexus&uid=6053676651067766727
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET setuid
ow.pubmatic.com/ Frame 3888 0
0

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame 3888 43 B
1 KB 73ms
71ms Image
image/gif 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=58931442-874e-4388-af38-614ae9f9ca68&do=freedomheadlines.com

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:44:00 GMT
an-x-request-uuid: a93c56ee-6456-49d3-aa7b-4a70a6c08a7b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame FAA9
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
354 B

62ms
62ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 06 Feb 2024 21:44:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=21b7045d-c254-48ac-9a8f-1cd489bb1d29&dongle=0cfd&gdpr=0&gdpr_consent=
date: Tue, 06 Feb 2024 21:44:00 GMT
server: Kestrel
content-length: 251

GET

ebda
eb2.3lift.com/ Frame FAA9
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE4MDU2MzMyOTQwNDE0ODM1Njc5Ng%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame FAA9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP_8hWZ6UsO8oSmyNqga1iI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

67ms
66ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP_8hWZ6UsO8oSmyNqga1iI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 06 Feb 2024 21:44:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:44:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP_8hWZ6UsO8oSmyNqga1iI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

pixel
cm.g.doubleclick.net/ Frame FAA9
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE4MDU2MzMyOTQwNDE0ODM1Njc5Ng%3D%3D

0
0

GET
H2 200 setuid
px.ads.linkedin.com/ Frame FAA9 0
362 B 92ms
83ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4180563329404148356796&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 21:43:59 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 1C98DD58FA924AE491F57DA3EB114FE2 Ref B: MIAEDGE2717 Ref C: 2024-02-06T21:44:00Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYQvXnlXsspKix8ggGYsw==

GET
H2

200

xuid
eb2.3lift.com/ Frame FAA9
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4180563329404148356796?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-yfArEsJE2oSjJVVwvBZveeSDhrdEbGDnLwERuGoJjg--~A&dongle=0883

37 B
354 B

62ms
62ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-yfArEsJE2oSjJVVwvBZveeSDhrdEbGDnLwERuGoJjg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 06 Feb 2024 21:44:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Tue, 06 Feb 2024 21:44:00 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-yfArEsJE2oSjJVVwvBZveeSDhrdEbGDnLwERuGoJjg--~A&dongle=0883
content-length: 0

GET

bsw_sync
ads.creative-serving.com/ Frame FAA9
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=4180563329404148356796&gdpr=0&gdpr_consent=${GDPR_CONSENT}
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=fdd96b06-5a2f-441c-9424-ef70eba3e799&gdpr=0&gdpr_consent=

0
0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame FAA9 43 B
362 B 65ms
56ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=44&p=75&cp=triplelift&cu=1&gdpr=0&gdpr_consent=&us_privacy=&gpp=${GPP_STRING_28}&gpp_sid=&url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D2711%26xuid%3D%40%40CRITEO_USERID%40%40%26dongle%3D013b

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:43:59 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 215886
expires: Tue, 06 Feb 2024 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame FAA9
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=6053676651067766727&dongle=4d58&gdpr=0&gdpr_consent=

37 B
354 B

70ms
66ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=6053676651067766727&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 06 Feb 2024 21:44:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 21:44:00 GMT
an-x-request-uuid: 2c440eb5-4569-408c-8fb7-1c57547cb500
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://eb2.3lift.com/xuid?mid=3335&xuid=6053676651067766727&dongle=4d58&gdpr=0&gdpr_consent=
x-proxy-origin: 38.132.118.68; 38.132.118.68; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame FAA9 43 B
1 KB 79ms
71ms Image
image/gif 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=0&gdpr_consent=&uid=4180563329404148356796

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 Jersey City, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS