swiftmoves.blog Open in urlscan Pro
2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Public Scan

ec2-18-213-35-88.compute-1.amazonaws.com

Software

Server /

Resource Hash

1beae3836966d8ccb00fe2568b594effeeaa649ee65d576210a1fa33edcdda49

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: M3CEF0MYEF4NANN2DP95
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 2966
x-amz-cf-id: cgk-1L_EiWdhQ1fa-7zzMoPquHfj3PsmkUpJs9kBbY5b4SKjrNnGLA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 94ms
28ms XHR
application/javascript 13.249.80.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.80.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-80-50.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: yHpogsakS7iCluwAmUa6Y9ccBYm32d5h
content-encoding: gzip
via: 1.1 e3bd3151a67fbf39759e8f681890f01e.cloudfront.net (CloudFront)
date: Sun, 14 May 2023 21:32:20 GMT
x-amz-cf-pop: ORD52-C1
age: 32333
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 11 May 2023 21:16:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: omAPwSbXYsww0u3ajiLUkJ7tbGhvmI_cl3yGzmV6ToJxCEnI76-XzA==

GET
H2 200 cropped-swift.png
swiftmoves.blog/wp-content/uploads/ 13 KB
13 KB 45ms
43ms Image
image/webp 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swiftmoves.blog/wp-content/uploads/cropped-swift.png?ezimgfmt=rs:150x98/rscb1/ngcb1/notWebP
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx centminmod / centminmod
Resource Hash: d6d087098961007caa4851de43d11e35a647ccf3e56a3c76c89b151256ad75e6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 UTC
content-encoding: br
display: staticcontent_sol
x-powered-by: centminmod
x-ezoic-cdn: Hit ds;mm;3829321870086a15a21e36d539d0aebe;2-284837-44;837b68bd-6085-4950-5ecb-f9e5521d84ad
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-ezoic-excludewebp: false
response: 200
last-modified: Wed, 03 May 2023 17:04:23 GMT
server: nginx centminmod
etag: "608db858-54c9-gzip"
x-origin-cache-control: public, must-revalidate, proxy-revalidate, immutable, max-age=31536000, stale-while-revalidate=86400, stale-if-error=604800
vary: Accept-Encoding,X-Ezoic-Excludewebp,User-Agent,Origin
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-hosted-by: BigScoots

GET
H/1.1 200
OK c3dpZnRtb3Zlcy5ibG9n Show response
tcheck.outbrainimg.com/tcheck/check/ 16 B
464 B 106ms
28ms XHR
application/json 23.33.181.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tcheck.outbrainimg.com/tcheck/check/c3dpZnRtb3Zlcy5ibG9n
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.181.205 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-205.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:12 GMT
ETag: W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=42064
Access-Control-Allow-Credentials: false
Connection: keep-alive
X-TraceId: 78717a4c542dfc121f189c4d919e5798
Content-Length: 16
Expires: Mon, 15 May 2023 18:12:16 GMT

GET
H2 200 px.gif
widget-pixels.outbrain.com/widget/detect/ 43 B
380 B 44ms
24ms Image
image/gif 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget-pixels.outbrain.com/widget/detect/px.gif?ch=1
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 14 Jun 2023 06:31:12 GMT
date: Mon, 15 May 2023 06:31:12 GMT
last-modified: Wed, 30 Sep 2020 14:22:29 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1601475749.911431"
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 43
access-control-request-headers: X-OB-STG,X-OB-PRD

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 93ms
26ms Preflight 44.213.190.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.213.190.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-213-190-84.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Mon, 15 May 2023 06:31:12 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
https://btloader.com/tag?o=5112081056530432&upapi=true

223 KB
44 KB

32ms
32ms

Script
application/javascript

2606:4700:20::681a:78b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5112081056530432&upapi=true
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:20::681a:78b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29d888a9c229334729aa11af1395ca396a3407ec87637f32960d6ce54b2123a7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:02:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1487
etag: W/"c0876d1c10e7cc9c128d116ff9d2835c"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4iyOZwUOzO7rn9HDIqNKErO90%2BRyZr0ihzotBcQu5Wxe200dYhQWpWeIFqDyVlL3kjABTcCoh1ItJJmoXCziRjXElbVQMuJ52imwLwkvmmfAk84bb4wfa6zvX2mHc0PV9Rli3TUjtFxtVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
cf-ray: 7c7956312b8b53e3-YYZ

Redirect headers

date: Mon, 15 May 2023 06:31:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yAUwFyB6T60W70l5QrUXmDEMmDTTv9f5RBRuX9H4fnAulckJMjC7Z98zy21qCr9grtix8yENWWlsFH6tJyCL%2Bm4CG3swmPgSdQYzuVzTohfBwvJ38ZeXM1bzbXSSwGXmopgo2hKkQiR4TQ%3D%3D"}],"group":"cf-nel","max_age":604800}
location: https://btloader.com/tag?o=5112081056530432&upapi=true
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 7c795630cb1653e3-YYZ
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 103ms
34ms Script
application/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fswiftmoves.blog%2F&ref=&_it=amazon&partner_id=524
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f329a0d3e082589a14177df4778b45ea8cb3826ce3b945fcbb0721baca5825

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 18 Nov 2022 10:57:44 GMT
server: cloudflare
x-amz-request-id: 9RA20245NA8GKGGH
age: 7117
etag: W/"2280e2148e4ee3c06f679f8fac039778"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7c795630cf9e546d-YYZ
x-amz-id-2: aSW16r0shI5ChmxJ5o0UI8DBapya69bh0So/eSShhfedsLvuK6Rir1Jf2MmnU9Nx3dyJgFeZI2c=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 120ms
52ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0325b6c9e68ae3f6ec25f6817b4daef364bd99c2ff5f04588fd6f956bf983b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: RFQ72ZT0FD50TQXF
age: 1968
etag: W/"b58faeda0c1d193bc50dd25a7640d8ba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c795630cc47a247-YYZ
x-amz-id-2: 6MkvUP0y5nd1eSOvOxhVNkQYe4JSYEReFvRefkTh11MRAXqP1kgeUsi0inWRBs8FmKy/WZ/6+EU=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
452 B 25ms
24ms XHR
text/plain 44.213.190.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.213.190.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-213-190-84.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:12 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 115ms
35ms Script
text/javascript 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-158660317-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 15 May 2023 04:59:57 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 5475
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 15 May 2023 06:59:57 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 56ms
10ms XHR
application/json 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230515

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fad5427c7817ae9d5569150533f3f74f5eacf5dde4ba3399b4ccebfc55d9d2e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 15 May 2023 06:31:12 GMT
x-content-type-options: nosniff
content-encoding: br
age: 9009
x-jsd-version: 1.0.1696
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 859
x-served-by: cache-fra-eddf8230103-FRA, cache-yul12827-YUL
x-jsd-version-type: version
etag: W/"63b-XbQ83bF+2drlLZkhKuq8ERRcN/0"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 play Show response
videosvc.ezoic.com/ 583 B
615 B 94ms
26ms XHR
application/json 18.213.35.88
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://videosvc.ezoic.com/play?videoID=f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b&manifest=dash

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

18.213.35.88 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

openresty/1.15.8.2 /

Resource Hash

ff8ad365f70e227e17f7bf1a95a75935ce0b57a3dfc74103895650e91daa40aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
server: openresty/1.15.8.2
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type

GET
H2 200 platforms Show response
odb.outbrain.com/utils/ 12 KB
5 KB 177ms
112ms Script
text/javascript 146.75.38.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://odb.outbrain.com/utils/platforms?contentUrl=https%3A%2F%2Fswiftmoves.blog%2F&idx=0&rand=35153&widgetJSId=AR_2&va=true&et=true&format=html&extid=284837_1_191_100x240&px=240&py=849&vpd=0&activeTab=true&settings=true&recs=true&key=EZOICL9MFJN21JB32NFBE7ODP&adblck=false&abwl=false&ab=0&wl=0&version=2010301&sig=QuwZhUlG&apv=false&&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpa=1---&ccpaStat=1&chs=1&ogn=https%3A%2F%2Fswiftmoves.blog%2F
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.38.132 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 36e1a0173c713256287e4665fa8189dccd7c90a8344e9de7e378d11df43464ef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 15 May 2023 06:31:12 GMT
content-encoding: br
via: 1.1 varnish
traffic-path: SADC1, IAD, North_America
x-cache: MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
x-traceid: 7ac4ccdd436dce345666ecf73f57f261
content-length: 4235
x-served-by: cache-iad-kcgs7200070-IAD
pragma: no-cache
x-timer: S1684132273.891097,VS0,VE83
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 160 B
631 B 111ms
27ms Script
application/javascript 2600:9000:21b8:c200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21b8:c200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 05:49:13 GMT
via: 1.1 be9e8198c11c3aefc38245bb41391566.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C1
age: 2519
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Fri, 14 Oct 2022 00:41:49 GMT
server: AmazonS3
etag: "af15ecfe46737cb2a37226fd060f23a6"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: ofVo8wtm42-15mTaEm3vFgoVz-0aJGWLUIDlcb83ZGty0wVdmeshiw==

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
23 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjQzMzQwNDA4MTI4NzEzIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6InN3aWZ0bW92ZXNfYmxvZy1uYXRpdmVzaW5nbGUtMSIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkxLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MiwiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOjB9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:13 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 100 B
315 B 49ms
49ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=524&sync=0&domain=swiftmoves.blog&url=https://swiftmoves.blog/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fswiftmoves.blog%2F&ref=&_it=amazon&partner_id=524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04b44adf444517ac9be0c976c8abda13445cf88441bef0d940bd79cbcae4b90e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 7c79563209c5a20a-YYZ

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 115ms
52ms Preflight
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=524&sync=0&domain=swiftmoves.blog&url=https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 7c795631b970a20a-YYZ
content-length: 0
content-type: application/json
date: Mon, 15 May 2023 06:31:12 GMT
debug: OPTIONS block
expires: Tue, 14 May 2024 06:31:12 GMT
server: cloudflare

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
402 B 315ms
101ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

39254c6ae0f9f36a5d39fdd5144b0d7652c6afc1c93d59c8e4fa009ea1f043a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

POST
H2 200 / Show response
ow.pubmatic.com/cookie_sync/ 2 KB
2 KB 114ms
31ms XHR
application/json 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://ow.pubmatic.com/cookie_sync/?sec=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 8e6cd61106199a05418b6b8b7af84e2c0159fd4e4b9af43f130ea6c7a6436362

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:12 GMT
access-control-allow-credentials: true
content-length: 1779
content-type: application/json; charset=utf-8

POST
H2 200 auction Show response
ow.pubmatic.com/pbs/openrtb2/ 73 KB
13 KB 360ms
281ms XHR
application/json 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://ow.pubmatic.com/pbs/openrtb2/auction
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 3ec1b69e28bd1da73d7557afc05b3da512243cb289015ea07d96c9ba56bb25fb

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
access-control-allow-credentials: true
content-type: application/json

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
531 B 84ms
35ms Script
application/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 81ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
206 B 50ms
49ms XHR
text/plain 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1561965060&t=pageview&_s=1&dl=https%3A%2F%2Fswiftmoves.blog%2F&ul=en-us&de=UTF-8&dt=Swift%20Moves%20-%20My%20Tech%20Reviews%20%26%20Comparisons&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=625456366&gjid=1693913401&cid=1420665221.1684132273&tid=UA-158660317-1&_gid=198455458.1684132273&_r=1&gtm=457e35a0&jsscut=1&z=84482639

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ulLnJckpJPgushqs_j1660268612133-irhkw2_t1660268841.003.jpg
swiftmoves.blog/ezoimgfmt/streaming.humix.com/poster/ulLnJckpJPgushqs/ 41 KB
35 KB 48ms
46ms Image
image/jpeg 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swiftmoves.blog/ezoimgfmt/streaming.humix.com/poster/ulLnJckpJPgushqs/ulLnJckpJPgushqs_j1660268612133-irhkw2_t1660268841.003.jpg?ezimgfmt=rs%3Adevice%2Frscb1-1
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 868bd5abec74c14cb18590b5ea7d0363383146ea2171e65988508de0446a33ad

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 UTC
content-encoding: br
via: 1.1 5b2c25375d693d0fb882145cde66154e.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 132625
display: staticcontent_sol
x-amz-cf-pop: IAD55-P1
x-ezoic-cdn: Hit ds;mm;6c92a814c394b3da4b4f834fd6567e37;2-284837-44;d6b6ecaa-9c5e-4274-5111-f25641754319
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol
cf-cached-behind: true
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 03 May 2023 17:04:23 GMT
server: cloudflare
etag: "158d032a9a3b2d88abd2874043a31584-gzip"
x-origin-cache-control: max-age=2678400
vary: Accept-Encoding,X-Ezoic-Excludewebp,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uyYy6Iqugm5rKJ79R%2FVNTJyMfYmRgBWkwqtkEbnFIGdONmvL6%2F8llmuXYGa0Zzl%2Fcs8rBLHsCKefO0MqGpYBcjeYTUb8PJ489%2BdBCM3aQrf7kYLbZrbOvWdM2YZLLnCvz1E8dEdd"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=31536000
cf-ray: 79e0ded5dac33b8c-IAD
x-amz-cf-id: 5xP2GAE_9HoUhmX1GV-SDtaohq0YWAI2B7p5CQPN2LUQMm5oTkfykQ==

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ad6b4cd9fdd1156ea742d8806d7d22f787ac9570a365aaa3a4903e25fc820c6

Request headers

Referer
Origin: https://swiftmoves.blog
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 bridge3.572.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 854C 707 KB
226 KB 35ms
34ms Document
text/html 2607:f8b0:400c:c14::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c14::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b144069da3f1709d073fdb3895992e36a79a45b9f8db3a8bc3f52b54bc86115a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 64833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 231061
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Sun, 14 May 2023 12:30:40 GMT
expires: Mon, 13 May 2024 12:30:40 GMT
last-modified: Thu, 04 May 2023 18:03:20 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 108ms
36ms Script
text/javascript 2607:f8b0:400c:c12::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c12::95 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 15 May 2023 06:31:13 GMT

GET
H2 200 vid.gif
swiftmoves.blog/detroitchicago/ 43 B
146 B 24ms
24ms Image
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swiftmoves.blog/detroitchicago/vid.gif?e=%5B%7B%22domain_id%22%3A284837%2C%22url%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22pageview_id%22%3A%22ba088273-417b-4dd5-55f5-4f5fefddc39f%22%2C%22visit_uuid%22%3A%22a1f23fd0-d1c4-40a8-6413-68ddfcab03c2%22%2C%22template_id%22%3A134%2C%22video_impression_id%22%3A%22025c31b7-8e0e-4911-9a75-84017523ab03%22%2C%22media_src%22%3A%22https%3A%2F%2Fstreaming.humix.com%2Fcontents%2FulLnJckpJPgushqs%2F1681584557%2Findex.mpd%22%2C%22player_type%22%3A%22HTML5%22%2C%22video_title%22%3A%22JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F%22%2C%22video_position_id%22%3A3998%2C%22is_autoplay%22%3A1%2C%22is_floating%22%3A1%2C%22floating_option%22%3A0%2C%22is_playlist_item%22%3A0%2C%22is_preferred%22%3Afalse%2C%22vab_test_id%22%3A%22%22%2C%22vab_test_val%22%3A%22%22%2C%22video_length%22%3A297096%2C%22content_id%22%3A%22f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%22%2C%22width%22%3A640%2C%22height%22%3A360%2C%22pos_x%22%3A290%2C%22pos_y%22%3A4343%2C%22video_objects_count%22%3A1%2C%22video_objects_index%22%3A1%2C%22video_selection_type%22%3A9%2C%22video_match_score%22%3A69%2C%22is_blocker_on%22%3A0%2C%22video_source%22%3A%22upload%22%7D%5D
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
content-encoding: br
vary: Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 14 May 2023 06:31:12 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
935 B 73ms
23ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1171141
x-guploader-uploadid: ADPycdtXf3p7BEUcy1y5SWj7OAAhVCjuFfaiJGIpUMyUuzbCUx6UHIPRyC8U0GHDo4LbsVb8kofKn8cik2NF8j0iUXmYGGX8rfOP
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8RtuWhUZ1e60P7afNP1s4d3Zf7e1tSBtdXSUSM6w6KUFBlQOFAFRP9M3kfQE4xdIzQAGSM5NHE82SgxkG6y9lTMEaxqJtmM%2BMP6AN6LRPwth0i%2F%2B0Yiwfx%2BLlsY0UYgUUMFKJeBv3WGP7ci7Gw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7c795632ed9853e3-YYZ
expires: Mon, 01 May 2023 17:42:44 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
570 B 118ms
35ms Image
image/x-icon 173.194.215.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.215.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

vt-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 03:51:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9566
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 16 May 2023 03:51:47 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
344 B 74ms
24ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.04337543606585026
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1171141
x-guploader-uploadid: ADPycdtXf3p7BEUcy1y5SWj7OAAhVCjuFfaiJGIpUMyUuzbCUx6UHIPRyC8U0GHDo4LbsVb8kofKn8cik2NF8j0iUXmYGGX8rfOP
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zkJLtGgWvDIpxB8EQDKLohZvfm6UbeghetwtdebPSV0xiX7ka%2FQSXLGZQGfqFmrH5JCBhJjLJQEevYWA3n%2B42YVUQJebatN5xo%2F7FK5Jzy%2Bze%2FgX%2F6h6BwXaPhu1N%2BsamcRrmSj3zFHLQsFVnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7c795632ed9953e3-YYZ
expires: Mon, 01 May 2023 17:42:44 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
698 B 461ms
461ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=135626512608151&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=1&adks=2650088509&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D1%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D260%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16&eri=1&cust_params=amznbid%3D1%26amznp%3D1&sc=1&cookie_enabled=1&abxe=1&dt=1684132273061&lmt=1684132273&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0bba15deeaf2804de9ed3eaa9df6b44b14295c37d6004e0cdda5446ff5a4b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 668
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E0F9 6 KB
3 KB 125ms
37ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:13 GMT
expires: Tue, 14 May 2024 06:31:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
632 B 461ms
461ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1796920675624249&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=2&adks=180521375&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D5923801764085628%26eid%3D5923801764085628%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D1%26at%3Dmbf%26adr%3D398%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dswiftmoves_blog-medrectangle-2-5923801764085628%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D300%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C14%2C0%2C67%2C0%2C131%2C153%2C0%2C192%2C209%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16&eri=1&cust_params=amznbid%3D1%26amznp%3D1&sc=1&cookie_enabled=1&abxe=1&dt=1684132273077&lmt=1684132273&dlt=1684132272249&idt=516&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

181ac547acc8fd54be2e89194c22873c090baac24982c2183413eb5b2d3f9627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 602
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
627 B 575ms
575ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=4326188441675999&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=3&adks=798944132&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D1%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3D8de2c8ca79e8623e3cb37120a35ebaa2%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D240%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16&eri=1&cust_params=amznbid%3D1%26amznp%3D1&sc=1&cookie_enabled=1&abxe=1&dt=1684132273082&lmt=1684132273&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d6f19fc14bc6f7a6076a927f785e8cb73578175da88aa5ed604dd45675f5b5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 597
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E906 16 KB
6 KB 28ms
28ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33849
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 524 Show response
a.ad.gt/api/v1/u/matches/ 11 KB
4 KB 94ms
30ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/524?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fswiftmoves.blog%2F&ref=&_it=amazon&partner_id=524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca4a9b22c41a2348ec64c7094258c0c74f7b6ea879ec243a3c6265506e87b769

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:30:18 GMT
server: cloudflare
age: 55
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 7c7956334f5da247-YYZ

GET
H2 200 ulLnJckpJPgushqs_j1660268612133-irhkw2_t1660268841.vtt Show response
video-meta.humix.com/thumbnails/ulLnJckpJPgushqs/ 3 KB
4 KB 96ms
26ms XHR
binary/octet-stream 2606:4700:3032::6815:55f9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-meta.humix.com/thumbnails/ulLnJckpJPgushqs/ulLnJckpJPgushqs_j1660268612133-irhkw2_t1660268841.vtt
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:55f9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bcadae348c742fed894169fd58371a1cca2ae91a68d1f110b2dd7263708f228

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 d4269b452831f0e203a89d437c84974c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: HIO50-C2
age: 1122
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3157
last-modified: Fri, 12 Aug 2022 01:47:26 GMT
server: cloudflare
etag: "9dc41870ce745f8cc61097b67b925508"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pA0KGh71cMtcOO9k6CeZYWJUJAhoy2%2FYkMY1pF0g7lL02yTLiQP7e%2FI1BsUX%2FzL%2F%2BhNmBoH6uTovbZMPi3SKy%2Bs7UGFa1HUzq4N9CftZx981utXUzI1UoRYVHuyMSONHILdWdqBuxRqKNu8RxNXW6fzFmw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795633b97153e9-YYZ
x-amz-cf-id: _39BmDIu7KQg_diWOyKUHgU6v4CmZRu4Mxv4TUblKkSdVnzdxE8cfw==

GET
H2 200 index.mpd Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 6 KB
6 KB 104ms
42ms XHR
text/xml 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/index.mpd
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b2ef546e7a9d6614e566dab7d82d84b5864d01b1a2b15880d5b9ef8e5bb5a31

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1123
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YCu9IhcMWSBydgbD5IAB5UNlTDKr%2B46taNOmfs0papI%2Fy0yabD9jDtMEPj2QDcjFRPtyulEwNGGsIXXQZcUt48NyRTbA0fvCMV%2FYIQ3pZLGRDERsZDhPHiRW5VIf%2FZ1ND2SITQ7FxdkwPiOMpeaJGSuI"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795633bdb65431-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5924

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 8E56
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_so...
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_so...

419 B
1 KB

46ms
46ms

Document
text/html

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

9151836727e3f8427b7abe96a69103ceb326d2d4b016a0c0b130f451608aaa9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 419
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: N2RASB52QG0SZ9XXQXB0

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: GA5DGBJYA637RTXAQBQR

GET
H2 200 pixel;r=540675400;labels=Domain.swiftmoves_blog%2CDomainId.284837;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fswiftmoves.blog%2F;uht=2;fpan=1;fpa=P0-637578525-1684132272823;pbc=;ns=0;ce=1;qjs=1;qv=c81...
pixel.quantserve.com/ 35 B
371 B 25ms
23ms Image
image/gif 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=540675400;labels=Domain.swiftmoves_blog%2CDomainId.284837;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fswiftmoves.blog%2F;uht=2;fpan=1;fpa=P0-637578525-1684132272823;pbc=;ns=0;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;us_privacy=1---;ref=;d=swiftmoves.blog;dst=0;et=1684132273267;tzo=0;ogl=locale.en_US%2Ctype.website%2Ctitle.Swift%20Moves%2Curl.https%3A%2F%2Fswiftmoves%252Eblog%2F%2Csite_name.Swift%20Moves;ses=2f4cb2db-8d5e-4cd5-b9ae-9a0900685ac9;mdl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
656 B 712ms
711ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=2968966164570713&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2%2Cswiftmoves_blog-box-1%2Cswiftmoves_blog-large-billboard-2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=250x250%2C250x250%2C320x50%7C336x280%7C200x200%7C234x60%7C300x250%7C120x240%7C320x100%7C180x150%7C125x125%7C320x50%7C250x250&fluid=0%2C0%2Cheight&ifi=4&adks=2128035842%2C1937768148%2C1801785216&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D1%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3D8de2c8ca79e8623e3cb37120a35ebaa2%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D240%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%7Ca%3D%257C0%257C%26iid1%3D9208762842146216%26eid%3D9208762842146216%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1127%26sap%3D1127%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D1%26at%3Dmbf%26adr%3D398%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dswiftmoves_blog-box-1-9208762842146216%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D300%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26amznbid%3D1mbwjy8%26amzniid%3DJHrZWHjL83chvnl7_FvuGisAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICALX6OG%26amznsz%3D250x250%26amznp%3D1k1hwjk%7Ca%3D%257C0%257C%26iid1%3D7268655742164335%26eid%3D7268655742164335%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1134%26sap%3D1134%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D1%26at%3Dmbf%26adr%3D398%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D34%26al%3D1034%26compid%3D0%26tap%3Dswiftmoves_blog-large-billboard-2-7268655742164335%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D300%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%26amznbid%3Dm90cg%26amzniid%3DJI6RXb6JJCXDGvZ5XFg3AzsAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCfv8gz%26amznsz%3D336x280%26amznp%3D1k1hwjk&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1684132273273&lmt=1684132273&dlt=1684132272249&idt=516&adxs=495%2C1095%2C1040&adys=215%2C275%2C1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250%7C280x264%7C360x264&msz=250x250%7C250x250%7C360x250&fws=0%2C0%2C0&ohw=0%2C0%2C0&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cb2a9c83c7a55f8a2256b074161114d7f8591a3b6d93b36748a88f9314529974

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 626
x-xss-protection: 0
google-lineitem-id: -2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 88908589-3397-4f03-878f-9f8bd879c0d0
https://swiftmoves.blog/ 5 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/88908589-3397-4f03-878f-9f8bd879c0d0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c12e54fac2a52a04d3c8b0c7af32ae3ddce2134dcbeeae215e2e1ec691dd9aab

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 5497
Content-Type: application/javascript

GET
BLOB 200
OK b9563b94-3be6-483f-be28-813e3c2cb4a9
https://swiftmoves.blog/ 78 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/b9563b94-3be6-483f-be28-813e3c2cb4a9
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: accdfd1ed287d30475e76e8a486c57f5251940b8137efb68ceec84bc8f63b6e9

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 79363
Content-Type: application/javascript

GET
BLOB 200
OK 98289e92-fbe8-4838-b0eb-b3faaf0110a9
https://swiftmoves.blog/ 78 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/98289e92-fbe8-4838-b0eb-b3faaf0110a9
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: accdfd1ed287d30475e76e8a486c57f5251940b8137efb68ceec84bc8f63b6e9

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 79363
Content-Type: application/javascript

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/obUserFrame/ Frame ABD8 2 KB
1 KB 26ms
25ms Document
text/html 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/obUserFrame/test.html?lsd=81c43d41-3f25-4c47-b961-3db682ce599a
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 45f0f27fb78191006375051ee3046fae3105b652d11680432511cba61b32c330

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-encoding: gzip
content-length: 686
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
etag: "1e015194a0e596827cb8971f884eb43c:1684079997.052549"
expires: Mon, 22 May 2023 06:31:13 GMT
last-modified: Sun, 14 May 2023 14:24:00 GMT
server: AkamaiNetStorage
timing-allow-origin: * *
vary: Accept-Encoding

GET
H2 200 put.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 30D5 416 B
752 B 26ms
24ms Document
text/html 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4f3b933077b738b503f7543ffc82fa0a061f0fe7d0ff1470865fde561a324bcc

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-length: 416
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
etag: "c0311cf15c21ddda054005e92fad3f9e:1684079992.62466"
expires: Mon, 22 May 2023 06:31:13 GMT
last-modified: Sun, 14 May 2023 14:24:00 GMT
server: AkamaiNetStorage
timing-allow-origin: * *

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
80 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjQzMzQwNDA4MTI4NzEzIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6InN3aWZ0bW92ZXNfYmxvZy1uYXRpdmVzaW5nbGUtMSIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkxLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MiwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOjB9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:13 GMT

GET
H2 200 ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/ 2 KB
3 KB 26ms
24ms Image
image/png 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 14 Jun 2023 06:31:13 GMT
date: Mon, 15 May 2023 06:31:13 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "c52b07e749f7a09fa7b97b7e195e06ce:1673369415.187551"
access-control-allow-methods: GET,POST
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2326
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 990 B
1 KB 28ms
26ms Image
image/svg+xml 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 14 Jun 2023 06:31:13 GMT
date: Mon, 15 May 2023 06:31:13 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "5ab8e16b5f46213840bcd403e349419c:1673369393.880194"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 990
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
330 B 363ms
88ms Fetch
text/plain 66.225.223.95
NTTA-3946

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=c62632dad57dd6a33aa5cac54e8c6521_6420_1684132272943&tm=690&eT=0&widgetWidth=351&widgetHeight=42&widgetX=240&widgetY=837&wRV=2010301&pVis=0&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=&ccpa=1---&cheq=0&rtt=470&oo=false&lo=608&odbreq=894&odbres=1363&cet=4g&to=1684132271920.6&umv=1&ll=0&chs=2&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 66.225.223.95 Sacramento, United States, ASN3949 (NTTA-3946, US),
Reverse DNS: sa.outbrain.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 15 May 2023 06:31:13 GMT
Access-Control-Expose-Headers: content-range
X-TraceId: 59eb576b6c4ceb8e40e584dc3b9d7ca1
Content-Length: 2
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8

GET
H2 200 obUserSync.html Show response
widgets.outbrain.com/widgetOBUserSync/ Frame A2BE 19 KB
6 KB 32ms
31ms Document
text/html 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ee8686e5b72a3d816d62a607cd65e758e9c258ae8a2f941a5413dc6d2e64df13

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-encoding: gzip
content-length: 6040
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
etag: "37202485ed061a936935162db30e773e:1683699701.334072"
expires: Mon, 22 May 2023 06:31:13 GMT
last-modified: Wed, 10 May 2023 06:16:26 GMT
server: AkamaiNetStorage
timing-allow-origin: * *
vary: Accept-Encoding

GET
H2 200 streamFeed.js Show response
widgets.outbrain.com/nanoWidget/2010301/module/ 32 KB
13 KB 29ms
28ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/2010301/module/streamFeed.js?e=1
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 811b5b33335287da210f782a0de3d8b33502ff3c4a754865430be3407df0e1c6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
content-length: 12554
last-modified: Sun, 14 May 2023 14:24:00 GMT
server: AkamaiNetStorage
etag: "d5472edf2fb8386fac3040f3f06cba54:1684079984.47149"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Mon, 22 May 2023 06:31:13 GMT

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 599 B
1 KB 300ms
99ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

739dad3f4bc963c0663ee7c35489a665798de4803de0e3d1e524d1c4d8ff9ea4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame E906 2 KB
3 KB 79ms
23ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=523207&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 9bc16c94c43e0cb2eabbb8e359513d21d7b663f19b0fb08a5cce1acf37d8aad2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:12 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 country Show response
api.btloader.com/ 16 B
141 B 76ms
42ms Fetch
application/json 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 8bd69d0dddab8bc553263c254faad469c2a3e08bfb0b737e763f7feabe571225

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2 204 pv Show response
api.btloader.com/ 0
128 B 75ms
41ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=yZqNPzeX&w=5380972227330048&o=5112081056530432&cv=2.1.11-3-gabc8642&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fswiftmoves.blog%2F&sid=IHSOwfEOUf&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrainimg.com/loggerServices/ 4 B
371 B 109ms
21ms Fetch
application/json 64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=c62632dad57dd6a33aa5cac54e8c6521&pvId=c62632dad57dd6a33aa5cac54e8c6521&sid=7473619&pid=6420&idx=0&wId=101&pad=0&org=0&tm=812&eT=3&cnsnt=1---&wRV=2010301&pVis=0&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=0&oo=false&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: bf8844004b352e221158b717ed9c9f24
Content-Length: 4
Expires: 0

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 30D5 610 B
947 B 27ms
27ms Document
text/html 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/test.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6139e1fc0d3709eebbe2b18510cf24361b9f8a538c3529a73c282bafe6c78474

Request headers

Referer: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-length: 610
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
etag: "48053d50141031b1511dbd30f9a31288:1684079993.364507"
expires: Mon, 22 May 2023 06:31:13 GMT
last-modified: Sun, 14 May 2023 14:24:00 GMT
server: AkamaiNetStorage
timing-allow-origin: * *

GET
H2 200 524 Show response
p.ad.gt/api/v1/p/ 40 KB
12 KB 95ms
29ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://p.ad.gt/api/v1/p/524
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/524?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae3c37f4fe72bcfefada6a3a325f0b3b141961b2f014ec10c898418599d532ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:30:52 GMT
server: cloudflare
age: 21
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 7c7956357984a252-YYZ

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&adnxs_id=$UID&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001684132273-7U8ZJF23-NETU%26adnxs_id%3D%24UID%26gdpr%3D0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&adnxs_id=2829111677345209672&gdpr=0

43 B
97 B

106ms
106ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&adnxs_id=2829111677345209672&gdpr=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c795635d95bf981-YYZ
content-length: 43
content-type: image/gif

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 96ec7c6b-ec5a-417a-8ef8-5a802fab5a6b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&adnxs_id=2829111677345209672&gdpr=0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001684132273-7U8ZJF23-NETU&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001684132273-7U8ZJF23-NETU&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=cb640652-5013-46a4-8cfe-1b84d3b7b490&id=AU1D-0100-001684132273-7U8ZJF23-NETU

43 B
97 B

108ms
101ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=cb640652-5013-46a4-8cfe-1b84d3b7b490&id=AU1D-0100-001684132273-7U8ZJF23-NETU
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c795635f976f981-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ids.ad.gt/api/v1/t_match?tdid=cb640652-5013-46a4-8cfe-1b84d3b7b490&id=AU1D-0100-001684132273-7U8ZJF23-NETU
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 259

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001684132273-7U8ZJF23-NETU
https://ids.ad.gt/api/v1/pbm_match?pbm=41DA1833-16BC-41FB-8168-95B4325D28EC&id=AU1D-0100-001684132273-7U8ZJF23-NETU

43 B
114 B

110ms
108ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=41DA1833-16BC-41FB-8168-95B4325D28EC&id=AU1D-0100-001684132273-7U8ZJF23-NETU
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c795635a92df981-YYZ
content-length: 43
content-type: image/gif

Redirect headers

location: https://ids.ad.gt/api/v1/pbm_match?pbm=41DA1833-16BC-41FB-8168-95B4325D28EC&id=AU1D-0100-001684132273-7U8ZJF23-NETU
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 204
No Content token
token.rubiconproject.com/ 0
696 B 122ms
25ms Image
text/plain 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001684132273-7U8ZJF23-NETU&gdpr=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001684132273-7U8ZJF23-NETU&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001684132273...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001684132273-7U8ZJF23-NETU&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001684...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c141b74b-22ea-414f-bc66-57ef6830a0e2%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=c141b74b-22ea-414f-bc66-57ef6830a0e2%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&tapad_id=c141b74b-22ea-414f-bc66-57ef6830a0e2

43 B
96 B

103ms
103ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&tapad_id=c141b74b-22ea-414f-bc66-57ef6830a0e2
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c7956372a1af981-YYZ
content-length: 43
content-type: image/gif

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&tapad_id=c141b74b-22ea-414f-bc66-57ef6830a0e2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

g_match
ids.ad.gt/api/v1/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001684132273-7U8ZJF23-NETU
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm=&google_sc=&google_ula=450542624&id=AU1D-0100-001684132273-7U8ZJF23-NETU&google_tc=
https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&google_gid=CAESEAQ-2cB6UotSWpEk1q6J2Ew&google_cver=1&google_ula=450542624,0

43 B
97 B

114ms
103ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&google_gid=CAESEAQ-2cB6UotSWpEk1q6J2Ew&google_cver=1&google_ula=450542624,0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c79563699c4f981-YYZ
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ids.ad.gt/api/v1/g_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&google_gid=CAESEAQ-2cB6UotSWpEk1q6J2Ew&google_cver=1&google_ula=450542624,0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 357
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001684132273-7U8ZJF23-NETU
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY4NDEzMjI3My03VThaSkYyMy1ORVRV

170 B
188 B

58ms
47ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY4NDEzMjI3My03VThaSkYyMy1ORVRV

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-39-235-222.us-west-2.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTY4NDEzMjI3My03VThaSkYyMy1ORVRV
date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c7956357904f981-YYZ
content-type: text/html; charset=utf-8

GET
H2 200 cm
trc.taboola.com/sg/audigent/1/ 43 B
377 B 56ms
19ms Image
image/gif 2a04:4e42:200::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/audigent/1/cm?redirect=http%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Ftaboola%3Fpartner_uid%3D%3CTUID%3E%3Fid%3DAU1D-0100-001684132273-7U8ZJF23-NETU
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-vcl-time-ms: 9
pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 varnish
x-served-by: cache-yul12834-YUL
server: nginx
x-timer: S1684132273.485114,VS0,VE9
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 ip_match
ids.ad.gt/api/v1/ 0
152 B 164ms
101ms Image
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/ip_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c7956357906f981-YYZ
content-type: text/html; charset=utf-8

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&uid=277a2357-1e32-4313-9dd0-85518179de6d&gdpr=0

43 B
97 B

112ms
99ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&uid=277a2357-1e32-4313-9dd0-85518179de6d&gdpr=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c79563699c3f981-YYZ
content-length: 43
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&uid=277a2357-1e32-4313-9dd0-85518179de6d&gdpr=0
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
96 B 118ms
109ms Image
image/gif 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001684132273-7U8ZJF23-NETU&halo_id=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c795635a92cf981-YYZ
content-length: 43
content-type: image/gif

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame A2BE
Redirect Chain

https://idsync.rlcdn.com/420046.gif?partner_uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
https://idsync.rlcdn.com/1000.gif?memo=CM7RGRJMCkgIARC-ngEaQHBpbWZiVUtIX2thVzFRN1dGajM3UDVRLXQ3NXd1eVo1eWd0VndNODBSdHBFWWhyV1d3WGU2dTk0ZllIbU95NGsQABoNCLGjh6MGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=7876c1c8bac2a1a3f01eff02decd6fad5df99a8ac57b5bf42506c17f75410716791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA3ODc2YzFjOGJhYzJhMWEzZjAxZWZmMDJkZWNkNmZhZDVkZjk5YThhYzU3YjViZjQyNTA2YzE3Zjc1NDEwNzE2NzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA3ODc2YzFjOGJhYzJhMWEzZjAxZWZmMDJkZWNkNmZhZDVkZjk5YThhYzU3YjViZjQyNTA2YzE3Zjc1NDEwNzE2NzkxNDI2YjU0MTdkY2UyMRAAGgwIsaOHowYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=c01021fd-aa05-45cf-89cc-cd1e3f6904ff

42 B
60 B

50ms
48ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=c01021fd-aa05-45cf-89cc-cd1e3f6904ff
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=c01021fd-aa05-45cf-89cc-cd1e3f6904ff
date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 google
x-samesite: secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://b1sync.zemanta.com/usersync/outbrain/?puid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://b1sync.zemanta.com/usersync/outbrain/?gdpr=0&gdpr_consent=&initiator=ob&puid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&s=2&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=zemanta&uid=C6nyuN2bkrNfaVnYPFE0&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&initiator=ob&gdpr=0&us_privacy=1---

0
145 B

24ms
24ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=zemanta&uid=C6nyuN2bkrNfaVnYPFE0&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&initiator=ob&gdpr=0&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache
X-TraceId: 3dd39943c351b48da8ff9a7e56cfdb05
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://sync.outbrain.com/cookie-sync?p=zemanta&uid=C6nyuN2bkrNfaVnYPFE0&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&initiator=ob&gdpr=0&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 222
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://ib.adnxs.com/getuid?https://sync.outbrain.com/cookie-sync?p=appnexus&uid=$UID&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&ini...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dappnexus%26uid%3D%24UID%26obUid%3DpimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k%26gdpr...
https://sync.outbrain.com/cookie-sync?p=appnexus&uid=2829111677345209672&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob

0
145 B

121ms
23ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=appnexus&uid=2829111677345209672&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache
X-TraceId: b7ece9bc95d07ca2443920033c78e43c
Content-Length: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: eaa531e1-feea-48a1-ab83-05141f2f9516
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://sync.outbrain.com/cookie-sync?p=appnexus&uid=2829111677345209672&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame A2BE
Redirect Chain

https://dpm.demdex.net/ibs:dpid=133726&dpuuid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_pd=1&gdpr_consent=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_pd=1&gdpr_consent=

42 B
942 B

84ms
83ms

Image
image/gif

52.39.235.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_pd=1&gdpr_consent=

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

HTTP/1.1

Server

52.39.235.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

DCS: dcs-prod-usw2-2-v044-020e3e31c.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: wJbmeHE9TUA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-usw2-1-v044-07a8a508d.edge-usw2.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 8lknjjxIQZY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_pd=1&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK set
sync-jp.im-apps.net/imid/ Frame A2BE 43 B
740 B 450ms
237ms Image
image/gif 104.126.116.66
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-jp.im-apps.net/imid/set?cid=1000047&tid=obid&uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.126.116.66 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-126-116-66.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: private, max-age=3000
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=icco6m5&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1---
https://match.adsrvr.org/track/cmb/generic?ttd_pid=icco6m5&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=ttd&uid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

0
145 B

110ms
22ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=ttd&uid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache
X-TraceId: 65e3afab6947d1479caa15f712092181
Content-Length: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=ttd&uid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 241

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame A2BE 0
338 B 102ms
23ms Image
text/plain 35.168.219.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=outbrain&partner_uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.219.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-219-4.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-served-by: beacon-n033-ash-prod.krxd.net
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: private, no-cache, no-store
x-request-time: D=69 t=1684132273
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame A2BE 43 B
657 B 132ms
54ms Image
image/gif 13.249.85.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212295978&puid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-112.ord52.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 3b3cb210495e4d1678591271d0921206.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: ORD52-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: hLin4XcGL5xiyuL6KQzatOx2A18d_e0SK2CDZS9gicrJptDnPHWQXQ==
expires: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=outbrain&ssp_user_id=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&gdpr=0&gdpr_consent=&us_privacy=1---

0
145 B

40ms
24ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache
X-TraceId: d35e55c21f283ed9d6aebb99d6f6b238
Content-Length: 0

Redirect headers

location: //sync.outbrain.com/cookie-sync?p=mediaforce&uid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&gdpr=0&gdpr_consent=&us_privacy=1---
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://x.bidswitch.net/sync?ssp=outbrain&user_id=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&us_privacy=1---&gdpr=0&gdpr_pd=1&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=outbrain&user_id=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&us_privacy=1---&gdpr=0&gdpr_pd=1&gdpr_consent=
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=outbrain&bsw_custom_parameter=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&gdpr_pd=1
https://x.bidswitch.net/sync?dsp_id=413&ssp=outbrain&user_id=csonata_096c2375-7099-4d7f-8f0f-c442ea271410&bsw_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb&expires=10&gdpr=0&gdpr_consent=&gdpr_pd=1
https://sync.outbrain.com/cookie-sync?p=bidswitch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=

0
145 B

22ms
22ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=bidswitch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 7a214e172214acac880eb3e10a57e3a0
Content-Length: 0

Redirect headers

Location: //sync.outbrain.com/cookie-sync?p=bidswitch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&gdpr_pd=1&us_privacy=
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame A2BE 43 B
363 B 81ms
25ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=74&p=126&cp=outbrain&cu=1&url=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcriteo%26obUid%3DpimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26initiator%3Dob%26uid%3D%40%40CRITEO_USERID%40%40

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:12 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 412062
expires: Mon, 15 May 2023 00:00:00 GMT

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/ Frame A2BE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&google_dbm
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEBlcAmefO3bD_nFnWZYchow&google_cver=1
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=0c031c75-0dc5-47ab-a78c-92793a44c6bb

49 B
864 B

37ms
37ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=0c031c75-0dc5-47ab-a78c-92793a44c6bb

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: //sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=0c031c75-0dc5-47ab-a78c-92793a44c6bb
Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=25&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=activeagent&uid=7233293034695948443&gdpr=0&gdpr_consent=

0
145 B

40ms
24ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=activeagent&uid=7233293034695948443&gdpr=0&gdpr_consent=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 065f8d92ea9e4c7cf6d6f680831ff185
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=activeagent&uid=7233293034695948443&gdpr=0&gdpr_consent=
Date: Mon, 15 May 2023 06:31:13 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/ Frame A2BE
Redirect Chain

https://ps.eyeota.net/match?bid=1mpn7m0&uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
https://ps.eyeota.net/match/bounce/?bid=1mpn7m0&uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k

70 B
440 B

24ms
24ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?bid=1mpn7m0&uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /match/bounce/?bid=1mpn7m0&uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Date: Mon, 15 May 2023 06:31:13 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
id.geistm.com/m/OB/ Frame A2BE 0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://creativecdn.com/cm-notify?pi=outbrain&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://creativecdn.com/cm-notify?pi=outbrain&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&tc=1
https://sync.outbrain.com/cookie-sync?p=rtbhouse&uid=VpfbHUC29S3305XiHykA&pi=outbrain&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&ini...

0
145 B

37ms
23ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rtbhouse&uid=VpfbHUC29S3305XiHykA&pi=outbrain&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&tc=1
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 8144c64896f849b5f8d5353ac181fb9e
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=rtbhouse&uid=VpfbHUC29S3305XiHykA&pi=outbrain&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&tc=1
pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT, Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LHOGVEZ1-17-H6WS&gdpr=0&us_privacy=1---

0
145 B

71ms
23ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LHOGVEZ1-17-H6WS&gdpr=0&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache
X-TraceId: a49b609b093c2aacf14147c2718ee18e
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LHOGVEZ1-17-H6WS&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H2 403 tpid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
sync.crwdcntrl.net/map/c=14516/tp=OBRN/ Frame A2BE 49 B
269 B 74ms
23ms Image
image/gif 54.235.118.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=14516/tp=OBRN/tpid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.118.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-118-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.3.230
content-length: 49
expires: 0

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame A2BE
Redirect Chain

https://loadus.exelator.com/load/?p=580&g=2&j=0&buid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
https://loadus.exelator.com/load/?p=580&g=2&j=0&buid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&xl8blockcheck=1
https://idsync.rlcdn.com/397416.gif?partner_uid=9aa0a57594b1aa858e0bef445a978940
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=edb722a5-4cdc-0d09-123b-6d34972d7887

42 B
60 B

43ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=edb722a5-4cdc-0d09-123b-6d34972d7887
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=edb722a5-4cdc-0d09-123b-6d34972d7887
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DpimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpE...
https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&ini...

0
145 B

28ms
26ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache
X-TraceId: 6bd349bf08c5c962f78bf236d69ed332
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 0
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame A2BE
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160065&gdpr=PM_GDPR&gdpr_consent=PM_CONSENT&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160065%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=-1&gdpr_consent=PM_CONSENT
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=5a3a2ac8e3c9105e&is_secure=true&networkId=17100&version=1&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=-1&gdpr_consent=PM_CONSENT
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMfi2JneWE_QMpHxCMAAAAAAA&expiration=1684218674&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=PM_CONSENT
https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=da289973-f669-4adc-a84d-be5c17460972&gdpr=0&gdpr_consent=PM_CONSENT
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=PM_CONSENT
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&gdpr_consent=PM_CONSENT&p=158355&pmc=1&pr=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F303%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D8220b2d...
https://prebid.a-mo.net/cchain/1/303?gdpr=&gdpr_consent=&us_privacy=&A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=pubmatic&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&...
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F3%2F303%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D8220b2d1-4aec-4d94-9d18-b2fae200...
https://prebid.a-mo.net/cchain/3/303?gdpr=&gdpr_consent=&us_privacy=&A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=sovrn&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&uid...
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F303%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D8220b2d1-4aec-4d94-9d18-b2fae200417f%26bidder%3Dappnexus%26cbx%3DaHR0c...
https://prebid.a-mo.net/cchain/5/303?gdpr=&gdpr_consent=&us_privacy=&A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=appnexus&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&...
https://cs.minutemedia-prebid.com/cs?aid=21492&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=&gdpr_consent=&us_privacy=

0
283 B

23ms
23ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://widgets.outbrain.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21492&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=&gdpr_consent=&us_privacy=
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://u.openx.net/w/1.0/cm?id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26initiator%3Dob%26...
https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&uid=086074c4-fe75-0695-2e2d-bf...

0
145 B

72ms
23ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&uid=086074c4-fe75-0695-2e2d-bf6a160dde74
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 6836ff7797a21e0dc995fc52ba8463e4
Content-Length: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&uid=086074c4-fe75-0695-2e2d-bf6a160dde74
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58523/occ?gdpr=0&gdpr_consent=&us_privacy=1---&redir=true
https://sync.outbrain.com/cookie-sync?p=oath&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A&gdpr=0

0
145 B

29ms
20ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=oath&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A&gdpr=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 9ca7017af6c161f561b4b4c2f30bebdb
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=oath&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A&gdpr=0
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://ice.360yield.com/server_match?partner_id=1863&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dimprove_digital%26uid%3D%7BPUB_USER_ID%7D%26obUid%3DpimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVw...
https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=22faed01-3036-432e-91a1-6e13b35ccecc&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_priva...

0
145 B

25ms
24ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=22faed01-3036-432e-91a1-6e13b35ccecc&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: cae6796bc7d6ad6a3196d4c8dcd8fc05
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=22faed01-3036-432e-91a1-6e13b35ccecc&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:13 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DpimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k%26gd...
https://sync.outbrain.com/cookie-sync?p=smaato&uid=be13326f&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob

0
145 B

24ms
24ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=smaato&uid=be13326f&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 0d01901b4090e8711ff832dd1efff046
Content-Length: 0

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 e82b003e5929abce569292fc53dbf254.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: CMH68-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=smaato&uid=be13326f&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 27Ww4QGN1JPy2f_z5R6FU32HQgAkWIHzsaTRLpI4D_mIM9-fODn9rw==

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=30&gdpr=0&gdpr_consent=&redirectUri=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmart%26uid%3D%5Bssb_sync_pid%5D%26obUid%3DpimfbUKH_kaW1Q...
https://sync.outbrain.com/cookie-sync?p=smart&uid=4857008915831342889&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob

0
145 B

27ms
25ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=smart&uid=4857008915831342889&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 23c77b54cb6912b816c60d9e141dda29
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=smart&uid=4857008915831342889&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 0

GET
H2 200 c.gif
c.bing.com/ Frame A2BE 42 B
666 B 108ms
32ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
last-modified: Thu, 04 May 2023 15:33:20 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8D77128E29F64FF9AB5EE031E1A8260B Ref B: YMQ01EDGE0620 Ref C: 2023-05-15T06:31:14Z
etag: "231a8c19d7ed91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://id.rlcdn.com/711945.gif?ct=4&cv=
https://sync.outbrain.com/cookie-sync?p=liveramp&uid=&

0
145 B

21ms
19ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=liveramp&uid=&
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 0a66ceb543aa595b30aa7172d5adf73e
Content-Length: 0

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.outbrain.com/cookie-sync?p=liveramp&uid=&
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=127&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcentro%26uid%3D%7BuserId%7D%26obUid%3DpimfbUKH_...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=127&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcentro%26uid%3D%7BuserId%7D%26obUid%3...
https://sync.outbrain.com/cookie-sync?p=centro&uid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_...

0
145 B

26ms
23ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=centro&uid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: e92e4c36a16a82a36b6c802fe1972e61
Content-Length: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://sync.outbrain.com/cookie-sync?p=centro&uid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://cms.quantserve.com/pixel/p-cxanv6hYFn1kw.gif?idmatch=0&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=quantcast&gdpr=0&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&uid=xJyGmJaZ0pjfnITNl8udm8qd1M_fm4HMkcoegprS

0
145 B

24ms
23ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=quantcast&gdpr=0&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&uid=xJyGmJaZ0pjfnITNl8udm8qd1M_fm4HMkcoegprS
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: b1d7275696fa63c46cda87b7e1ca1911
Content-Length: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://sync.outbrain.com/cookie-sync?p=quantcast&gdpr=0&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&uid=xJyGmJaZ0pjfnITNl8udm8qd1M_fm4HMkcoegprS
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

400
Bad Request

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562709&ev=1&us_privacy=${us_privacy}&rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dpulsepoint%26uid%3D%25%25VGUID%25%25%26obUid%3DpimfbUKH_kaW1Q7WF...
https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid=UMxte5rHSSDS&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&ev=1&us_...

0
84 B

22ms
19ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid=UMxte5rHSSDS&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&ev=1&us_privacy=${us_privacy}&pid=562709
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Content-Length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid=UMxte5rHSSDS&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&ev=1&us_privacy=${us_privacy}&pid=562709
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/ Frame A2BE
Redirect Chain

https://id5-sync.com/s/164/9.gif?puid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F3%2F8%2F2.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
https://id5-sync.com/c/164/3/8/2.gif?puid=102b6461-d1b1-4f00-b06c-5186e28fb05c&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F434%2F7%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/164/434/7/3.gif?puid=277a2357-1e32-4313-9dd0-85518179de6d&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/164/2/6/4.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/164/2/6/4.gif?puid=2829111677345209672&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F108%2F5%2F5.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/164/108/5/5.gif?puid=c141b74b-22ea-414f-bc66-57ef6830a0e2&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F112%2F4%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F112%2F4%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/164/112/4/6.gif?puid=83EBEECDE5202F11&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F441%2F3%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/164/441/3/7.gif?puid=u_71b8ac05-8145-406f-9fd1-b5d091727fba&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F429%2F2%2F8.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/164/429/2/8.gif?puid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%
https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&consent=&id5id=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ

49 B
868 B

73ms
27ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&consent=&id5id=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:15 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&consent=&id5id=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ
date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame A2BE
Redirect Chain

https://cm.rtbsystem.com/usermatch/ob?redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Drtbsystem%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26uid%3D%7Buserid%7D%26initiator%3Dob%2...
https://sync.outbrain.com/cookie-sync?p=rtbsystem&gdpr=0&gdpr_consent=&us_privacy=1---&uid=1ed67777-236a-5969-aa1f-c774783ee25d&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWw...

0
145 B

22ms
22ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rtbsystem&gdpr=0&gdpr_consent=&us_privacy=1---&uid=1ed67777-236a-5969-aa1f-c774783ee25d&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 4d055f6822a232e55cfc5a7cb1299eab
Content-Length: 0

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ndj15X3qJRzJIlWeK2APmFdlV3ygRpKeimBylDKJUMpj6UFEHLBSbmR%2BV%2F1DiKC6gsAxGX7tpstk5NdTFk19owX1Cny7rnKOuAPWN%2BsEMaflVxW9Cm41EJfdp8f7M2D9NJYGMOCXPESuF5nzdm5C"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://sync.outbrain.com/cookie-sync?p=rtbsystem&gdpr=0&gdpr_consent=&us_privacy=1---&uid=1ed67777-236a-5969-aa1f-c774783ee25d&initiator=ob&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
cf-ray: 7c79563a7b5aa1f0-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame B706 2 KB
815 B 32ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1684132273346

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B9C6 16 KB
6 KB 24ms
23ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33849
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame C323 9 KB
4 KB 103ms
31ms Document
text/html 13.249.85.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-56.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b24b19152e92ee2240cdf53444b33a1b8ec286e9a44072890c5490c9d8ddfa3d

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 74469
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Sun, 14 May 2023 09:50:05 GMT
etag: W/"fd0102e5847015626666169917857ba8"
last-modified: Wed, 12 Apr 2023 16:16:50 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 b892209f8d3dd056b68bdca7e0c07418.cloudfront.net (CloudFront)
x-amz-cf-id: mxs6KxPz3R29FOdurrL246cQo8uOqXWvCJn59vnVxaWCEidC2iJ7Yg==
x-amz-cf-pop: ORD52-C1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:b4af218c-2bc9-4531-9210-521693d9d5d7
x-amz-meta-codebuild-content-md5: 9cec9a15b660da7393081e2fc6c34731
x-amz-meta-codebuild-content-sha256: 8e6d48a695640d90e0623cd4e573f94721be8c1becd249758c7df42fcffde7be
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H2 200 get Show response
mv.outbrain.com/Multivac/api/ 42 KB
11 KB 299ms
290ms Script
text/javascript 146.75.38.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mv.outbrain.com/Multivac/api/get?scrW=1600&fab=11984-89554&px=240&py=849&winW=1600&rand=35153&sig=QuwZhUlG&osLang=en-US&widgetjsid=AR_2&scrH=1200&wl=0&recs=true&ogn=https%3A%2F%2Fswiftmoves.blog%2F&abwl=false&winH=1200&key=EZOICL9MFJN21JB32NFBE7ODP&activeTab=true&adblck=false&cmpStat=0&settings=true&ab=0&widgetJSId=AR_2&apv=false&dpr=1&format=html&va=true&vpd=0&nextURL=true&version=2010301&feedIdx=0&url=http%3A%2F%2Fwww.ezoic.com%2Fswiftmoves.blog%3Foburltocrawl%3Dhttps%253A%252F%252Fswiftmoves.blog%252F&et=true&chs=1&contentUrl=https%3A%2F%2Fswiftmoves.blog%2F&extid=284837_1_191_100x240&feedIdx=0&secured=true&ccpa=1---&ccpaStat=1&lastIdx=1000&lastCardIdx=0&t=YzYyNjMyZGFkNTdkZDZhMzNhYTVjYWM1NGU4YzY1MjE=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/2010301/module/streamFeed.js?e=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.38.132 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9bb63d607129f7d71f664938454f5f21c7a468656f128df30d4f542f65f901fa

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: br
via: 1.1 varnish
traffic-path: SADC1, IAD, North_America
x-cache: MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
x-traceid: c2624e4a4f02a87a51b78ff22c8af876
content-length: 10741
x-served-by: cache-iad-kcgs7200070-IAD
pragma: no-cache
x-timer: S1684132274.559585,VS0,VE267
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
165 B 37ms
35ms Script
application/javascript 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 37ms
36ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
823 B 487ms
487ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=2320137887434351&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=7&adks=2423740104&sfv=1-0-40&ists=1&fas=8&prev_scp=tap%3Dswiftmoves_blog-pixel1-1297728224135626%26ap%3D9999%26reft%3Dn%26avc%3D186%26ic%3D1%26d%3D284837%26br1%3D280%26br2%3D180%26iid1%3D1297728224135626%26bra%3Dmod178%26eb_br%3Dc16fac08e79a971524b1c6834f5caad3%26ga%3D2497208%26bvr%3D8%26al%3D1006%26ezoic%3D1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1684132273493&lmt=1684132273&dlt=1684132272249&idt=516&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38575d7b082c4ed63869fb626b818290489b0285df813c5ac9f492061a8f493b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 793
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/ 36 KB
13 KB 41ms
40ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl_page_level_ads.js?cb=31074524

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e73751edcf8a770dfa49af6704e25e8bde8bfda726379437f9f015c5785f5f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 11:14:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69376
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12858
x-xss-protection: 0
server: cafe
etag: 2634796304427349734
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 13 May 2024 11:14:57 GMT

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame A79D 5 KB
5 KB 29ms
28ms Document
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

4281bfa978e092eed1ae6481ad1444f01c031420afa183b45a3f7fcd72c8f352

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 4817
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: SS661KH7R3SYT44B61JM

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 651F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZGHRsQAKKKWZKgAp&gdpr=1&gdpr_consent=&_test=ZGHRsQAKKKWZKgAp

0
225 B

38ms
18ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZGHRsQAKKKWZKgAp&gdpr=1&gdpr_consent=&_test=ZGHRsQAKKKWZKgAp
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:11 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZGHRsQAKKKWZKgAp&gdpr=1&gdpr_consent=&_test=ZGHRsQAKKKWZKgAp
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-yul12825-YUL
x-timer: S1684132274.622853,VS0,VE0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6596
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1783777321620245001

42 B
291 B

39ms
18ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1783777321620245001
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Mon, 15 May 2023 06:31:13 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=1783777321620245001
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 4CEE 43 B
855 B 55ms
34ms Document
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=41DA1833-16BC-41FB-8168-95B4325D28EC&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: E2BTBMXBAW9GT40HZ9GM

GET
H2 200 setuid Show response
ow.pubmatic.com/ Frame FCE5 0
293 B 37ms
22ms Document
text/html 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://ow.pubmatic.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 0
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E906
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QdoYMxa8QfuBaJW0Ml0o7A%3D%3D&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QdoYMxa8QfuBaJW0Ml0o7A%3D%3D&gdpr=0&gdpr_consent=&google_tc=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

37ms
26ms

Image
text/html

23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=33849
accept-ranges: bytes
content-length: 5554
expires: Mon, 15 May 2023 15:55:22 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame E906
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=41DA1833-16BC-41FB-8168-95B4325D28EC
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=c141b74b-22ea-414f-bc66-57ef6830a0e2%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

95 B
123 B

55ms
46ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 359

GET
H2

200

xuid
eb2.3lift.com/ Frame E906
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=41DA1833-16BC-41FB-8168-95B4325D28EC&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=41DA1833-16BC-41FB-8168-95B4325D28EC&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

40ms
27ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=41DA1833-16BC-41FB-8168-95B4325D28EC&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=41DA1833-16BC-41FB-8168-95B4325D28EC&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

insync
thrtle.com/ Frame E906
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=41DA1833-16BC-41FB-8168-95B4325D28EC&vxii_pid=12&vxii_pid1=10067&vxii_rcid=f44c0015-7266-449c-8180-f0098ef3912a

43 B
295 B

34ms
27ms

Image
image/gif

18.205.195.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=41DA1833-16BC-41FB-8168-95B4325D28EC&vxii_pid=12&vxii_pid1=10067&vxii_rcid=f44c0015-7266-449c-8180-f0098ef3912a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 18.205.195.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-195-138.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=41DA1833-16BC-41FB-8168-95B4325D28EC&vxii_pid=12&vxii_pid1=10067&vxii_rcid=f44c0015-7266-449c-8180-f0098ef3912a
date: Mon, 15 May 2023 06:31:13 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E906
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDFEQTE4MzMtMTZCQy00MUZCLTgxNjgtOTVCNDMyNUQyOEVD&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDFEQTE4MzMtMTZCQy00MUZCLTgxNjgtOTVCNDMyNUQyOEVD&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

27ms
20ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:12 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E906
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHN8RK_OvMm-I_96f5bFGAc&google_cver=1

42 B
299 B

31ms
20ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHN8RK_OvMm-I_96f5bFGAc&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEHN8RK_OvMm-I_96f5bFGAc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E906
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:B7D96E344B854AAEBEEA8D6B3EB4E207

42 B
288 B

21ms
21ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:B7D96E344B854AAEBEEA8D6B3EB4E207
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:B7D96E344B854AAEBEEA8D6B3EB4E207
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 14 May 2023 06:31:13 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E906
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8575394200595948846&gdpr=0&gdpr_consent=&us_privacy=

1 B
255 B

23ms
23ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8575394200595948846&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:11 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8575394200595948846&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 15 May 2023 06:31:12 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E906
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

42 B
376 B

126ms
19ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:18:31 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 355

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame E906
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=41DA1833-16BC-41FB-8168-95B4325D28EC&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=41DA1833-16BC-41FB-8168-95B4325D28EC&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-1JMlbK5E2uW_kcysYY8EL1aN6U0_8Z4-~A&gdpr=0

0
260 B

74ms
18ms

Image
text/plain

162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-1JMlbK5E2uW_kcysYY8EL1aN6U0_8Z4-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-1JMlbK5E2uW_kcysYY8EL1aN6U0_8Z4-~A&gdpr=0
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 41DA1833-16BC-41FB-8168-95B4325D28EC
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame E906 43 B
603 B 108ms
25ms Image
image/gif 2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/41DA1833-16BC-41FB-8168-95B4325D28EC?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

POST
H2 204 greenoaks.gif
swiftmoves.blog/detroitchicago/ 0
16 B 25ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDUtMTUifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInRfZXBvY2giOjE2ODQxMzIyNzIsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInRfZXBvY2giOjE2ODQxMzIyNzIsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiZGF0YSI6W3sibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiIxMjg0In1dfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:12 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
25ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTE5MiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJhZF9sb2FkX3RpbWUiLCJ2YWwiOiIxMjg0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:13 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImFkX2xvYWRfdGltZSIsInZhbCI6IjEyOTYifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:13 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A79D
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24%7BBSW_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=

43 B
479 B

42ms
32ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 2HXK91PN40NH9YQC5SDX
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=
Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame A79D
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1684132273693
https://ad.turn.com/r/cs?pid=45&rndcb=4783352973
https://sync.1rx.io/usersync/turn/8575394200595948846?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
https://ads.servenobid.com/sync?pid=321&uid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

0
362 B

24ms
23ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:14 GMT
Server: Tengine
ETag: RX48fe24f188bf46cd87343bca0e84d201005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ads.servenobid.com/sync?pid=321&uid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Content-Type: text/html
Connection: keep-alive

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A79D
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3271338731455157000V10

43 B
479 B

51ms
31ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3271338731455157000V10

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5B9RRQ2WXDF4A3HQRQAB
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3271338731455157000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Mon, 15 May 2023 06:31:13 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A79D
Redirect Chain

https://match.prod.bidr.io/cookie-sync/amzn?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID
https://match.prod.bidr.io/cookie-sync/amzn?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID&_bee_ppp=1
https://s.amazon-adsystem.com/ecm3?id=AAC5aU7Iw6MAACKiklmZXA&ex=beeswax.com

43 B
479 B

44ms
42ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=AAC5aU7Iw6MAACKiklmZXA&ex=beeswax.com

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 2ZVJC9X65JRRZ3QZFZW5
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?id=AAC5aU7Iw6MAACKiklmZXA&ex=beeswax.com
Date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2 204 /
onetag-sys.com/match/ Frame A79D 0
148 B 25ms
9ms Image
text/plain 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A79D
Redirect Chain

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
https://s.amazon-adsystem.com/ecm3?id=36881F8882764BFBBAB2F6595BB0DFFB&ex=simpli.fi&status=ok

43 B
479 B

53ms
31ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=36881F8882764BFBBAB2F6595BB0DFFB&ex=simpli.fi&status=ok

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: X1T5GCYB5JZWRRQ75YX4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.amazon-adsystem.com/ecm3?id=36881F8882764BFBBAB2F6595BB0DFFB&ex=simpli.fi&status=ok
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 14 May 2023 06:31:13 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A79D
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=7gquK14NHC7G2jeIjfln

43 B
479 B

43ms
42ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=7gquK14NHC7G2jeIjfln

Requested by

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WSRZD554ZCEPCN59B74E
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Content-Type: text/html; charset=utf-8
Location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=7gquK14NHC7G2jeIjfln
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 101
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame BFF2 4 KB
2 KB 119ms
20ms Document
text/html 52.20.117.119
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.117.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-117-119.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 7a13413fdcd16837092ce421adb8effa55533e0aab0b2ac72ae7d565bcba4f59

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:13 GMT
etag: W/"0829f1850a8811841531c7f9948d55597"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
3 KB

23ms
21ms

Document
text/html

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: a90b8a0d9bfcb972809be1e0b836c6526bdfef99e3ec7c5d50eb90e616457115

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1869
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
Location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 9FF8
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

693 B
731 B

34ms
12ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: cca8092fef66b084a7013e958633ed5db4fa888c3cc0edbe7efb9cce3bf4bd9e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 398
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 62CC
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2166743647608391662&gdpr=0&gdpr_consent=

43 B
479 B

40ms
30ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2166743647608391662&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: XDR7B1P05MCW94NP2GYY

Redirect headers

content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=2166743647608391662&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 6CF7
Redirect Chain

https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=9517b50cd2d0fd8&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAInHvelJ2paQMisVF-AAAAAAA&expiration=1684218673&is_secure=true

43 B
479 B

32ms
32ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAInHvelJ2paQMisVF-AAAAAAA&expiration=1684218673&is_secure=true

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: CJ67HNDKJ16H3VB5FM07

Redirect headers

cache-control: no-cache, private, max-age=0, no-store
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
expires: 0
location: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAInHvelJ2paQMisVF-AAAAAAA&expiration=1684218673&is_secure=true
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma: no-cache
server: nginx

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 765B
Redirect Chain

https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ

43 B
479 B

44ms
36ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: RAP3YHEB7CT9JSAFZ68Z

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ
p3p: CP="CAO PSA OUR"
strict-transport-security: max-age=63072000; includeSubDomains; preload
transfer-encoding: chunked
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame 58DB 427 B
938 B 163ms
23ms Document
text/html 44.196.26.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.196.26.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-26-30.compute-1.amazonaws.com
Software: /
Resource Hash: 24f491dd88e1b5dde353925dd8051be7bf43097f26d1c09944dc5296b9adcad6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 427
date: Mon, 15 May 2023 06:31:13 GMT

GET
H2 200 tamptsync Show response
sync-amz.ads.yieldmo.com/ Frame 160B 973 B
1008 B 162ms
24ms Document
text/html 34.236.25.118
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.25.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-25-118.compute-1.amazonaws.com
Software: /
Resource Hash: a98ac0d3df0b25cc398b8c3ce6e3e318bd32cb3b07ba40bfa8333a4a47e362e7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Mon, 15 May 2023 06:31:13 GMT
pragma: no-cache
vary: accept-encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame DE93 281 B
554 B 108ms
28ms Document
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:13 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2

200

visitormatch Show response
bh.contextweb.com/ Frame ADF6
Redirect Chain

https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

828 B
2 KB

20ms
19ms

Document
text/html

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

a99c627a65935b372183a038453ee2cdce446214945905d23018ca1ec6ed19da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-CA
content-length: 828
content-type: text/html;charset=iso-8859-1
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-CA
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1
location: /visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 09A2
Redirect Chain

https://ups.analytics.yahoo.com/ups/58251/sync?redir=true
https://ups.analytics.yahoo.com/ups/58251/sync?redir=true&verify=true
https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS11T2VSR1ZKRTJ1Sjh1LmxkY0Fib2Y2eWM5M01rbHVLRn5B

43 B
479 B

38ms
31ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS11T2VSR1ZKRTJ1Sjh1LmxkY0Fib2Y2eWM5M01rbHVLRn5B

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: NMFS7QC7FX6TFHBKMTYK

Redirect headers

age: 0
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS11T2VSR1ZKRTJ1Sjh1LmxkY0Fib2Y2eWM5M01rbHVLRn5B
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server: ATS/9.1.10.57
strict-transport-security: max-age=31536000

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame B253
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
https://s.amazon-adsystem.com/ecm3?id=2829111677345209672&ex=appnexus.com

43 B
479 B

46ms
32ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=2829111677345209672&ex=appnexus.com

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: Z5W32GTST4BP0VG0J6NY

Redirect headers

AN-X-Request-Uuid: 1b52f4b3-ee2b-4c4c-82b5-5dc7bf26d678
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://s.amazon-adsystem.com/ecm3?id=2829111677345209672&ex=appnexus.com
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1

200
OK

amazon Show response
ce.lijit.com/beacon/ Frame 2D52
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

1 KB
1 KB

25ms
25ms

Document
text/html

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_smrt_cnv_n-inmobi_n-sharethrough_n-onetag_n-simpli.fi_ym_rbd_ppt_n-vmg_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: e12024ca4bb0d3ef232b173f5d80c695051cb4b4489c98f93e4934cb74e6e203

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 457
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
location: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
x-envoy-upstream-service-time: 0

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 4595
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2394646913815972036409

43 B
479 B

41ms
34ms

Document
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2394646913815972036409

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 8WWYTRQJCJRS6M1331MC

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2394646913815972036409
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 t1660268611_03_640x360p_30Hz_800Kbps_init.mp4 Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 840 B
1 KB 46ms
37ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_init.mp4
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc979f61e708f1d1e13c959fa9e30fd1d7b9364f3898de09d460289aa3c1b6a7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxCQ3ybWW%2F94yFq6VocsRDAwaMILrZO%2FNtIVNmTdHBx1bycHrIvydWyEyd7SNGMQkR3oG%2FJqM2tvvPlvV%2FS%2BDlfXwFQ%2B3cdFVo1biKOoCkDfCPf4GXDd18CYQTxOusaW%2BJZkY5YKwZcXe4a7EEIKWQp4"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795636284b5431-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 840

GET
H2 200 t1660268611_03_640x360p_30Hz_800Kbps_001.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 65 KB
65 KB 46ms
38ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_001.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81e5d7e29faa9e5f93b5361202ea9db4ebcd0fecb2169a920df5ef14ab375144

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRYmVYT9JKJlYkBRfIA9LMZbT0DJVe%2FzsQZsPt0m2U0AQwAvG7NXNc%2BxyoFTS2Hbjm9tnn1m6qVp3i112CrlYXvs1LwvTlhGAtb22oNyPZPI3vv5Xy6BWHzSdPJ0j4q9hVjUCjPlOv9SplX9h9F1n%2F1A"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795636284c5431-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 66464

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 7315 4 KB
2 KB 140ms
25ms Document
text/html 54.146.174.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.174.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-174-45.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 575e6b672ec7d3c1df268f21753fbd9426747127279df10e59dd1110ecd10dc9

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:13 GMT
etag: W/"0458cafbc03ad497cb81dd40e06717ea8"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C834 2 KB
814 B 16ms
14ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 0C15 653 B
903 B 170ms
54ms Document
text/html 199.187.193.197
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.187.193.197 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 9df4a7803af6d28cc75a40833d4f766f3ccfcfefafbb77d6ebe2d2eab796a34c

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 653
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
2 KB

22ms
20ms

Document
text/html

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 1f8d08b3f6ca06a741ebd42145749e65081a56dbcf1e53cecf1ee7ab69010026

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1659
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
Location: /usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame CAA9
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

60ms
59ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:13 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2F0A 16 KB
6 KB 75ms
21ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33849
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 2044 3 KB
3 KB 217ms
96ms Document
text/html 2600:9000:21b8:8800:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21b8:8800:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0d05b0aba67dac21a3f10144f9802ab490188df03cc67c0b715442d432168caf

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 419c9901ed027566ceb381cbfb7dd6c0.cloudfront.net (CloudFront)
x-amz-cf-id: emNIjZAJOXobSqqWZ-QJhHHw6S2Gt4zzZ_b4f-pRjGv5gfdApt7qXA==
x-amz-cf-pop: ORD52-C1
x-cache: Miss from cloudfront

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 433A 635 B
1 KB 119ms
18ms Document
text/html 174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ecde7045f108b519f6f6d44d3be8c4bb8c1706f3994e901266d9546bb8554502

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 635
Content-Type: text/html; charset=utf-8
Date: Mon, 15 May 2023 06:31:13 GMT
Pragma: no-cache
Server: nginx

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame 24E8 1 KB
2 KB 130ms
28ms Document
text/html 54.161.38.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.161.38.36 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-38-36.compute-1.amazonaws.com
Software: /
Resource Hash: edb9c0f7e63436373e816a78fd96385983f62849a3648abcc183b632c6f25cb3

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 1225
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=2829111677345209672

0
345 B

89ms
23ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=2829111677345209672
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 52524de2-00d7-485b-9061-70a175d14e4c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ads.servenobid.com/sync?pid=312&uid=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=GpfHAPZHSyvkYo7GRcqvmKxM

0
351 B

43ms
23ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=GpfHAPZHSyvkYo7GRcqvmKxM
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://ads.servenobid.com/sync?pid=310&uid=GpfHAPZHSyvkYo7GRcqvmKxM
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 0
expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=GpfHAPZHSyvkYo7GRcqvmKxM

0
351 B

34ms
27ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=GpfHAPZHSyvkYo7GRcqvmKxM
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.servenobid.com/sync?pid=310&uid=GpfHAPZHSyvkYo7GRcqvmKxM
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame C323
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1684132273750
https://ad.turn.com/r/cs?pid=45&rndcb=8428027884
https://sync.1rx.io/usersync/turn/8575394200595948846?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005?redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21478%26id%3DRX-48fe24f1-88bf-46cd-8734-3bca0e84d...
https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

0
284 B

24ms
23ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://public.servenobid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Date: Mon, 15 May 2023 06:31:14 GMT
Server: Tengine
ETag: RX48fe24f188bf46cd87343bca0e84d201005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=2810035086818332396

0
344 B

91ms
23ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=2810035086818332396
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=2810035086818332396
Date: Mon, 15 May 2023 06:31:13 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
https://ads.servenobid.com/sync?pid=332&uid=277a2357-1e32-4313-9dd0-85518179de6d

0
356 B

60ms
24ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=332&uid=277a2357-1e32-4313-9dd0-85518179de6d
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ads.servenobid.com/sync?pid=332&uid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cookie
cm.adform.net/ Frame C323
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://cm.adform.net/cookie?gdpr=1&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F660%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D8220b2d1-4aec-4d94-9d18-b2fae2...

43 B
106 B

372ms
114ms

Image
image/gif

37.157.6.237
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?gdpr=1&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F660%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D8220b2d1-4aec-4d94-9d18-b2fae200417f%26bidder%3Dadform%26cbx%3DaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%253D%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 37.157.6.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
server: nginx
content-length: 43
content-type: image/gif

Redirect headers

location: https://cm.adform.net/cookie?gdpr=1&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F660%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%3D8220b2d1-4aec-4d94-9d18-b2fae200417f%26bidder%3Dadform%26cbx%3DaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%253D%26uid%3D%24UID
date: Mon, 15 May 2023 06:31:12 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A

0
367 B

25ms
23ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://us.ck-ie.com/ztg897.gif?gdpr=&gdpr_consent=&us_privacy=&coppa={$COPPA}&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D30%26buyeruid%3D%7B%24PARTNER_UID%7D%26r%3DCid1YS1lNGE0NDU3ZS0xY...
https://ssp.disqus.com/match?bidder=30&buyeruid=bba82fd4412fa8d9776396a4e15d5a4113800dfba70ba9975e2800b9b2a41127&r=Cid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg4MmQQ____________ASpTaHR0cHM6Ly...
https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg...
https://ssp.disqus.com/match?bidder=18&buyeruid=277a2357-1e32-4313-9dd0-85518179de6d&r=Cid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg4MmQQ____________ASpTaHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3...
https://ads.servenobid.com/sync?pid=346&uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d

0
359 B

23ms
22ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d
pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ups.analytics.yahoo.com/ups/58632/occ?verify=true
https://ads.servenobid.com/sync?pid=339&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A

0
367 B

24ms
22ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=KW3eSFMR&gdpr=0&gdpr_consent=&us_privacy=1YN-&
https://ads.servenobid.com/sync?pid=351&uid=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=&gdpr_consent=&us_privacy=&gdpr=0

0
356 B

33ms
22ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=351&uid=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=&gdpr_consent=&us_privacy=&gdpr=0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=351&uid=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=&gdpr_consent=&us_privacy=&gdpr=0
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame C323
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D353%26uid%3D%3Cvsid%3E
https://ads.servenobid.com/sync?pid=353&uid=3271338731455172000V10

0
346 B

26ms
23ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=353&uid=3271338731455172000V10
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Mon, 15 May 2023 06:31:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
location: https://ads.servenobid.com/sync?pid=353&uid=3271338731455172000V10
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:13 GMT

GET
H/1.1

404

264.gif
id5-sync.com/k/
Redirect Chain

https://id5-sync.com/i/457/8.gif?id5id=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&o=api&gdpr_consent=undefined&gdpr=false
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F457%2F429%2F7%2F2.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/457/429/7/2.gif?puid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%

43 B
43 B

99ms
97ms

Image
text/html

162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

5f789ccae156b160492d89a6146b1974d15128790b74abb995d8e89fa44cde5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
transfer-encoding: chunked
content-type: text/html;charset=utf-8

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 31ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTE5MywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJhZF9sb2FkX3RpbWUiLCJ2YWwiOiIxNDExIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:13 GMT

GET
H3 200 ecommerce.js Show response
www.google-analytics.com/plugins/ua/ 1 KB
763 B 46ms
35ms Script
text/javascript 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ecommerce.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1b84265e633c043720dd0921476c16bc9f75e393e855c9116ca7c3a847b5c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:02:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1743
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 15 May 2023 07:02:10 GMT

GET
H3 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 46ms
36ms Script
text/javascript 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 05:48:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2551
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1129
x-xss-protection: 0
last-modified: Thu, 30 Dec 2021 12:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 15 May 2023 06:48:42 GMT

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
134 B 149ms
110ms XHR
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c79563709285431-YYZ
vary: Origin
content-type: text/html; charset=utf-8

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
109 B 169ms
96ms Script
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=bd3efee5a89fccaf73b0d4c4fbdf75f1&url=https%3A%2F%2Fswiftmoves.blog%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c7956374b0d53dd-YYZ
content-type: text/html; charset=utf-8

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 9FF8 43 B
479 B 48ms
31ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=e0a721be-9d31-8093-8d4c-6f50c685d2bf

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 72P6Y285KJA53YRW28DX
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 2cb63b87-1137-a920-7c95-fb3251e1d416
pr-bh.ybp.yahoo.com/sync/openx/ Frame 9FF8 43 B
603 B 28ms
28ms Image
image/gif 2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/2cb63b87-1137-a920-7c95-fb3251e1d416?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 9FF8 43 B
855 B 62ms
30ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e0a721be-9d31-8093-8d4c-6f50c685d2bf

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: W8NVVKFAA26SBSC5V5TG
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 9FF8
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=b8715dc3-819b-3b69-4d42-edc7aeb6195f&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=b8715dc3-819b-3b69-4d42-edc7aeb6195f&gdpr=0&gdpr_consent=

43 B
62 B

24ms
23ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=b8715dc3-819b-3b69-4d42-edc7aeb6195f&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttd_puid=b8715dc3-819b-3b69-4d42-edc7aeb6195f&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 9FF8 170 B
188 B 46ms
44ms Image
image/png 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTQxZThlMDktNDhlYy02NWNkLTU4YTItYjc3ZTY0NTRkNzNm

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 9FF8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGci01MFxMKcG7rqMqaOrRw&google_cver=1

43 B
61 B

19ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGci01MFxMKcG7rqMqaOrRw&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGci01MFxMKcG7rqMqaOrRw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2829111677345209672

35 B
250 B

121ms
30ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2829111677345209672
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4db0ad0a-fb50-4f8d-af48-05028b41522a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_d2f833d3-40f8-4942-b9a7-0927d0dea250&gdpr=&gdpr_consent=&us_privacy=
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=gumgum2&gdpr=0&user_id=c_iOeSH92nlo-IwsIK-Ven353C5o_4ktJq7XB9ex
https://usersync.gumgum.com/usersync?b=bsw&i=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=

35 B
250 B

27ms
27ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-7f1c2561-4b9b-5220-6f27-cba23fba0797$ip$149.56.153.183

35 B
250 B

40ms
27ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-7f1c2561-4b9b-5220-6f27-cba23fba0797$ip$149.56.153.183
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-7f1c2561-4b9b-5220-6f27-cba23fba0797$ip$149.56.153.183
Date: Mon, 15 May 2023 06:31:13 GMT
Connection: keep-alive
Content-Length: 128
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_d2f833d3-40f8-4942-b9a7-0927d0dea250&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTJHU3WO4LVJMYTITSIIM3UOMTKMVEWUZTMNY
https://usersync.gumgum.com/usersync?b=zem&i=7gquK14NHC7G2jeIjfln

35 B
250 B

26ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=7gquK14NHC7G2jeIjfln
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=7gquK14NHC7G2jeIjfln
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 92
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=UMxte5rHSSDS&ev=1&pid=558355

35 B
250 B

93ms
30ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=UMxte5rHSSDS&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://usersync.gumgum.com/usersync?b=pln&i=UMxte5rHSSDS&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame BFF2
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRd...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_71b8ac05-8145-406f-9fd1-b5d091727fba&obuid=ENC(pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k)
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51
https://b1sync.zemanta.com/usersync/outbrain/?puid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
https://sync.outbrain.com/cookie-sync?p=zemanta&uid=7gquK14NHC7G2jeIjfln&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&initiator=ob&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_...

0
145 B

22ms
21ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=zemanta&uid=7gquK14NHC7G2jeIjfln&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&initiator=ob&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 3dc346de77ffe00586aa6a7b42a206f3
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Content-Type: text/html; charset=utf-8
Location: https://sync.outbrain.com/cookie-sync?p=zemanta&uid=7gquK14NHC7G2jeIjfln&obUid=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k&initiator=ob&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 267
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=4f4cf9b3-a98e-033f-2a39-fd2a66e61819

35 B
250 B

87ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=4f4cf9b3-a98e-033f-2a39-fd2a66e61819
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=4f4cf9b3-a98e-033f-2a39-fd2a66e61819
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-XppbpxRE2pfySuzma0ZUR95X5gOejEI7y6mo~A

35 B
250 B

90ms
28ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-XppbpxRE2pfySuzma0ZUR95X5gOejEI7y6mo~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-XppbpxRE2pfySuzma0ZUR95X5gOejEI7y6mo~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=12402fe0-a3d3-466f-ba65-3e4e9d166d82

35 B
250 B

78ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=12402fe0-a3d3-466f-ba65-3e4e9d166d82
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=12402fe0-a3d3-466f-ba65-3e4e9d166d82
Date: Mon, 15 May 2023 06:31:13 GMT
Connection: keep-alive
X-CI-RTID: 179db455-3714-464e-b3c1-f27a7c97ed89
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=5597529CCA40456999768DE69389154D

35 B
250 B

98ms
26ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=5597529CCA40456999768DE69389154D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 547754776
location: https://usersync.gumgum.com/usersync?b=snc&i=5597529CCA40456999768DE69389154D
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame BFF2 0
222 B 98ms
23ms Image
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 Miami, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:12 GMT
server: c
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=48d10cb6-8639-4910-8bd3-c6b0a94824d0

35 B
250 B

27ms
27ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=48d10cb6-8639-4910-8bd3-c6b0a94824d0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=48d10cb6-8639-4910-8bd3-c6b0a94824d0
access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:14 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BFF2
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=4857008915831342889

35 B
250 B

34ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=4857008915831342889
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=4857008915831342889
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame BFF2 43 B
479 B 43ms
34ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_d2f833d3-40f8-4942-b9a7-0927d0dea250

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ABH6FJKZ9B48JQFFV4FA
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame DE93 34 KB
10 KB 82ms
23ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66792
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame ADF6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=U3R1S0dVdndfVDRFTG9ncGVKcThzUQ&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEPc6dZ_S6KmlpKvCo0IPRHY&google_cver=1

49 B
812 B

22ms
21ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEPc6dZ_S6KmlpKvCo0IPRHY&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

Protocol

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEPc6dZ_S6KmlpKvCo0IPRHY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 335
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame ADF6
Redirect Chain

https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=34287ec1372105e&is_secure=true&networkId=14200&version=1&nuid=
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMfi2JneWE-wMHIcxzAAAAAAA&expiration=1684218673&nuid=&is_secure=true

49 B
840 B

20ms
18ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMfi2JneWE-wMHIcxzAAAAAAA&expiration=1684218673&nuid=&is_secure=true

Requested by

Protocol

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMfi2JneWE-wMHIcxzAAAAAAA&expiration=1684218673&nuid=&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame ADF6 43 B
479 B 31ms
30ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=UMxte5rHSSDS&ex=Pulsepoint

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 0P0QGB9GQ2KPDEW8PZ8G
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

user-sync
sync.adkernel.com/ Frame 433A
Redirect Chain

https://ib.adnxs.com/getuid?%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D181225%26dsp%3D578434%26t%3Dimage%26uid%3D%24UID%26us_privacy%3D1YN-
https://sync.adkernel.com/user-sync?zone=181225&dsp=578434&t=image&uid=2829111677345209672&us_privacy=1YN-

42 B
353 B

118ms
18ms

Image
image/gif

174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?zone=181225&dsp=578434&t=image&uid=2829111677345209672&us_privacy=1YN-
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Protocol: HTTP/1.1
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync.adkernel.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: close
Content-Length: 42

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 0513a361-15b1-419c-bd0a-dcf9f53c5964
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: //sync.adkernel.com/user-sync?zone=181225&dsp=578434&t=image&uid=2829111677345209672&us_privacy=1YN-
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 400
Bad Request user-sync Show response
sync.adkernel.com/ Frame 93B8 21 B
191 B 56ms
18ms Document
text/plain 174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=&gdpr_consent=&ccpa=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: 43e96d451b13a80f769c106908376c94b31beb9aac6566498c5c60f0059ca4f1

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 21
Date: Mon, 15 May 2023 06:31:13 GMT
Pragma: no-cache
Server: nginx

GET
H/1.1 204
No Content e9d4ff858b5e32317e843f5ed11b2659.gif
cs.iqzone.com/ Frame DCD6 0
0 2677ms
958ms Document
text/plain 8.2.111.13
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_d2f833d3-40f8-4942-b9a7-0927d0dea250&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.2.111.13 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Mon, 15 May 2023 06:31:16 GMT
Server: nginx

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C66C 16 KB
6 KB 26ms
24ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33849
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 01D6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=cb640652-5013-46a4-8cfe-1b84d3b7b490

35 B
250 B

104ms
28ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=cb640652-5013-46a4-8cfe-1b84d3b7b490
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame AB4D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=4c776461-d1b1-4900-b124-b9c5515ce93c&gdpr=&gdpr_consent=

35 B
250 B

93ms
27ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=4c776461-d1b1-4900-b124-b9c5515ce93c&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Mon, 15 May 2023 06:31:12 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 851 9bd98ae master ord-pixel-x48 config_version:"unknown"
location: https://usersync.gumgum.com/usersync?b=mmh&i=4c776461-d1b1-4900-b124-b9c5515ce93c&gdpr=&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 8AFF
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=atm&i=ZGHRsQAKKKWZKgAp&gdpr=&gdpr_consent=

35 B
250 B

105ms
28ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=ZGHRsQAKKKWZKgAp&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=ZGHRsQAKKKWZKgAp&gdpr=&gdpr_consent=
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-yul12825-YUL
x-timer: S1684132274.837916,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 83BF 170 B
188 B 78ms
46ms Document
image/png 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9kMmY4MzNkMy00MGY4LTQ5NDItYjlhNy0wOTI3ZDBkZWEyNTA=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 58DB 43 B
479 B 44ms
29ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=40219a53-1b3d-42e8-873b-12dcf5b8e3e3

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HFBJQFP20YECZWSSV664
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 58DB
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

68 B
604 B

25ms
24ms

Image
image/png

44.196.26.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 44.196.26.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-26-30.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 58DB
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

68 B
604 B

25ms
24ms

Image
image/png

44.196.26.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 44.196.26.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-26-30.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 58DB
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=7ead435e-a2cd-4cbf-8876-adb66822613f&ph=c6b01e12-aa62-4ae6-9e10-71346e597c31&r=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DF2...
https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=7612a8fe-33df-0684-08e9-cb8da47dbb37

68 B
605 B

28ms
25ms

Image
image/png

44.196.26.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=7612a8fe-33df-0684-08e9-cb8da47dbb37
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 44.196.26.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-26-30.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=7612a8fe-33df-0684-08e9-cb8da47dbb37
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 58DB
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

68 B
602 B

24ms
24ms

Image
image/png

44.196.26.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 44.196.26.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-26-30.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 160B 43 B
479 B 42ms
30ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=gb0f8a3808a0d19db6a0

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Z63X7ZWPTQWW9BWWYD8S
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 160B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEO9_1-VPiZoZql6UA16qnKU&google_cver=1

43 B
471 B

153ms
24ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEO9_1-VPiZoZql6UA16qnKU&google_cver=1
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEO9_1-VPiZoZql6UA16qnKU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 160B 170 B
188 B 56ms
42ms Image
image/png 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_hm=Z2IwZjhhMzgwOGEwZDE5ZGI2YTA=

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 160B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=gb0f8a3808a0d19db6a0
https://ads.yieldmo.com/v000/sync?tdid=cb640652-5013-46a4-8cfe-1b84d3b7b490

43 B
475 B

53ms
25ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?tdid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ads.yieldmo.com/v000/sync?tdid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 181

GET
H2

200

sync
ads.yieldmo.com/ Frame 160B
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=yieldmo
https://ads.yieldmo.com/sync?pn_id=rc&id=LHOGVEZ1-17-H6WS

43 B
464 B

34ms
24ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/sync?pn_id=rc&id=LHOGVEZ1-17-H6WS
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ads.yieldmo.com/sync?pn_id=rc&id=LHOGVEZ1-17-H6WS
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 160B
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=gb0f8a3808a0d19db6a0
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Dc141b74b-22ea-414f-bc66-57ef6830a0e2%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2829111677345209672&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

95 B
123 B

55ms
55ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2829111677345209672&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

Date: Mon, 15 May 2023 06:31:14 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2116d320-65f2-4615-9298-18d541003eb4
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=2829111677345209672&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2829111677345209672

35 B
250 B

77ms
29ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2829111677345209672
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f39939dc-110e-456d-b707-c27e07f91415
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_71b8ac05-8145-406f-9fd1-b5d091727fba&gdpr=0&gdpr_consent=&us_privacy=1---
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%...
https://x.bidswitch.net/sync?dsp_id=440&ssp=gumgum2&user_id=BLGUmxdXEycUVQX9HDOm0
https://usersync.gumgum.com/usersync?b=bsw&i=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=

35 B
250 B

39ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-7f1c2561-4b9b-5220-6f27-cba23fba0797$ip$149.56.153.183

35 B
250 B

30ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-7f1c2561-4b9b-5220-6f27-cba23fba0797$ip$149.56.153.183
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-7f1c2561-4b9b-5220-6f27-cba23fba0797$ip$149.56.153.183
Date: Mon, 15 May 2023 06:31:13 GMT
Connection: keep-alive
Content-Length: 128
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_71b8ac05-8145-406f-9fd1-b5d091727fba&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2N3HOF2UWMJUJZEEGN2HGJVGKSLKMZWG4...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7gquK14NHC7G2jeIjfln&us_privacy=1---

35 B
250 B

30ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7gquK14NHC7G2jeIjfln&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7gquK14NHC7G2jeIjfln&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=UMxte5rHSSDS&ev=1&pid=558355

35 B
250 B

38ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=UMxte5rHSSDS&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://usersync.gumgum.com/usersync?b=pln&i=UMxte5rHSSDS&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 7315
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_71b8ac05-8145-406f-9fd1-b5d091727fba&obuid=ENC(pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k)
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51
https://x.bidswitch.net/sync?ssp=outbrain&user_id=pimfbUKH_kaW1Q7WFj37P5Q-t75wuyZ5ygtVwM80RtpEYhrWWwXe6u94fYHmOy4k
https://match.prod.bidr.io/cookie-sync/bidswitch?bidswitch_ssp_id=outbrain&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=269&expires=5&user_id=AAC5aU7Iw6MAACKiklmZXA&ssp=outbrain
https://sync.outbrain.com/cookie-sync?p=bidswitch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

0
145 B

24ms
24ms

Image
text/plain

64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=bidswitch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
X-TraceId: 566cf3b2297f827ffaad145267a41a45
Content-Length: 0

Redirect headers

Location: //sync.outbrain.com/cookie-sync?p=bidswitch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=4f4cf9b3-a98e-033f-2a39-fd2a66e61819

35 B
250 B

54ms
27ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=4f4cf9b3-a98e-033f-2a39-fd2a66e61819
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=4f4cf9b3-a98e-033f-2a39-fd2a66e61819
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-XppbpxRE2pfySuzma0ZUR95X5gOejEI7y6mo~A

35 B
250 B

29ms
27ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-XppbpxRE2pfySuzma0ZUR95X5gOejEI7y6mo~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-XppbpxRE2pfySuzma0ZUR95X5gOejEI7y6mo~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=da289973-f669-4adc-a84d-be5c17460972

35 B
250 B

59ms
26ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=da289973-f669-4adc-a84d-be5c17460972
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=da289973-f669-4adc-a84d-be5c17460972
Date: Mon, 15 May 2023 06:31:13 GMT
Connection: keep-alive
X-CI-RTID: def34f16-186b-4544-8a3c-a2e7dce6e0a4
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=5597529CCA40456999768DE69389154D

35 B
250 B

60ms
26ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=5597529CCA40456999768DE69389154D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 533287492
location: https://usersync.gumgum.com/usersync?b=snc&i=5597529CCA40456999768DE69389154D
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame 7315 0
150 B 52ms
21ms Image
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 Miami, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:13 GMT
server: c
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=48d10cb6-8639-4910-8bd3-c6b0a94824d0

35 B
250 B

26ms
26ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=48d10cb6-8639-4910-8bd3-c6b0a94824d0
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=48d10cb6-8639-4910-8bd3-c6b0a94824d0
access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:14 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7315
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=4857008915831342889

35 B
250 B

52ms
25ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=4857008915831342889
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=4857008915831342889
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 7315 0
358 B 53ms
22ms Image
image/avif 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=u_71b8ac05-8145-406f-9fd1-b5d091727fba
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 cksync.php
contextual.media.net/ Frame 24E8 61 B
467 B 160ms
65ms Image
image/gif 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E

Requested by

Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:13 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:13 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame 24E8
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11587&uid=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=0

0
288 B

74ms
28ms

Image
application/javascript

54.161.38.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.161.38.36 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-38-36.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11587&uid=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=0
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 24E8
Redirect Chain

https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11591&id=y-MQI9TAFE2uJGDwXbsxdFQLPrpM54ayCd~A&gdpr_in_effect=0

0
288 B

26ms
24ms

Image
application/javascript

54.161.38.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11591&id=y-MQI9TAFE2uJGDwXbsxdFQLPrpM54ayCd~A&gdpr_in_effect=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.161.38.36 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-38-36.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11591&id=y-MQI9TAFE2uJGDwXbsxdFQLPrpM54ayCd~A&gdpr_in_effect=0
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

cs
cs.yellowblue.io/ Frame 24E8
Redirect Chain

https://x.bidswitch.net/sync?ssp=rise&gdpr=0&gdpr_consent=&user_id=J8byGlIaCj_s
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=0c031c75-0dc5-47ab-a78c-92793a44c6bb&ssp=rise&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10599080989829358732&ssp=rise&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11582&id=0c031c75-0dc5-47ab-a78c-92793a44c6bb

0
288 B

26ms
25ms

Image
application/javascript

54.161.38.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11582&id=0c031c75-0dc5-47ab-a78c-92793a44c6bb
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.161.38.36 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-38-36.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Location: //cs.yellowblue.io/cs?aid=11582&id=0c031c75-0dc5-47ab-a78c-92793a44c6bb
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 24E8
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11601&id=bf2f2b7ff761676aafb02745af8a8031&gdpr_consent=&gdpr=0

0
288 B

71ms
65ms

Image
application/javascript

54.161.38.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=bf2f2b7ff761676aafb02745af8a8031&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.161.38.36 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-38-36.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cs.yellowblue.io/cs?aid=11601&id=bf2f2b7ff761676aafb02745af8a8031&gdpr_consent=&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1684132273982049-272

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 24E8
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=4073deab38b60fd8&is_secure=true&networkId=17100&version=1&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAInHvelJ2pbwNLpqi6AAAAAAA&expiration=1684218674&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://cs.minutemedia-prebid.com/cs?aid=21482&id=41DA1833-16BC-41FB-8168-95B4325D28EC

0
288 B

23ms
22ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21482&id=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21482&id=41DA1833-16BC-41FB-8168-95B4325D28EC
date: Mon, 15 May 2023 06:31:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 113
content-type: text/html; charset=utf-8

GET
H2 200 sync
ads.servenobid.com/ Frame 24E8 0
340 B 41ms
27ms Image
image/avif 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=352&uid=J8byGlIaCj_s
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 696B 2 KB
814 B 11ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5adb88524e24e50

Requested by

Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 sync
ads.servenobid.com/ Frame 0C15 0
344 B 35ms
29ms Image
image/avif 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=4857008915831342889&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0C15
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7233293034697980059&gdpr=0&gdpr_consent=

43 B
408 B

178ms
63ms

Image
image/gif

199.187.193.179
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7233293034697980059&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 199.187.193.179 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7233293034697980059&gdpr=0&gdpr_consent=
Date: Mon, 15 May 2023 06:31:13 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0C15
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=de370d98-bf85-4e34-be86-7788a9892ec3&gdpr_consent=null&gdpr=0

43 B
477 B

54ms
53ms

Image
image/gif

199.187.193.179
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=de370d98-bf85-4e34-be86-7788a9892ec3&gdpr_consent=null&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 199.187.193.179 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=de370d98-bf85-4e34-be86-7788a9892ec3&gdpr_consent=null&gdpr=0
date: Mon, 15 May 2023 06:31:14 GMT
server: _
content-length: 0

GET
H/1.1

404

264.gif
id5-sync.com/k/ Frame 0C15
Redirect Chain

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_...
https://id5-sync.com/c/102/102/8/2.gif?puid=4857008915831342889&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%

43 B
43 B

104ms
104ms

Image
text/html

162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

HTTP/1.1

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

5f789ccae156b160492d89a6146b1974d15128790b74abb995d8e89fa44cde5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
transfer-encoding: chunked
content-type: text/html;charset=utf-8

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://id5-sync.com/k/264.gif?puid=cb640652-5013-46a4-8cfe-1b84d3b7b490&ttl=%%TTL%%
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2 200 711890.gif
id.rlcdn.com/ Frame 0C15 42 B
318 B 88ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 2D52 43 B
479 B 33ms
32ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=GpfHAPZHSyvkYo7GRcqvmKxM&ex=sovrn.com&gdpr=0&gdpr_consent=

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: THB2CKMWEKV927W51XYZ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 sovrn
tr.blismedia.com/v1/api/sync/ Frame 2D52 0
173 B 82ms
29ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 2D52
Redirect Chain

https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=EFucuEJeyLgLW57tQwyHux5azu8LXJvsRQ2HZ19j

43 B
1 KB

27ms
26ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=EFucuEJeyLgLW57tQwyHux5azu8LXJvsRQ2HZ19j
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=EFucuEJeyLgLW57tQwyHux5azu8LXJvsRQ2HZ19j
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 2D52
Redirect Chain

https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

43 B
1 KB

28ms
27ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=27&3pid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ce.lijit.com/merge?pid=27&3pid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 223

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D52
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

48ms
44ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:13 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 2D52
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=VpfbHUC29S3305XiHykA&pi=sovrn&gdpr=0&gdpr_consent=&tc=1

43 B
2 KB

27ms
27ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=VpfbHUC29S3305XiHykA&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 2
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=VpfbHUC29S3305XiHykA&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT, Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0D7F
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZGHRssCo5swAAEhaWzUAAAAA

35 B
250 B

26ms
26ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZGHRssCo5swAAEhaWzUAAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:14 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZGHRssCo5swAAEhaWzUAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 1
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad451.dc4p.scaleout.jp
X-SO-IP: 149.56.153.183
X-SO-Key: ZGHRssCo5swAAEhaWzUAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.183","key":"ZGHRssCo5swAAEhaWzUAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad451"}
X-SO-LB-Hostname: a-tgng40008.dc2p.scaleout.jp
X-SO-Upstream-ID: m-ad451

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 2A69
Redirect Chain

https://cs.admanmedia.com/sync/gumgum?puid=u_d2f833d3-40f8-4942-b9a7-0927d0dea250&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=&gdpr_consent=&ccpa=
https://usersync.gumgum.com/usersync?b=aad&i=15b13a97-3013-4414-9585-70eff0cd3766

35 B
250 B

91ms
25ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=aad&i=15b13a97-3013-4414-9585-70eff0cd3766
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Location: https://usersync.gumgum.com/usersync?b=aad&i=15b13a97-3013-4414-9585-70eff0cd3766
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Transfer-Encoding: chunked
X-Frame-Options: DENY

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 346E 43 B
632 B 18ms
18ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Keep-Alive: timeout=1, max=497
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 9138
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=CyPp6BI27eQquzRNErXy&pi=gumgum&tc=1

35 B
250 B

25ms
24ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=CyPp6BI27eQquzRNErXy&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Mon, 15 May 2023 06:31:14 GMT Mon, 15 May 2023 06:31:14 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=CyPp6BI27eQquzRNErXy&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 7B77
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

51ms
23ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:13 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

22ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZGHRseRl8.SUQDBYssPdFQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2

43 B
632 B

36ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame C0A9 43 B
855 B 53ms
34ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 52MCN86VPPP3V3JN1MNY
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724273&gdpr=0&gdpr_consent=

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724273&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724273&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame C0A9
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=246f9f89c8e90fd8&is_secure=true&networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAFoQF1QutEGQMvpgdnAAAAAAA&expiration=1684218674&is_secure=true

43 B
632 B

82ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAFoQF1QutEGQMvpgdnAAAAAAA&expiration=1684218674&is_secure=true
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAFoQF1QutEGQMvpgdnAAAAAAA&expiration=1684218674&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3S...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD2N3HOF2UW...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7gquK14NHC7G2jeIjfln

43 B
632 B

19ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7gquK14NHC7G2jeIjfln
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Content-Type: text/html; charset=utf-8
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7gquK14NHC7G2jeIjfln
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29
https://c1.adform.net/serving/cookie/match?CC=1&party=29
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=7246762434369164995&expiration=1685341874

43 B
632 B

36ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=7246762434369164995&expiration=1685341874
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=7246762434369164995&expiration=1685341874
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C0A9
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=2810035086818332396

43 B
632 B

23ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=2810035086818332396
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=2810035086818332396
Date: Mon, 15 May 2023 06:31:13 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 sync
ads.servenobid.com/ Frame C0A9 0
357 B 48ms
22ms Image
image/avif 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 400
Bad Request user-sync Show response
sync.adkernel.com/ Frame 4D21 21 B
191 B 45ms
19ms Document
text/plain 174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: 43e96d451b13a80f769c106908376c94b31beb9aac6566498c5c60f0059ca4f1

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 21
Date: Mon, 15 May 2023 06:31:13 GMT
Pragma: no-cache
Server: nginx

GET
H/1.1 404
Not Found e9d4ff858b5e32317e843f5ed11b2659.gif Show response
cs.iqzone.com/ Frame 8C66 9 B
175 B 4603ms
2065ms Document
text/plain 8.2.111.13
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_71b8ac05-8145-406f-9fd1-b5d091727fba&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.2.111.13 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/plain
Date: Mon, 15 May 2023 06:31:18 GMT
Server: nginx
Transfer-Encoding: chunked

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F121 16 KB
6 KB 49ms
23ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33849
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 024B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=cb640652-5013-46a4-8cfe-1b84d3b7b490

35 B
250 B

86ms
25ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Mon, 15 May 2023 06:31:13 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=cb640652-5013-46a4-8cfe-1b84d3b7b490
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame E29F
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=102b6461-d1b1-4f00-b06c-5186e28fb05c&gdpr=0&gdpr_consent=

35 B
250 B

69ms
25ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=102b6461-d1b1-4f00-b06c-5186e28fb05c&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: Mon, 15 May 2023 06:31:12 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 851 9bd98ae master ord-pixel-x48 config_version:"unknown"
location: https://usersync.gumgum.com/usersync?b=mmh&i=102b6461-d1b1-4f00-b06c-5186e28fb05c&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame FC05
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=atm&i=ZGHRsQAKKKWZKgAp&gdpr=0&gdpr_consent=

35 B
250 B

70ms
27ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=ZGHRsQAKKKWZKgAp&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=ZGHRsQAKKKWZKgAp&gdpr=0&gdpr_consent=
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-yul12825-YUL
x-timer: S1684132274.933730,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 6AC7 170 B
188 B 62ms
47ms Document
image/png 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV83MWI4YWMwNS04MTQ1LTQwNmYtOWZkMS1iNWQwOTE3MjdmYmE=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 199D 43 B
855 B 52ms
36ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: AZGVT53KEB630VRGNW2X
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZGHRseRl8.SUQDBYssPdFQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2

43 B
632 B

47ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724273&gdpr=0&gdpr_consent=

43 B
632 B

36ms
20ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724273&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724273&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

20ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=493
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1700029874&external_user_id=b144d512-5e11-4668-85d1-67d217c20736

43 B
632 B

21ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1700029874&external_user_id=b144d512-5e11-4668-85d1-67d217c20736
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 google
access-control-allow-methods: GET,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *.casalemedia.com
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1700029874&external_user_id=b144d512-5e11-4668-85d1-67d217c20736
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 157

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=4c776461-d1b1-4900-b124-b9c5515ce93c

43 B
632 B

35ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=4c776461-d1b1-4900-b124-b9c5515ce93c
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:14 GMT
Server: MT3 851 9bd98ae master ord-pixel-x18 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=4c776461-d1b1-4900-b124-b9c5515ce93c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:13 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=4857008915831342889&gdpr=0&gdpr_consent=

43 B
632 B

22ms
20ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=4857008915831342889&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=4857008915831342889&gdpr=0&gdpr_consent=
date: Mon, 15 May 2023 06:31:13 GMT
content-length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 199D
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=36881F8882764BFBBAB2F6595BB0DFFB

43 B
632 B

58ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=36881F8882764BFBBAB2F6595BB0DFFB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=36881F8882764BFBBAB2F6595BB0DFFB
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 14 May 2023 06:31:14 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 199D 43 B
479 B 44ms
33ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WVAYA942AE7VCSFKT28N
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame CAA9 34 KB
10 KB 36ms
24ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:13 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66792
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame F33A 2 KB
814 B 21ms
9ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=69f48c2160c8113

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 8012
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east

281 B
554 B

46ms
30ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:14 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:13 GMT
location: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server: AkamaiGHost

GET
H3 200 audio_init.mp4 Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 826 B
1 KB 67ms
59ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_init.mp4
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e809baf83b0cd0d58f4f3b0a4cad40f65481770f9b98d5a4773b9c464cacbf98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V2%2FGfu3q7qys8yqRql0YUuSWwI92%2BxliVte43p68TKstB5ReBWVxRiHwy%2FUM%2Fiyy0v4mgE5kurrv5dWHC5t0wjmH0u5BRtf89WSitAkYbgfXSkINlJjvSZasJ7l81zxF1Bxvm2dlKNRgXzkFpuh%2Fifuq"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956381dc35437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 826

GET
H3 200 audio_001.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 41 KB
42 KB 52ms
44ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_001.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6d64358152ba6cfcc50fa75c8fe28fe77d29945109ccfd08f20b8e83fb18c1c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:13 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cjIJbnKag8DzKVSmr%2Bq1QlqZThLwLNHzexDVY0B3rrOahpBKNC9RAbAr%2FaOXUWuYAm%2FTE8Qfd%2Blx9VTj7137t%2Ffz3lOav27du0VjahdYq1E5jxkwCFrlunWDOnuH%2FXG1bsbuO6eDimKECYMW1cMaPrxT"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956381dc45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 42041

POST
H2 200 wl Show response
t.pubmatic.com/ 17 B
182 B 161ms
44ms XHR
text/plain 8.28.7.92
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://t.pubmatic.com/wl?pubid=162833
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.92 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 0d111d61901004eafd87c672f12f6cd54b3c376513aa672bf58100506dfe76f5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 17
expires: 0

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 2044
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=161683&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21482%26id%3D%23PMUID
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=42eaf4032399183d&is_secure=true&networkId=17100&version=1&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAMfi2JneWE_wMSPc-HAAAAAAA&expiration=1684218674&nuid=41DA1833-16BC-41FB-8168-95B4325D28EC&...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35CA5_102B27654_9C620B87&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

35ms
35ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D

Protocol

HTTP/1.1

Server

38.68.201.140 , United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-367137074; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-367137074; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21485%26puid%3D33XUSERID33X
https://cs.minutemedia-prebid.com/cs?aid=21485&puid=212163770660309

0
289 B

136ms
17ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21485&puid=212163770660309
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:13 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cs.minutemedia-prebid.com/cs?aid=21485&puid=212163770660309
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=196326&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21476%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZGHRseRl8.SUQDBYssPdFQAA%261358

0
289 B

134ms
15ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZGHRseRl8.SUQDBYssPdFQAA%261358
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 0
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=44808&gdpr=0&gdpr_consent=&callback_url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21505%26id%3D$%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=44808&gdpr=0&gdpr_consent=&callback_url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21505%26id%3D%24%7BUSER_ID%7D&crf=1
https://cs.minutemedia-prebid.com/cs?aid=21505&id=de4b5f83-2dbe-5387-9f53-13f2fb32c240

0
289 B

23ms
23ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21505&id=de4b5f83-2dbe-5387-9f53-13f2fb32c240
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21505&id=de4b5f83-2dbe-5387-9f53-13f2fb32c240
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21480&id=2394646913815972036409

0
289 B

125ms
40ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21480&id=2394646913815972036409
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21480&id=2394646913815972036409
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://u.openx.net/w/1.0/cm?id=29975467-6f1b-4e06-b545-920b22ea49b2&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21477%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21477&id=2128bfc7-fe09-043d-35da-f430eeb593ba

0
289 B

105ms
17ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21477&id=2128bfc7-fe09-043d-35da-f430eeb593ba
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cs.minutemedia-prebid.com/cs?aid=21477&id=2128bfc7-fe09-043d-35da-f430eeb593ba
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

204

CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 2044
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21492%26uid%3D
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F303%3Fgdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26A%3D8220b2d1-...
https://prebid.a-mo.net/cchain/0/303?gdpr=&gdpr_consent=&us_privacy=&A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=index_rtb&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9...
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fprebid.a-mo....
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&ssp=pubmatic&gdpr=0
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&gdpr_pd=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=

0
35 B

72ms
22ms

Image
text/plain

3.212.118.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 3.212.118.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-118-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT

Redirect headers

location: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
date: Mon, 15 May 2023 06:31:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 95
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
sync.targeting.unrulymedia.com/csync/ Frame 2044
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sportority
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7585445956
https://sync.1rx.io/usersync/tradedesk/cb640652-5013-46a4-8cfe-1b84d3b7b490
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

43 B
452 B

34ms
32ms

Image
image/gif

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://cs.krushmedia.com/6185b9cf4d72f7e454746134b8c78716.gif?redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21501%26puid%3D%5BUID%5D
https://cs.minutemedia-prebid.com/cs?aid=21501&puid=4aa68abf-e66c-412c-9e20-eb752a598e97

0
289 B

79ms
25ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21501&puid=4aa68abf-e66c-412c-9e20-eb752a598e97
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://cs.minutemedia-prebid.com/cs?aid=21501&puid=4aa68abf-e66c-412c-9e20-eb752a598e97
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21488%26id%3D%24UID
https://cs.minutemedia-prebid.com/cs?aid=21488&id=GpfHAPZHSyvkYo7GRcqvmKxM

0
289 B

103ms
16ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21488&id=GpfHAPZHSyvkYo7GRcqvmKxM
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Date: Mon, 15 May 2023 06:31:14 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cs.minutemedia-prebid.com/cs?aid=21488&id=GpfHAPZHSyvkYo7GRcqvmKxM
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://cs.admanmedia.com/sync/minute_media?gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21497%26puid%3D%5BUID%5D
https://cs.minutemedia-prebid.com/cs?aid=21497&puid=15b13a97-3013-4414-9585-70eff0cd3766

0
290 B

107ms
14ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21497&puid=15b13a97-3013-4414-9585-70eff0cd3766
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
Transfer-Encoding: chunked
X-Frame-Options: DENY
Location: https://cs.minutemedia-prebid.com/cs?aid=21497&puid=15b13a97-3013-4414-9585-70eff0cd3766
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://ads.yieldmo.com/pbsync?is=mmed&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]&redirectUri=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21486%26uid%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21486&uid=gb0f8a3808a0d19db6a0&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]

0
289 B

91ms
18ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21486&uid=gb0f8a3808a0d19db6a0&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cs.minutemedia-prebid.com/cs?aid=21486&uid=gb0f8a3808a0d19db6a0&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET

cs
cs.minutemedia-prebid.com/ Frame 2044
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=3r9HMldH&gdpr=0&gdpr_consent=
https://cs.minutemedia-prebid.com/cs?aid=21496&id=79897214-8af9-48b5-85a2-26f1235a2a79&gdpr=0

0
0

GET
H2 200 sync
ads.servenobid.com/ Frame 2044 0
341 B 44ms
21ms Image
image/avif 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=348&uid=RqbyJlUakp_mm
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0656
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZGHRssCo5s8AAC5gCzsAAAAA

35 B
250 B

27ms
26ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZGHRssCo5s8AAC5gCzsAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:14 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZGHRssCo5s8AAC5gCzsAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: a-ad40109.dc2p.scaleout.jp
X-SO-IP: 149.56.153.183
X-SO-Key: ZGHRssCo5s8AAC5gCzsAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.183","key":"ZGHRssCo5s8AAC5gCzsAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40109"}
X-SO-LB-Hostname: a-tgng40011.dc2p.scaleout.jp
X-SO-Upstream-ID: a-ad40109

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 810E
Redirect Chain

https://cs.admanmedia.com/sync/gumgum?puid=u_71b8ac05-8145-406f-9fd1-b5d091727fba&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=1---
https://usersync.gumgum.com/usersync?b=aad&i=15b13a97-3013-4414-9585-70eff0cd3766

35 B
250 B

61ms
25ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=aad&i=15b13a97-3013-4414-9585-70eff0cd3766
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Location: https://usersync.gumgum.com/usersync?b=aad&i=15b13a97-3013-4414-9585-70eff0cd3766
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Transfer-Encoding: chunked
X-Frame-Options: DENY

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 0607 43 B
632 B 32ms
18ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:13 GMT
Expires: 0
Keep-Alive: timeout=1, max=496
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame DF60
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=VpfbHUC29S3305XiHykA&pi=gumgum&tc=1

35 B
250 B

26ms
24ms

Document
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=VpfbHUC29S3305XiHykA&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Mon, 15 May 2023 06:31:14 GMT Mon, 15 May 2023 06:31:14 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=VpfbHUC29S3305XiHykA&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 131B
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

31ms
23ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:14 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:14 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2

200

setuid
ow.pubmatic.com/
Redirect Chain

https://ads.servenobid.com/getsync?tek=pbs&ver=1&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dnobid%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%2...
https://ow.pubmatic.com/setuid?bidder=nobid&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=MzEyOjI4MjkxMTE2!zcz!*UyM*k2!zJ8MzI0OjI4MT(wMzUwO*Y4MTgzMzIzOT)8MzMyOjI3!2EyMzU3LTFlMzIt!*MxMy05)GQwLTg1!TE4MTc...

86 B
996 B

24ms
24ms

Image
image/png

8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=nobid&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=MzEyOjI4MjkxMTE2!zcz!*UyM*k2!zJ8MzI0OjI4MT(wMzUwO*Y4MTgzMzIzOT)8MzMyOjI3!2EyMzU3LTFlMzIt!*MxMy05)GQwLTg1!TE4MTc5)GU2)Hwz!TE6!zk4OTcyMTQtOGFmOS00OGI1LTg1YTItMj)mMTIz!WEyYTc5f*MzOTp5LVdleVF4eHRFMnVHcFFiaU!T)1FG!mtl!T)OS*QyeV!R)0x1X1!xdy1+QXwzMzc6eS1X)XlReHh0RTJ1R3BRYml*U2dRRj)r)TU2Tkg0MnlTUWdMdV9TcXctfkF8MzUzOjMy!zEzMzg3MzE0!TUx!zIwM*BWMTB8MzE3OjQ4!TcwM*g5MTU4MzEz!*I4O*l8Mz(5OnVf!zFiOGFjM*UtO*E0!S00M*)mLTlm)*EtYjVkM*kx!zI3)mJhf*M1MjpKOGJ5R2xJYU!qX3!8MzEwOkdw)khBUFpIU3l2a1lv!0dSY3F2bUt4TQ~~
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-length: 86
content-type: image/png

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
location: https://ow.pubmatic.com/setuid?bidder=nobid&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=MzEyOjI4MjkxMTE2!zcz!*UyM*k2!zJ8MzI0OjI4MT(wMzUwO*Y4MTgzMzIzOT)8MzMyOjI3!2EyMzU3LTFlMzIt!*MxMy05)GQwLTg1!TE4MTc5)GU2)Hwz!TE6!zk4OTcyMTQtOGFmOS00OGI1LTg1YTItMj)mMTIz!WEyYTc5f*MzOTp5LVdleVF4eHRFMnVHcFFiaU!T)1FG!mtl!T)OS*QyeV!R)0x1X1!xdy1+QXwzMzc6eS1X)XlReHh0RTJ1R3BRYml*U2dRRj)r)TU2Tkg0MnlTUWdMdV9TcXctfkF8MzUzOjMy!zEzMzg3MzE0!TUx!zIwM*BWMTB8MzE3OjQ4!TcwM*g5MTU4MzEz!*I4O*l8Mz(5OnVf!zFiOGFjM*UtO*E0!S00M*)mLTlm)*EtYjVkM*kx!zI3)mJhf*M1MjpKOGJ5R2xJYU!qX3!8MzEwOkdw)khBUFpIU3l2a1lv!0dSY3F2bUt4TQ~~
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame DE93
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LHOGVEZ1-17-H6WS
https://s.amazon-adsystem.com/ecm3?id=LHOGVEZ1-17-H6WS&ex=d-rubiconproject.com&status=ok

43 B
479 B

35ms
30ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LHOGVEZ1-17-H6WS&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZC8X71MMCT0M4H6YSY6Z
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LHOGVEZ1-17-H6WS&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c57992b917a1c5de787b922c662fdf18
Expires: 0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 808A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=minute_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east

281 B
554 B

23ms
23ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-rtb.minutemedia-prebid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:14 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:14 GMT
location: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame FD08 2 KB
814 B 30ms
8ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=765b4e6bb9c8438

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-rtb.minutemedia-prebid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 26ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5NzcyODIyNDEzNTYyNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJzd2lmdG1vdmVzX2Jsb2ctcGl4ZWwxIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImFkX2xvYWRfdGltZSIsInZhbCI6IjE4MjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:14 GMT

GET
H2 200 userZapping.js Show response
widgets.outbrain.com/nanoWidget/2010301/module/ 26 KB
7 KB 26ms
24ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/2010301/module/userZapping.js?e=1
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 833043cacc4b6a1fa211be428164629a8cfae9d6f8305d68673d67ac7155ec41

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
content-length: 7073
last-modified: Sun, 14 May 2023 14:24:00 GMT
server: AkamaiNetStorage
etag: "ac316a0e4de5e92f4e60a82d7d84a827:1684079987.916719"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Mon, 22 May 2023 06:31:14 GMT

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
330 B 98ms
87ms Fetch
text/plain 66.225.223.95
NTTA-3946

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=ed74607366c018e947d5d6270acd8282_6420_1684132273774&tm=1493&eT=0&widgetWidth=734&widgetHeight=316&widgetX=243&widgetY=890&tpcs=0&wRV=2010301&pVis=1&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=&ccpa=1---&rtt=615&oo=false&lo=608&odbreq=894&odbres=1363&mvreq=1559&mvres=2174&re=2178&cet=4g&cs=1&to=1684132271920.6&umv=1&ll=0&chs=2&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 66.225.223.95 Sacramento, United States, ASN3949 (NTTA-3946, US),
Reverse DNS: sa.outbrain.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 15 May 2023 06:31:14 GMT
Access-Control-Expose-Headers: content-range
X-TraceId: 9c7ec5cd1a6ea7f9933b196f0eff8013
Content-Length: 2
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8

GET
H2 200 obVideo.js Show response
libs.outbrain.com/video/obVideo/current/ 113 KB
31 KB 49ms
25ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 34ec958a193114641113b435f69be309fce34c02b391440f6fcc3f53c1ed05fd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 11 May 2023 05:51:04 GMT
server: AkamaiNetStorage
etag: "885bf484f25b44b43fba643c01c94842:1683784629.095521"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 30951
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H2 200 Close.svg
widgets.outbrain.com/images/widgetIcons/ 765 B
1 KB 34ms
20ms Image
image/svg+xml 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/Close.svg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2c92cde33538b1187bedea3d0b6d5141e4222eba8092476339aa080cee759ac

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 14 Jun 2023 06:31:14 GMT
date: Mon, 15 May 2023 06:31:14 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "f740f788e2e26736856f7a3a12457a63:1673369390.457553"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 765
access-control-request-headers: X-OB-STG,X-OB-PRD

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 30ms
19ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImFkX2xvYWRfdGltZSIsInZhbCI6IjE4MzkifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:14 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 29ms
19ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImFkX2xvYWRfdGltZSIsInZhbCI6IjE4NDAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:14 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 29ms
20ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTM0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImFkX2xvYWRfdGltZSIsInZhbCI6IjE4NDEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:14 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7B77 34 KB
10 KB 31ms
28ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66791
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 8012 34 KB
10 KB 32ms
32ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66791
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H2 200 eyJpdSI6IjI5ZjgzOTA2OGNkMmEwYjk5MjBlNGFlNWFhOGMzYWJiNzlhYTY4YjkwMjYyZTJiYTA2ZmZjNjNhZTA1YzU3M2YiLCJ3Ijo0NTAsImgiOjMwMCwiZCI6MS4wLCJjaCI6LTExNTQyMDY0NTYsImNzIjowLCJmIjo0fQ.webp
images.outbrainimg.com/transform/v3/ 28 KB
28 KB 119ms
49ms Image
image/webp 23.33.181.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjI5ZjgzOTA2OGNkMmEwYjk5MjBlNGFlNWFhOGMzYWJiNzlhYTY4YjkwMjYyZTJiYTA2ZmZjNjNhZTA1YzU3M2YiLCJ3Ijo0NTAsImgiOjMwMCwiZCI6MS4wLCJjaCI6LTExNTQyMDY0NTYsImNzIjowLCJmIjo0fQ.webp
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.181.205 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-205.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8ba36c32656a838690cd5f52275802624fe8e6cdf5de3a446e0d11bf044344ca

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
last-modified: Tue, 04 Apr 2023 20:58:07 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=421991
access-control-allow-credentials: false
x-traceid: 079ef247849aa9ed9a85ec375824ff8f
timing-allow-origin: *, *
content-length: 28826

GET
H2 200 eyJpdSI6ImI5NTYzMWExODllNWRiNDVjNmMxNTM0MTk0MWY4OWRjMjQ2ODY0NGU5MDliMDI0OTczZGIwYzk0M2YyOGU4ZDUiLCJ3Ijo0NTAsImgiOjMwMCwiZCI6MS4wLCJjaCI6ODI4MzAwMTA4LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 29 KB
30 KB 94ms
25ms Image
image/webp 23.33.181.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImI5NTYzMWExODllNWRiNDVjNmMxNTM0MTk0MWY4OWRjMjQ2ODY0NGU5MDliMDI0OTczZGIwYzk0M2YyOGU4ZDUiLCJ3Ijo0NTAsImgiOjMwMCwiZCI6MS4wLCJjaCI6ODI4MzAwMTA4LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.181.205 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-205.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4b022620cb45141f11ede515c1d89ce11b5b4ccf6fd2fd69a2f0bc293676e67e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
last-modified: Wed, 05 Apr 2023 16:13:22 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=1708409
access-control-allow-credentials: false
x-traceid: 162a1f6834163fd8c8985e1c9c31d703
timing-allow-origin: *, *
content-length: 29950

GET
H2

200

sync
ads.servenobid.com/ Frame CAA9
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=duration_media&khaos=LHOGVEZ1-17-H6WS
https://ads.servenobid.com/sync?pid=323&uid=LHOGVEZ1-17-H6WS

0
344 B

49ms
19ms

Image
image/avif

3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=323&uid=LHOGVEZ1-17-H6WS
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: H2
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ads.servenobid.com/sync?pid=323&uid=LHOGVEZ1-17-H6WS
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 131B 34 KB
10 KB 147ms
142ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66791
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrainimg.com/loggerServices/ 4 B
371 B 21ms
21ms Fetch
application/json 64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=ed74607366c018e947d5d6270acd8282&pvId=c62632dad57dd6a33aa5cac54e8c6521&sid=7473619&pid=6420&idx=1001&wId=1515&pad=2&org=0&tm=1612&eT=3&cnsnt=1---&wRV=2010301&pVis=1&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=1&oo=false&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: fdb7109d88d0627f90d29ca7097ecf13
Content-Length: 4
Expires: 0

GET
H2 200 sync Show response
ads.servenobid.com/ Frame 433A 0
344 B 29ms
27ms Document
text/html 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/sync?pid=152&uid=A7807108221276919879
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
amp-access-control-allow-source-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length: 0
content-type: text/html;charset=ISO-8859-1
date: Mon, 15 May 2023 06:31:14 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 808A 34 KB
10 KB 44ms
43ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66791
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DE93
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEhPR1ZFWjEtMTctSDZXUw==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEF_HT_jx3JfCB2I5brr0fP8&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhPR1ZFWjEtMTctSDZXUw==&google_push=

170 B
188 B

45ms
45ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhPR1ZFWjEtMTctSDZXUw==&google_push=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhPR1ZFWjEtMTctSDZXUw==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DE93
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=N2RhNjEyZDg5YzcwNjdkYjMyMTQ5YTRkMDA2YWM1NWMzNWQ4ODFjOA

170 B
188 B

40ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=N2RhNjEyZDg5YzcwNjdkYjMyMTQ5YTRkMDA2YWM1NWMzNWQ4ODFjOA

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-39-235-222.us-west-2.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=N2RhNjEyZDg5YzcwNjdkYjMyMTQ5YTRkMDA2YWM1NWMzNWQ4ODFjOA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame DE93
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/toElkDRCtitAbtj7g0CPmcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-BZY4MVVE2oIgIdg_V9FdxbrABIDT09zmrYSAZg--~A

42 B
787 B

24ms
24ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-BZY4MVVE2oIgIdg_V9FdxbrABIDT09zmrYSAZg--~A
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 29af2665c43893332e84c235bac366c1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-BZY4MVVE2oIgIdg_V9FdxbrABIDT09zmrYSAZg--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame DE93
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=&expires=30

42 B
787 B

102ms
24ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame DE93 43 B
855 B 491ms
177ms Image
image/gif 67.220.228.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.228.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: PMEEC4MF07WZV922YV5F
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame DE93
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEM06xB26UHuXGT41GFwuwEk&google_cver=1

42 B
787 B

96ms
24ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEM06xB26UHuXGT41GFwuwEk&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEM06xB26UHuXGT41GFwuwEk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame DE93
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LHOGVEZ1-17-H6WS

0
514 B

131ms
92ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LHOGVEZ1-17-H6WS
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 12BF754F038841C0AB9828314CDC8A41 Ref B: YMQ01EDGE0308 Ref C: 2023-05-15T06:31:14Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX7tZn5qUu05e11WOVTBg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LHOGVEZ1-17-H6WS
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame DE93
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=TyF_41S6Td-z_5sIpZZrXA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=TyF_41S6Td-z_5sIpZZrXA

43 B
479 B

31ms
30ms

Image
image/gif

52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=TyF_41S6Td-z_5sIpZZrXA

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 7DB03D1H8ERMRQ7S8GPE
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=TyF_41S6Td-z_5sIpZZrXA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame EECC 2 KB
2 KB 31ms
20ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 5df1b5d9b9dac7e53d33ddbd81803d405aafa8761cfbb8279969c4f9b5b592a6

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1955
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:14 GMT
Expires: 0
Keep-Alive: timeout=1, max=492
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7B77
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LHOGVEZ1-17-H6WS
https://usersync.gumgum.com/usersync?b=mag&i=LHOGVEZ1-17-H6WS

35 B
250 B

26ms
24ms

Image
image/gif

54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LHOGVEZ1-17-H6WS
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LHOGVEZ1-17-H6WS
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8bab65602db075726861004da5629947
Expires: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 8012
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&khaos=LHOGVEZ1-17-H6WS
https://cs.yellowblue.io/cs?aid=11590&id=LHOGVEZ1-17-H6WS

0
284 B

24ms
23ms

Image
application/javascript

54.161.38.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=LHOGVEZ1-17-H6WS
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol: H2
Server: 54.161.38.36 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-38-36.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://eus.rubiconproject.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cs.yellowblue.io/cs?aid=11590&id=LHOGVEZ1-17-H6WS
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H2 200 icon-vi.svg
widgets.outbrain.com/images/widgetIcons/ 229 B
543 B 26ms
25ms Image
image/svg+xml 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/icon-vi.svg
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/2010301/module/userZapping.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3c1179965bbbc155a93a33852b756160ec48f09d26d41f96273d14f732fa74c8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
content-length: 182
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "91990280dce13a095a0da3a6b2fc6816:1673369403.63584"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Wed, 14 Jun 2023 06:31:14 GMT

GET
H2 200 ChevronRight.svg
widgets.outbrain.com/images/widgetIcons/ 524 B
866 B 28ms
27ms Image
image/svg+xml 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ChevronRight.svg
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/2010301/module/userZapping.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f8d6148b07b2251c53a2605a003b1d29babb8154c5abd0bde0f7e8a800f2dfd9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 14 Jun 2023 06:31:14 GMT
date: Mon, 15 May 2023 06:31:14 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "c1dc41410784b37a37e29a21baf9aa1f:1673369389.756676"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 524
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H2 200 icon-x-white.svg
widgets.outbrain.com/images/widgetIcons/ 559 B
901 B 27ms
26ms Image
image/svg+xml 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/icon-x-white.svg
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/2010301/module/userZapping.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 06ffd9e17bd41822b9a7b982a8ff486fafa54f7781baacb6ef3507ae7f9b36b5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 14 Jun 2023 06:31:14 GMT
date: Mon, 15 May 2023 06:31:14 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "854eb39a3d94a8ec9977261db0c8acc8:1673369404.25082"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 559
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame EECC 43 B
855 B 39ms
34ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: M3808VQCDBR3B9RVG22Z
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame EECC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=491
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EECC
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724274&gdpr=0&gdpr_consent=

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724274&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490&expiration=1686724274&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame EECC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZGHRseRl8.SUQDBYssPdFQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2

43 B
632 B

20ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAx29unm8tq5TVPV8GQJkXo&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame EECC
Redirect Chain

https://x.bidswitch.net/sync?ssp=index
https://cm.smadex.com/sync?sm_did=bds&bds_ssp_id=index&bds_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://x.bidswitch.net/sync?dsp_id=340&user_id=4898a96b-d658-4e71-92de-eca42af52c39&expires=10&ssp=index&bsw_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Location: //dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 15 May 2023 06:31:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EECC
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZGHRsQAKKKWZKgAp

43 B
632 B

18ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZGHRsQAKKKWZKgAp
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-yul12825-YUL
pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1684132274.468163,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZGHRsQAKKKWZKgAp
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=ZGHRseRl8.SUQDBYssPdFQAA%261358
dpm.demdex.net/ Frame EECC 42 B
942 B 83ms
82ms Image
image/gif 52.39.235.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZGHRseRl8.SUQDBYssPdFQAA%261358?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.39.235.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

DCS: dcs-prod-usw2-1-v044-0e56850aa.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: gFRgQ03oQ2Q=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame EECC
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

43 B
603 B

29ms
28ms

Image
image/gif

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Protocol

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 setuid
ow.pubmatic.com/ Frame EECC 0
994 B 25ms
23ms Image
text/html 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-length: 0
content-type: text/html

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 808A
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=minute_media&khaos=LHOGVEZ1-17-H6WS
https://cs.minutemedia-prebid.com/cs?aid=21479&id=LHOGVEZ1-17-H6WS

0
284 B

28ms
26ms

Image
application/javascript

52.70.153.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21479&id=LHOGVEZ1-17-H6WS
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Protocol: H2
Server: 52.70.153.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-153-7.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://eus.rubiconproject.com/
date: Mon, 15 May 2023 06:31:14 GMT
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cs.minutemedia-prebid.com/cs?aid=21479&id=LHOGVEZ1-17-H6WS
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c57992b917a1c5de787b922c662fdf18
Expires: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_002.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 69 KB
69 KB 34ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_002.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01b6cbe36d69046c64b07b5653c588eecf4a220ba081cd482e2262bae9297f26

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnxxtVaXBGUuh6sla5C6Qcr7bwgfNnxjDr9%2B%2BznihPlwYyl8opqOmo3XdiVLALPELw3kfR9aYt4WIcuewAp4lfzmOedKLyqqDywnpPDNrKYnl8C8OeihjdmVsWyEsBres8iKDUGtdkSVLKUZY%2FO4cENq"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79563bca145437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70420

GET
H2 200 si
capi.connatix.com/tr/ 0
330 B 130ms
64ms Image
application/json 104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/tr/si?token=dceed97a-951e-4c47-b565-c2794ffae817&cid=5f049401-746e-4449-8c27-b6b9d8e25882
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7c79563c3cd4a1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 334.obVideo.js Show response
libs.outbrain.com/video/obVideo/current/ 12 KB
4 KB 28ms
27ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/334.obVideo.js
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9356c7e858b8004444333837019cebdab10ff62e6775c42c3bb180f0beeeee53

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 11 May 2023 05:51:04 GMT
server: AkamaiNetStorage
etag: "3af318edd53dbb777e620c226bfc1b89:1683784622.647892"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 3819
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H2 200 688.obVideo.js Show response
libs.outbrain.com/video/obVideo/current/ 16 KB
5 KB 26ms
25ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/688.obVideo.js
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9bbd37da5a4b98eb2690bd65094794d806fb765c3d6cddaadd09b698a594347f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 11 May 2023 05:51:04 GMT
server: AkamaiNetStorage
etag: "8f03c82f1cb9d933c9a92d77280e2f1e:1683784625.891332"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 5097
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H2 200 822.obVideo.js Show response
libs.outbrain.com/video/obVideo/current/ 178 B
471 B 27ms
27ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/822.obVideo.js
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 89a2d18b2cc89a3a8466cb2bf20928f950d2d0ae6f4bf9f4c270090a3224c567

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 11 May 2023 05:51:04 GMT
server: AkamaiNetStorage
etag: "399e7d178d16eb28c3a48dd0f1251c44:1683784627.787516"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 155
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H3 200 audio_002.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 38ms
37ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_002.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 290e47cf23c68b39c2436f1403276b9102ac622a7e464fd138477fe0cc79238f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l1pKpI3FwE3VsGNFm7cD4rG0Ei626t1pCf64HBo6DGhFFy%2FWpV8AkD5hCILyB9gf%2BR7dbHlzDnThdbgrOeQvOvfWolJf6nyd4LMNAKTn3KzdxvIHdMiaJe7R49s%2BiI1FEJoVoso%2FzkAu10tnl6aRmUVr"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79563c5aae5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40621

GET
H2 200 vpts.js Show response
static.vidazoo.com/basev/ 42 KB
11 KB 85ms
20ms Script
application/javascript 2606:4700::6812:46d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/vpts.js
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:46d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0ecd0b7c8e4db72578c8d28429bff3a47a2d8f306e3c9ecce4f34403b9ed83

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: C3QQMF5FY2EN7Z84
age: 44743
content-length: 10884
x-amz-id-2: UFNvVQGAv8vW3PwLtu9ihWeAmGrNuFN7H/ybKaWmGbvvOKjKQkFFs4rPwKJ4UCt0YjWNTP54f2s=
last-modified: Tue, 08 Jun 2021 05:47:52 GMT
server: cloudflare
etag: "c5a750a1ed58c511f163f50523350222"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79563cc9ff7133-YUL
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 16 May 2023 06:31:14 GMT

GET
H2 200 omp.min.js Show response
libs.outbrain.com/video/outbrain-media-player/current/ 14 KB
6 KB 30ms
30ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/outbrain-media-player/current/omp.min.js
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 633eb8fd8c0d233806f69e59312a8fb7f131cbbfa06bcde8e12f08b1a8a81800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 13 Apr 2023 10:15:37 GMT
server: AkamaiNetStorage
etag: "3f9b70c39f5449d55a300e69f6906ec0:1681382801.408067"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 5638
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H2 200 omp.min.css
libs.outbrain.com/video/outbrain-media-player/current/ 11 KB
3 KB 33ms
33ms Stylesheet
text/css 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/outbrain-media-player/current/omp.min.css
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/outbrain-media-player/current/omp.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3c7462d7424da799db65370aa29e2f525600c5ec407cc966b664e4b0fc0f90fa

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 13 Apr 2023 10:15:37 GMT
server: AkamaiNetStorage
etag: "dee81b04dc7a78bae8d2dedfb895bd31:1681382801.129788"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 2256
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H2 200 252.bundle.js Show response
libs.outbrain.com/video/outbrain-media-player/current/ 2 KB
1 KB 31ms
31ms Script
application/x-javascript 23.33.181.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/outbrain-media-player/current/252.bundle.js
Requested by: Host: libs.outbrain.com
URL: https://libs.outbrain.com/video/outbrain-media-player/current/omp.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.181.107 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-181-107.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4f8ea93da34138f1638a714214d277c3a0f14e513ff4b8b32b9708bb0782685c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
last-modified: Thu, 13 Apr 2023 10:15:37 GMT
server: AkamaiNetStorage
etag: "ba054d563137e0f3b932b6fddac424f0:1681382798.098942"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 1074
expires: Mon, 15 May 2023 10:31:14 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_003.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 95 KB
95 KB 37ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_003.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ecea22c4b1d3b38079d373b40382c9eb0f7ba1a14b13ebc43f62cb5077801a4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LkBSXQFXYEkvrb6VFwnkP4112lUnQzb8PGBfmt9KL9CSYwPIGPiopQ9jQ6xwGpchrq%2FpOV2mz9grIwYxYRJgn9TZjRFrxtv%2FfnBskdBleEfK13Wltk2gjoS3%2FiVrOyaAUPwwG%2BZcXqsrHw%2Fynt5Qe7XZ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79563cdb2a5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 96874

GET
H2 200 platforms Show response
odb.outbrain.com/utils/ 6 KB
3 KB 250ms
250ms Script
text/x-json 146.75.38.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://odb.outbrain.com/utils/platforms?contentUrl=https%3A%2F%2Fswiftmoves.blog%2F&idx=101&rand=22148&widgetJSId=FMS_CP_1&va=true&et=true&format=vjapi&rtbEnabled=true&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&lsdt=1684132273287&t=YzYyNjMyZGFkNTdkZDZhMzNhYTVjYWM1NGU4YzY1MjE=&extid=284837_1_191_100x240&fId=101&feedVersion=2&fAB=11984-89554&settingLevel=TEMPLATE&servePc=true&maxNumAds=1&num=1&maxNumOrganicRecs=0&secondaryVideoReq=true&videolinearity=2&fAB=11984-89554&feedIdx=0&playerLocation=aboveWidget&playerLocation=aboveWidget&layeredTestInfo=11984-89554-83708&recMode=odb_video&videoWidth=734&videoHeight=412&pauseOutOfView=false&placementType=4&videoPlaybackMethod=6&isRequestInView=true&activeTab=true&seid=eeb8c9e1-0388-8d0e-0000-01881e1b1b29%7C0%7C1&settings=true&recs=true&key=EZOICL9MFJN21JB32NFBE7ODP&adblck=false&abwl=false&ab=0&wl=0&wdr-cosc=1&version=2010301&sig=QuwZhUlG&apv=false&&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpa=1---&ccpaStat=1&chs=1&ogn=https%3A%2F%2Fswiftmoves.blog%2F
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.38.132 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2aa0cf9eb42169681e33b3c24e1ef193d3cac4b086129af0370c62abd5a1e4e6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: br
via: 1.1 varnish
traffic-path: SADC1, IAD, North_America
x-cache: MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
x-traceid: 5eea9c5974b1d2a760d3e5a8d9bd3ab4
content-length: 2972
x-served-by: cache-iad-kcgs7200070-IAD
pragma: no-cache
x-timer: S1684132275.703297,VS0,VE227
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK recordOBV Show response
videoevents.outbrain.com/events/ 41 B
380 B 94ms
21ms Fetch
application/json 64.202.112.159
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://videoevents.outbrain.com/events/recordOBV?eventType=VIDGET_PLACEMENT_VIEWABILITY&abTestList=11984-89554-83708&abTestVal=11984-89554-83708&adBlocker=false&cardIdx=1&ccpaPrivacy=1---&configuredNative=never&configuredProvidersCount=2&configuredReloadCount=1&docId=4543702453&featureFlag=GA&feedVersion=2&gdpr=0&iframe=false&obRecsAbtestAndVars=1024-3192%2C833-3369%2C386-1123%2C1090-3454%2C1154-3763%2C1155-3748%2C1094-3468%2C1159-3755%2C1223-4077%2C1161-3766%2C1164-3777%2C1165-3783%2C1231-4109%2C1103-3714%2C1168-4046%2C784-2396%2C1105-3514%2C1169-3790%2C1172-3813%2C1045-3874%2C792-2427%2C927-3026%2C998-3234%2C1069-3352%2C1008-3129%2C1137-3751%2C1203-4057%2C822-2522%2C951-2935%2C888-3161%2C1146-3694%2C1082-3419%2C699-2183%2C1086-3443&placementType=footer&playerLocation=aboveWidget&publisherId=6420&screenResolution=1200x1600&sessionId=ebd5844e-a1b9-b825-4615-58574d98b22f&sourceDocUrl=https%3A%2F%2Fswiftmoves.blog%2F&sourceId=7473619&sourcePvId=c62632dad57dd6a33aa5cac54e8c6521&sourceRequestId=ed74607366c018e947d5d6270acd8282&sourceSubWidgetId=FMS_CP_1&sourceWidgetId=AR_2&version=v1.174.0&waterfall=Vidazoo%2COPA&widgetIdx=1001&externalId=284837_1_191_100x240&isAdnginControl=false&isOnyxFeed=false&currentReload=0&playingType=OUTSTREAM&orientation=LANDSCAPE&viewability=75&providersStatus=%7B%22Vidazoo%22%3A%7B%22playedAds%22%3A0%2C%22loadedAds%22%3A0%7D%2C%22OPA%22%3A%7B%22playedAds%22%3A0%2C%22loadedAds%22%3A0%7D%7D&videoClickUrl=7f5f20aa-dfb3-d69d-dc98-79fe568bb07b&localTime=Mon+May+15+2023+06%3A31%3A14+GMT%2B0000+%28GMT%29&playMode=UNKNOWN
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.159 Chicago, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 3649cae0069d73cdaa9422b1e69672afd111cd7c4cc3fa8d9a91c4033d5cf8c8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
Connection: close
X-TraceId: 10ef67a5c54e8ee15c4bbdc32e8e9f8c
Content-Length: 41

OPTIONS
H/1.1 200
OK json
server5.vidazoo.com/campaigns/5a9ea5a0225f7d0004c70045/612b515fa94087000435798d/ Frame 0
0 102ms
25ms Preflight 18.205.36.100
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://server5.vidazoo.com/campaigns/5a9ea5a0225f7d0004c70045/612b515fa94087000435798d/json
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.205.36.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-36-100.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Max-Age: 86400
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:14 GMT
Server: Cowboy
Via: 1.1 vegur

POST
H/1.1 200
OK json Show response
server5.vidazoo.com/campaigns/5a9ea5a0225f7d0004c70045/612b515fa94087000435798d/ 30 KB
19 KB 92ms
42ms XHR
application/json 18.205.36.100
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://server5.vidazoo.com/campaigns/5a9ea5a0225f7d0004c70045/612b515fa94087000435798d/json
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/vpts.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.205.36.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-36-100.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 602428cbfd1413787dce9e64e1d13490afb57f42aa75262293e30e1a66dd9258

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

Date: Mon, 15 May 2023 06:31:14 GMT
Content-Encoding: gzip
Via: 1.1 vegur
Server: Cowboy
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: max-age=0, no-cache, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
Content-Length: 18533

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 7305 2 KB
870 B 10ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

ec9fe4d0ced38987b5b20c2b8431e541cdf946f422f2130435f02487d06f8283

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 787
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 setuid
ow.pubmatic.com/ Frame 7305 0
994 B 24ms
23ms Image
text/html 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=onetag&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BUSER_TOKEN%7D&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-length: 0
content-type: text/html

GET
H2

200

setuid
ow.pubmatic.com/
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dmedianet%26gdpr%3D%26gd...
https://ow.pubmatic.com/setuid?bidder=medianet&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3271338731455172000V10

86 B
1 KB

24ms
23ms

Image
image/png

8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=medianet&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3271338731455172000V10
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-length: 86
content-type: image/png

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Mon, 15 May 2023 06:31:14 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
location: https://ow.pubmatic.com/setuid?bidder=medianet&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3271338731455172000V10
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:14 GMT

GET
H3 200 audio_003.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 35ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_003.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2185772f744e8e3cc6e70476f38a4f4fd8a3f328c70b8f333e762aa78f9397a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ew3hUHwtJYP%2BB%2Fh4H%2FDjqfnnH1tXhJXka8kX5UrnIcj3X8LIfnymrnx7cp2gLbF3mF5KMy7JsR3UIVwK2fdqk5sRbjztMSbQ2iRjcBPCwdQ%2B%2FLUl0EJaB241Mqq09%2BsMfwNpVT5fMxjU6R4T3sQqINzt"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79563dbc375437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40130

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_004.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 75 KB
75 KB 39ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_004.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25aa0dafd69b5d661a1739825bcb3b99dbb3ae08cc8b98ffa50b1e2efa525411

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1kx8XdbK2%2F%2BRTc68pVIb82saj%2F%2F5B7w3CJEPX5lyn1SKTK85RntuxqwdZYBtjcMukru7PMucZcBtFUoacXXa7fhfaoBD0txkReqssI7Uwr23h7feqaKrv%2BJBhw5uzGb%2F%2F%2FsCR8dZMtauiYJIZMmdH6d2"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79563e4d265437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 76423

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
330 B 87ms
86ms Fetch
text/plain 66.225.223.95
NTTA-3946

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=fc968cb631f2ef5e98c30b579e1f6be5_6420_1684132274892&tm=2338&eT=0&wRV=2010301&pVis=0&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=&ccpa=1---&oo=false&umv=1&chs=2&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 66.225.223.95 Sacramento, United States, ASN3949 (NTTA-3946, US),
Reverse DNS: sa.outbrain.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 15 May 2023 06:31:14 GMT
Access-Control-Expose-Headers: content-range
X-TraceId: 800eb01e877b659552245c83da25c8a8
Content-Length: 2
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8

GET
H2 200 sbt.js Show response
static.vidazoo.com/basev/1.0.802/ 650 KB
137 KB 17ms
17ms Script
application/javascript 2606:4700::6812:46d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/1.0.802/sbt.js
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/vpts.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:46d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca1658acd3e025c7c65bf6b792d058b578d0fd1f021aebef15639a9b781bf2d8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 1MBC16WJX5TT7H6F
age: 74375
x-amz-server-side-encryption: AES256
content-length: 139997
x-amz-id-2: 8cWkAOdZ6QsPF0H5neWVZ7Kc+XhH3VqRdgUbdeEJ5/6gQNA0thMROfkO0Q9Mf+4oaOmsr/8GWzY=
last-modified: Sun, 02 Apr 2023 09:39:24 GMT
server: cloudflare
etag: "9bdfef1baa38d5a34c32f3b177656616"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79563e8b457133-YUL
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 16 May 2023 06:31:14 GMT

GET
H2

204

magnite
prebid.a-mo.net/setuid/
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=&us_privacy=&cb=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Damx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D
https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr=0&gdpr_consent=&us_privacy=
https://prebid.a-mo.net/setuid/magnite?uid=LHOGVEZ1-17-H6WS&gdpr=0

0
127 B

26ms
25ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LHOGVEZ1-17-H6WS&gdpr=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LHOGVEZ1-17-H6WS&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
Expires: 0

GET
H3 200 audio_004.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 39ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_004.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37c13c5b1f616d1ed6e6882e05d008a1b62e0da802b93887adb8ae5ac825a20e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K406K75eo3mE0gEWlMwRY5dT0mHpRVnDMUUOlkGze7yNVGTO6hmWh8ArImuUEX2lmtSN1f0iKxgZTQGvBd1OEWDWSdrC%2BteLuAnTuzCAcdeZvRMApalD1SaVs0CCn0FN8PoQMO5dc6Xp3SNHALkM86n4"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79563ebd8c5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40677

GET
H2 200 outbrain.js Show response
static.vidazoo.com/basev/skins/outbrain/ 71 KB
20 KB 16ms
16ms Script
application/javascript 2606:4700::6812:46d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/skins/outbrain/outbrain.js
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/sbt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:46d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f006dec88c65732acad8ea71a9bcc6be450a360567eccc8174da37df54c6038

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 76NGNAJ72NFQEB6D
age: 31054
content-length: 19996
x-amz-id-2: RgC1yCY7At2GTJEEC86NZvqMJk4V+JTFjTFLiUi/jPkv8fJqZakyJN94sud3zRTnf2lNfqHND68=
last-modified: Mon, 06 Apr 2020 12:23:25 GMT
server: cloudflare
etag: "27c03d08ed4bfb0b9084b79ce358e325"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79563f5bcb7133-YUL
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 16 May 2023 06:31:15 GMT

GET
H2 206 blank.mp4
static.vidazoo.com/basev/ 891 B
1 KB 17ms
17ms Media
video/mp4 2606:4700::6812:46d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/blank.mp4
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:46d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c957adaf4326a8636ad68fc78acb194b96b34bbeba09daf6b36c74975ac37d21

Request headers

Referer: https://swiftmoves.blog/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
x-amz-request-id: GBRATFDKPPPX6NP7
age: 31770
Content-Range: bytes 0-890/891
Content-Length: 891
x-amz-id-2: f2+C1F2B/+ZcpIOAgwi4MRbq5AQkt1+iE1JmVteMD1xQW6KEGPxxiBnro5maThMnaL4+gAPvg9k=
last-modified: Mon, 06 Apr 2020 12:07:11 GMT
server: cloudflare
etag: "86ec3fbb73842f6c776555cfb7f1950d"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: video/mp4
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: public, max-age=86400
cf-ray: 7c79563f7be87133-YUL
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 16 May 2023 06:31:15 GMT

GET
H2 200 5bce1044a94d4200045740ed.jpg
inventory.vidazoo.com/5a9ea5a0225f7d0004c70045/5bce1044a94d4200045740ed/ 677 B
950 B 100ms
77ms Image
image/jpeg 2606:4700::6812:46d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://inventory.vidazoo.com/5a9ea5a0225f7d0004c70045/5bce1044a94d4200045740ed/5bce1044a94d4200045740ed.jpg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:46d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e724533992b3c0cf17c8ec16eb7e6edad2dafb80b1a563b84b663b11841c1f3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
x-amz-request-id: HT0VX3WHC383S654
age: 32228
content-length: 677
x-amz-id-2: CQdUl/XcS2kOO8lRk4MDFs3a7dyskvAkbb7kUSgHsgXdlmH+YiuzmDkkP/7A3WFkTPNGmnKt5aw=
cf-bgj: h2pri
last-modified: Mon, 22 Oct 2018 18:01:45 GMT
server: cloudflare
etag: "78252c61eb4971238aab053f7a617825"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7c79563fcc467133-YUL
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 14 May 2024 06:31:15 GMT

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-ttf

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e38335b8da3a11b4a278e7572f99a3990da81b9764b7526bd7b69ec0c6a57c84

Request headers

Referer
Origin: https://swiftmoves.blog
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: application/x-font-ttf;charset=utf-8

GET
H2 200 iJWbBXyIfDnIV7nEt3KSJbVDV49rz8u6FHU3f4I.woff2
fonts.gstatic.com/s/rubik/v26/ 18 KB
18 KB 152ms
152ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v26/iJWbBXyIfDnIV7nEt3KSJbVDV49rz8u6FHU3f4I.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Rubik:300,500,700,700italic,900,regular&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47f1bca01c0390a6f7134f2032b619cebe2d2615d32bebe6c7c0f5bf3670c070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://swiftmoves.blog
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:33:33 GMT
x-content-type-options: nosniff
age: 7062
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18496
x-xss-protection: 0
last-modified: Wed, 08 Mar 2023 21:38:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 14 May 2024 04:33:33 GMT

GET
H2 200 prebid.js Show response
static.vidazoo.com/basev/1.0.802/prebid/ Frame 79BB 768 KB
240 KB 44ms
44ms Script
application/javascript 2606:4700::6812:46d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/sbt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:46d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 464220c72a1da7b44953151ece06d32a6b9758a9d15b18e4263fec9c33a5c71b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 676K3EY0YEG3PAYB
age: 50084
x-amz-server-side-encryption: AES256
content-length: 245657
x-amz-id-2: LTzNrHkAG5v2JbIZSuCLKoWEWPP4KsjGC6rgJ6VdZpnk3gNdHvWIo6jjs5LpOdRnd8wu1wg0UUo=
last-modified: Sun, 02 Apr 2023 09:39:25 GMT
server: cloudflare
etag: "656a3d864336b2ef52f8d67caf1672cf"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79563fdc4b7133-YUL
access-control-allow-headers: Origin, Accept ,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length, Accept-Language, Accept-Encoding, Referer, Range
expires: Tue, 16 May 2023 06:31:15 GMT

GET
H3 200 audio_005.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 49ms
44ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_005.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c000aaff6d80fb099c73fbdfc53fe0df05f7bb3e95898e14a733a5bd3739b513

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fen2sHcvRR1vylcOjGnh%2BWQgZaYi9OKeeCD80dmsHhTxjGrDW7vWhypMV3%2BCZ%2BzjPBGdeQBWOpY%2Feg2crj%2BZltMVqrDIFJqybz9vSNn1e2dj5VISj2MPflpiJLIXNQByW8j8DjuQlo%2BzXMkI6WBgTFD%2F"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956405f7c5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40963

POST
H2 200 aggregate Show response
bis4.vidazoo.com/ 0
183 B 109ms
23ms XHR
text/plain 157.230.8.140
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bis4.vidazoo.com/aggregate?_=1684132275262
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/sbt.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.230.8.140 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:15 GMT
content-type: text/plain
access-control-allow-headers: *
content-length: 0
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

POST
H/1.1 200
OK aggregate Show response
bis.vidazoo.com/ 0
314 B 133ms
33ms XHR
text/plain 3.232.242.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bis.vidazoo.com/aggregate?_=1684132275263
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/sbt.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.242.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-242-170.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Mon, 15 May 2023 06:31:15 GMT
Via: 1.1 vegur
Server: Cowboy
Content-Type: text/plain
Access-Control-Allow-Origin: *
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_005.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 74 KB
74 KB 39ms
38ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_005.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eb78ce102198677e32dae534ef6823a4d5bb8e04727192104e0d7f44d4ba558

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mkNqitbICXWkXmaNxRpcgT3A4oIpjDEcaHhejmlqy%2B1B3U%2FeSeob8HtDrGDl4Ziv3QN9Q4wGZ1fulW1zib1%2BYkgUGAO5%2BJuAsc92lVSGUsc6zBXEwAnCnMfCs%2FVzNOgELn%2Bv0tj6NWpftAY13ALWrMI7"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795640880b5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 75274

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 79BB 483 B
1021 B 98ms
28ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:15 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Wed, 23 Nov 2022 15:43:18 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 2429012
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KvqU700PE2DqPENmDGVSNAo4Bfg4QrNhZNq%2B5L48f48seu5fTdN8zGWdsLlMSWOIO4Bdxj8%2FuEPqWeb28eqJrrIQlaIhw95bkjvxtPKrk9Oy6EJuYWsbAZIVB%2FNoy2WOsQf3ky8k7w5Zkt%2Bk"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 7c7956414bb3a1db-YYZ

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
426 B 201ms
30ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: 1e8fe123c400a66ef4d5c48fa730ff97d4c05f313b00b328df9ec2720e85a25f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
255 B 143ms
43ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:15 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: 4485162e-6f10-96f3-a022-7c06c893e1ef

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame 79BB 74 KB
23 KB 67ms
27ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:15 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 552886
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 23 Nov 2022 15:43:17 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y5cCOAfewxRFhNnaVZbdFR25tO4xA2CMR1StEA%2BMn7qLni6P8X5IBMRBkQdDgBewxu%2BConJ5nGchzjheKuQr%2FKNEucVuX%2FTAzW3KkyTpEw8SA89w1US17s2%2BlOY8gaQhXRRvvTseYFmAjyrQ"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 7c795641c847547f-YYZ

GET
H3 200 audio_006.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 41ms
41ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_006.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bbf31c39b4536da26b9f8dca6085ff6527dc6f0bc20b2c922c1c0e779da3c72

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ynJ1lW20BvDYxQAMFKk1PcOtByqxtiQozydwZqWFDBuZz27k%2BY12z%2BBz7rsAz2HXYxYe1Cw7fw8cvOWfxK7GX12xcQujpCzQN9ArBkQNSGsJ3qJRO3R%2BETFx4v6GGwVeFVHa8HUwa8IC%2Bhc9zvQOod%2B7"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795641d9455437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40385

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_006.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 97 KB
97 KB 56ms
55ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_006.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61c47907556424dbad00953f4b05421e92fcc8fc2a216f2535a6afa882d22c3e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=InQmMJokiZuVLBVlvTSQw1Zzq2PUza83yk1oNGnYTF9AdKrlcziVEuMkMmESDq%2Ft134hnFo%2FWnJ3mWGdCXJSyeud7c73WFclDQcC7EDjifT5sR0XaHOetpp9ul91Vu23v2Z2uZjky2mGjuKKGsP4D99S"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795641d94a5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 99044

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame E906 0
128 B 27ms
25ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fow.pubmatic.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 79BB 144 B
1 KB 97ms
97ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

ad5a7675c03d801f6cb72d5c3826679feecb4440da87e7e9077b356aa18138f4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:15 GMT
AN-X-Request-Uuid: 982e7d4a-d9f2-4131-8155-a82d8b609902
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vpp.gif
swiftmoves.blog/detroitchicago/ 43 B
84 B 24ms
24ms Image
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swiftmoves.blog/detroitchicago/vpp.gif?e=%5B%7B%22url%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22pageview_id%22%3A%22ba088273-417b-4dd5-55f5-4f5fefddc39f%22%2C%22template_id%22%3A134%2C%22player_name%22%3A%22ezoicvideo%22%2C%22domain_id%22%3A284837%2C%22media_src%22%3A%22blob%3Ahttps%3A%2F%2Fswiftmoves.blog%2F45213039-a903-4820-8e2b-9ee3f6fffcd1%22%7D%5D
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:14 GMT
content-encoding: br
vary: Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 14 May 2023 06:31:14 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 70ms
23ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fswiftmoves.blog%2F&domain=swiftmoves.blog&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 15 May 2023 06:31:15 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 420199
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame 79BB
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fswiftmoves.blog%2F&domain=swiftmoves.blog&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=i2ox53xaV2RyUXpPT1pWZmI0WkNJQ1g4WVJScFpjdjBrbzFvK0IyK2tyNjFsWmovRUtNcmhiTkZ3VSsxMjY4a1FpVThBVkx3QTFwK0pjQ2VrYWVyVTlGdHJoemhQbnFmR0k2dlMwWGtPQXl1ZGNxWmZaY1pITUpqUmhHVz...

373 B
656 B

70ms
24ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=i2ox53xaV2RyUXpPT1pWZmI0WkNJQ1g4WVJScFpjdjBrbzFvK0IyK2tyNjFsWmovRUtNcmhiTkZ3VSsxMjY4a1FpVThBVkx3QTFwK0pjQ2VrYWVyVTlGdHJoemhQbnFmR0k2dlMwWGtPQXl1ZGNxWmZaY1pITUpqUmhHVzVRYkRDU1Z6MngxbDFMM3JCYWN5MGRpeWRIUjlJWmpoNk9JOVA4S29QV1JEM0w4Y2V3RlpXV0ozbVR4TnhkZ1FCS1hlZVcrK0VjT3FlOVRkamU4MXVnbEs4VThJQ1hjbkpTNW9Ca1NxeS83c1F3V3cxdVdRPXw&cppv=2

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

3ec1d9a5c286e38927fdcfa000d564929b37217e7f03a41829a50fc29014ddb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1537920
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
location: https://mug.criteo.com/sid?cpp=i2ox53xaV2RyUXpPT1pWZmI0WkNJQ1g4WVJScFpjdjBrbzFvK0IyK2tyNjFsWmovRUtNcmhiTkZ3VSsxMjY4a1FpVThBVkx3QTFwK0pjQ2VrYWVyVTlGdHJoemhQbnFmR0k2dlMwWGtPQXl1ZGNxWmZaY1pITUpqUmhHVzVRYkRDU1Z6MngxbDFMM3JCYWN5MGRpeWRIUjlJWmpoNk9JOVA4S29QV1JEM0w4Y2V3RlpXV0ozbVR4TnhkZ1FCS1hlZVcrK0VjT3FlOVRkamU4MXVnbEs4VThJQ1hjbkpTNW9Ca1NxeS83c1F3V3cxdVdRPXw&cppv=2
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 533178
content-length: 0
expires: 0

POST
H/1.1 200 prebid Show response
id5-sync.com/api/config/ Frame 79BB 135 B
544 B 304ms
101ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

c1bc9713262909e254cacf97028387438221cc0d1f416262d4338c93e14a865c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 id Show response
id.crwdcntrl.net/ Frame 79BB 152 B
901 B 74ms
57ms XHR
application/json 54.235.118.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?us_privacy=1---
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.118.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-118-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: b324c34e24c4217a6b8e3c1aaca6c2afbf9aaf16e9b6363a11c756c1f79a37d9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
x-server: 10.40.9.139
access-control-allow-credentials: true
content-length: 152
expires: 0

GET
H/1.1 200 prebid Show response
h.parrable.com/ Frame 79BB 123 B
470 B 140ms
36ms XHR
application/json 35.196.86.86
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.parrable.com/prebid?data=eyJlaWQiOm51bGwsInRyYWNrZXJzIjpbIjE5YWQ2YzRkLTc3ZGEtNDU2ZS04NzRiLWQzODA1M2E5Y2M5OCJdLCJ1cmwiOiJodHRwczovL3N3aWZ0bW92ZXMuYmxvZy8iLCJwcmViaWRWZXJzaW9uIjoiNy40MS4wIiwiaXNJZnJhbWUiOnRydWUsInRwY1N1cHBvcnQiOm51bGx9&gdpr=0&_rand=0.9693948879240741&us_privacy=1---
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.196.86.86 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 86.86.196.35.bc.googleusercontent.com
Software: /
Resource Hash: 5019169aa593733ae16f27ba1fe43373d9217fe74fd1c2f49bde842f94e0e653

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:15 GMT
Content-Encoding: gzip
Access-Control-Allow-Credentials: true
Connection: close
Transfer-Encoding: chunked
Content-Type: application/json

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame 79BB 108 B
768 B 26ms
26ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=t63kyxp&fmt=json
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: d7e78fc5b4fba478634e76bdd9717fbe9e14edc5536faedb14f41fbab169c6b8

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Wed, 14 Jun 2023 06:31:15 GMT

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 29ms
27ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:15 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: a6a4a167-9d6c-8b49-05cb-fe612d8cdaac

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 79BB 859 B
2 KB 269ms
90ms XHR
application/json 23.105.12.131
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.131 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 3b545c75514b4d9f50bc6b40a9ef9beca05d373080f5bec4d21ff57c11040448

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK metric
report2.hb.brainlyads.com/statistics/ Frame 79BB 463 B
751 B 88ms
24ms Image
image/png 54.84.92.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://report2.hb.brainlyads.com/statistics/metric?event=noBid&bidder=appnexus64520d892126d5b60b1c1d8a&source=pbjs&placements=29926568
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.84.92.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-92-154.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 64faef43f59f0d829a290bb25e0b5c24308c0381b590d9717e460a8344912ba3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:15 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Powered-By: Express
ETag: W/"1cf-XHssOe1+WUPy43P3Ckt9sJ3fhf4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 463

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 27ms
26ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: a47182e59249266daa870fe7e830fb4e28ae4a21e737f1c35eb38fed1e972e4f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 4746 52 KB
17 KB 47ms
10ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 537
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:15 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 818
X-Served-By: cache-lga13626-LGA, cache-yul12831-YUL
X-Timer: S1684132276.702978,VS0,VE0

POST
H2 204 grapefruit.gif
swiftmoves.blog/detroitchicago/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/grapefruit.gif?orig=0&v=W3sidHlwZSI6InZpZGVvIiwidmlkZW9faW1wcmVzc2lvbl9pZCI6IjAyNWMzMWI3LThlMGUtNDkxMS05YTc1LTg0MDE3NTIzYWIwMyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInRfZXBvY2giOjE2ODQxMzIyNzIsImRhdGEiOlt7Im5hbWUiOiJ2aWRlb19zdGFydCIsInZhbCI6IjIwMjMtMDUtMTUgMDY6MzE6MTMifV19LHsidHlwZSI6InZpZGVvIiwidmlkZW9faW1wcmVzc2lvbl9pZCI6IjAyNWMzMWI3LThlMGUtNDkxMS05YTc1LTg0MDE3NTIzYWIwMyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInRfZXBvY2giOjE2ODQxMzIyNzIsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWRfc3RhcnQiLCJ2YWwiOiIxIn1dfSx7InR5cGUiOiJ2aWRlbyIsInZpZGVvX2ltcHJlc3Npb25faWQiOiIwMjVjMzFiNy04ZTBlLTQ5MTEtOWE3NS04NDAxNzUyM2FiMDMiLCJkb21haW5faWQiOiIyODQ4MzciLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJkYXRhIjpbeyJuYW1lIjoiaGVhcmRfc3RhcnQiLCJ2YWwiOiIwIn1dfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:14 GMT

GET
H2 200 avjp Show response
outbrain-d.openx.net/v/1.0/ Frame 79BB 106 B
414 B 40ms
31ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://outbrain-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fswiftmoves.blog%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=c86ad2f0-18c1-4d83-a1da-84c5ce681a82&nocache=1684132275691&sua=%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D&us_privacy=1---&lotameid=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&pubcid=efc6dd67-eb86-4443-a034-9da4b203b609&ttduuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&schain=1.0%2C1!outbrain.com%2C006ca10119b62fceba0024c827780cdc78%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A734%2C%22h%22%3A412%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22maxduration%22%3A60%2C%22minduration%22%3A0%2C%22linearity%22%3A1%2C%22api%22%3A%5B2%5D%2C%22placement%22%3A3%7D%7D%5D%7D&auid=540492000&vwd=734&vht=412&vos=101&aumfs=4680
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 550D 281 B
554 B 32ms
29ms Document
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:15 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H3 200 audio_007.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 33ms
32ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_007.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d3bd642125a2c5fb5306c4d5d604c32e0654096854750ac2962481491170fa1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15Qd8t%2FACc4KoTU1dIzt3ZxTVlHk2gOBAWGJS3u3HvSo%2FPvLgCv41vLCw5Cdjb%2FWgGWspFi734TM%2FhB5wrK7nlOosoPIS57XXfg9lO3vu%2B4ouXb3MQHNT2v3btCYOf7CW4l8m9YPTKCipnWQv94Mti4Y"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956432ac45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40383

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_007.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 161 KB
162 KB 46ms
45ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_007.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d2fc09431b78a9111e1e025b07ebc090704c826420522e7374a8a4c7d2454e7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rGQEDYGAnsdf%2BSQxvbX6Ad4Zs%2FHN30vCNAQr7oAiYqZaoOiTq3Tiv7Y9qZU3YaxD%2FBw1qJepcqh3CBcS43esRAdlqdbEvcgUlVVvaQWKu%2FzQfucGvHlP2Yq7gV1Oahe0GeZEW3vjTeKAkSaXT62EcuO0"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956433acb5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 165286

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 4746 0
861 B 19ms
18ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:15 GMT
AN-X-Request-Uuid: 27c8f6df-0059-434c-9ee2-18a287c78157
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 80ms
23ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 15 May 2023 06:31:15 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 373829
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 550D 34 KB
10 KB 35ms
34ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:15 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66790
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H3 200 pd Show response
u.openx.net/w/1.0/ Frame 21AA 740 B
480 B 14ms
14ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?us_privacy=1---
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 87f348e13f6de46c342b6889f169238b67d5bbaccefd5387c626f57c726b05a3

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 461
content-type: text/html
date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 21AA 95 B
123 B 42ms
40ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=be0f2e3f-da9c-06ee-07a3-75119d3ad853

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?us_privacy=1---

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58294/ Frame 21AA 0
357 B 27ms
23ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=96b5de4a-59f1-0120-1e65-2ccd3915ed36

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?us_privacy=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.57 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 21AA
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
https://id.rlcdn.com/464246.gif?partner_uid=edb722a5-4cdc-0d09-123b-6d34972d7887
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJR07GMitSnQhquVxVXznxY&google_cver=1

42 B
60 B

42ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJR07GMitSnQhquVxVXznxY&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEJR07GMitSnQhquVxVXznxY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 21AA
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=2829111677345209672

43 B
61 B

12ms
12ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=2829111677345209672
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 65563d1e-11a5-47bd-862c-bb4c7afd7f6e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 21AA
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8575394200595948846&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

16ms
15ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8575394200595948846&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8575394200595948846&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 15 May 2023 06:31:14 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 21AA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZGHRsQAKKKWZKgAp

43 B
61 B

13ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZGHRsQAKKKWZKgAp
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by: cache-yul12825-YUL
pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1684132276.785071,VS0,VE0
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZGHRsQAKKKWZKgAp
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
573 B 202ms
201ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=1&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A1400%2C%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22id5%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Server /

Resource Hash

7912e3b49891ebcf84915ee178bd2fdf777853307af2ea61afe67a1b3455130f

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: XRMJY640WSWRF374XZN1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: nu_RRMcp_VE2tEzVNBR3pKVEx-R5jQWPgg6yes1hzDuFXtJ9uH9spw==

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 79BB 33 B
402 B 106ms
105ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4162499361c6839a9f1d0f72b00cf4e7e13636a0c39cfa1257807c4e7fc05127

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H3 200 audio_008.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 36ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_008.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9ea72539c1413893239bc7b5b0511eef474144be8c707f0732e4662e9230b74

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1gQ3dTqNVjGwyNeltWQKbAWvahP945O5ZPfi%2F%2BAEDIJo1EwM2wDPsy0K24pVt8yIp5baDHktVXrIHKJICnvTQ%2BIygiIpf%2B6ExVW%2FoGIOk1So2kPgquEWjGFEYSMjl5eCr4FoRJPGuQ%2FIiWULZSxZvKuU"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956445c265437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40784

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 79BB
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7233293034697980059&gdpr=0&gdpr_consent=

43 B
540 B

54ms
53ms

Image
image/gif

199.187.193.179
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7233293034697980059&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 199.187.193.179 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location: https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7233293034697980059&gdpr=0&gdpr_consent=
Date: Mon, 15 May 2023 06:31:15 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 79BB
Redirect Chain

https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent=
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33N...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC...
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7gquK14NHC7G2jeIjfln

43 B
602 B

55ms
55ms

Image
image/gif

199.187.193.179
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7gquK14NHC7G2jeIjfln
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 199.187.193.179 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:16 GMT
Content-Type: text/html; charset=utf-8
Location: https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7gquK14NHC7G2jeIjfln
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 140
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 79BB
Redirect Chain

https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partnerus...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=23e57560f10562aa025089edbcb723f1&gdpr=0&gdpr_consent=0

43 B
577 B

53ms
53ms

Image
image/gif

199.187.193.179
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=23e57560f10562aa025089edbcb723f1&gdpr=0&gdpr_consent=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 199.187.193.179 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=23e57560f10562aa025089edbcb723f1&gdpr=0&gdpr_consent=0
p3p: CP="CAO PSA OUR"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 8
content-length: 0
expires: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 79BB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=

43 B
517 B

57ms
57ms

Image
image/gif

199.187.193.179
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 199.187.193.179 , Canada, ASN47043 (SMARTADSERVER, CA),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:15 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=cb640652-5013-46a4-8cfe-1b84d3b7b490&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 299

GET
H/1.1

200

6.gif
id5-sync.com/c/102/10/4/ Frame 79BB
Redirect Chain

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-2ddbgOH5_qgLudh1216dDW7p2ar_L-IVa8MP9gD3jQ&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_...
https://id5-sync.com/c/102/102/8/2.gif?puid=4857008915831342889&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAC5aU7Iw6MAACKiklmZXA
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F6%2F4.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent=
https://id5-sync.com/c/102/104/6/4.gif?puid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=
https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=id517&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY
https://cookie-matching.mediarithmics.com/v1/get_or_create?gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&domid=1033
https://cm.g.doubleclick.net/pixel?google_nid=medr&google_cm&key=GOO&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_I...
https://cookie-matching.mediarithmics.com/input?key=GOO&key=GOO&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_ID&opi...
https://ib.adnxs.com/getuid?https://cookie-matching.mediarithmics.com/input?key=APX&apx_uid=$UID&opid=apx&ops=&utidl=tech:goo:CAESEF3SenaWhXQ7dOKubdRCoss&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0Rv...
https://cookie-matching.mediarithmics.com/input?key=APX&apx_uid=2829111677345209672&opid=apx&ops=&utidl=tech:goo:CAESEF3SenaWhXQ7dOKubdRCoss&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0a...
https://id5-sync.com/qp/18.gif?puid=vec%3A36588787889&gdpr=0&gdpr_consent=&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY
https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F10%2F4%2F6.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/102/10/4/6.gif?puid=7246762434369164995&gdpr=0&gdpr_consent=

43 B
2 KB

103ms
102ms

Image
image/gif

162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/c/102/10/4/6.gif?puid=7246762434369164995&gdpr=0&gdpr_consent=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Mon, 15 May 2023 06:31:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://id5-sync.com/c/102/10/4/6.gif?puid=7246762434369164995&gdpr=0&gdpr_consent=
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_008.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 37 KB
37 KB 53ms
53ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_008.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63660869d05a76db15d30218d6ba54e126cacec9f10aa2d42ff0a44df6a8e605

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3rOh6479uNbDv4e4fxFUgFMbZDCkh6AEQHrjIE1TTGGnEKKdAhziKwl9A0fAx5s1yxOTGQi81Yo58SxdbNZkjblA2cm2GySfSiiZwtETDw%2BA7ghWLehWgggSo315PBmNoBZ2omegYaeW05lKx9n1ZanP"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795644ac715437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37491

POST
H/1.1 200 401.json Show response
id5-sync.com/g/v2/ Frame 79BB 594 B
1 KB 99ms
98ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/401.json

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

59d4ba2b24111b71115a6bb8d5cd55849afb1cd17558aea52bd9702a89d29c80

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H3 200 audio_009.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 40ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_009.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed735ad96de0421c5ee61933872ea741216b42df25e543c13ac9470aaaf67c43

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rf8UGFr32SvMxLr6S6X83AFSTeM1HbV0%2BfafqwMSUuYAValATWS2wrQa1G8pUoCHnY6gdecKyhKYuRR4AySlfm7gHBQl9%2F3NNeeQS1uqgEBYWUy37%2BjxzWcW%2F3mUOI6p66bJoyov80hJTz8qRjX42%2FTW"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956459da65437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40603

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 40ms
40ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
683 B 497ms
497ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=4363508461036010&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=8&adks=2423740103&sfv=1-0-40&ists=1&fas=8&prev_scp=tap%3Dswiftmoves_blog-pixel1-1297728224135626%26ap%3D9999%26reft%3Dn%26avc%3D186%26ic%3D2%26d%3D284837%26br1%3D140%26br2%3D180%26iid1%3D1297728224135626%26bra%3Dmod178%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26ga%3D2497208%26bvr%3D8%26al%3D1006%26ezoic%3D1%26lb%3D280&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276120&lmt=1684132276&dlt=1684132272249&idt=516&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6f72881eda0b580b70fed9562073f0f6b93cda47e0c4eaf70ec3d9eab29a28a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 654
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
483 B 557ms
557ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1098905122118691&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C336x280%7C200x200%7C234x60%7C300x250%7C120x240%7C320x100%7C180x150%7C125x125%7C320x50%7C250x250&fluid=height&ifi=9&adks=1801785216&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D7268655742164335%26eid%3D7268655742164335%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1134%26sap%3D1134%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D2%26at%3Dmbf%26adr%3D398%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D34%26al%3D1034%26compid%3D0%26tap%3Dswiftmoves_blog-large-billboard-2-7268655742164335%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D160%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%26amznbid%3Dm90cg%26amzniid%3DJI6RXb6JJCXDGvZ5XFg3AzsAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCfv8gz%26amznsz%3D336x280%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-large-billboard-2-0%26hb_opt%3D0.01%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D374416fc9f12789%26lb%3D300%26reqt%3D1684132276099&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276137&lmt=1684132276&dlt=1684132272249&idt=516&adxs=1040&adys=1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=360x264&msz=360x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09de6c255d22b40e23740f951805c1960b879b18426127fa47c376dd52a4e1ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 454
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
475 B 466ms
465ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1134501020580621&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=10&adks=2650088509&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D2%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D140%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2761%2C2763%2C3044%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJCehygsYoEzMwpI8sbWhhxwAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBri1Pp%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D260%26reqt%3D1684132276131&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276144&lmt=1684132276&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf6e3e889f732f25ad19036d5aa31771cccade67da9741b1c2d6c50dec214e19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 446
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
471 B 465ms
464ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3239562821878770&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=11&adks=1937768148&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D9208762842146216%26eid%3D9208762842146216%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1127%26sap%3D1127%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D2%26at%3Dmbf%26adr%3D398%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dswiftmoves_blog-box-1-9208762842146216%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D160%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJHrZWHjL83chvnl7_FvuGisAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICALX6OG%26amznsz%3D250x250%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%26hb_opt%3D0.14%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D3644e0050a428d%26lb%3D300%26reqt%3D1684132276109&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276149&lmt=1684132276&dlt=1684132272249&idt=516&adxs=1095&adys=275&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=280x264&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97299d7996d51aff622180cf31534e71a5a9aced6be9438c3a0e806e6bd54bac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 442
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
479 B 479ms
479ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=2920164132596694&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=12&adks=798944132&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D2%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJK4zlLT5pSJZwr0ZflCbYmQAAAGIHhsbAgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDjdWM0%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D240%26reqt%3D1684132276125&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276154&lmt=1684132276&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39308d3a47e878540c3e94bb22b7b4f2ec045e45aaf94a7b89137bb98e97d981

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 450
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
481 B 421ms
421ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1507469005718651&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=13&adks=180521375&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D5923801764085628%26eid%3D5923801764085628%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D2%26at%3Dmbf%26adr%3D398%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dswiftmoves_blog-medrectangle-2-5923801764085628%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D160%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C14%2C0%2C67%2C0%2C131%2C153%2C0%2C192%2C209%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJOomfROQ1JNBqeVmTIEqlO8AAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAAzIFR%26amznsz%3D728x90%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-medrectangle-2-0%26hb_opt%3D0.03%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D38b530636b8d352%26lb%3D300%26reqt%3D1684132276129&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276158&lmt=1684132276&dlt=1684132272249&idt=516&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f060c466216f455494322b7d7c305b909bbc137f563da6ac9885ba5c8344e17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 452
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
471 B 391ms
391ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3649017530819563&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=14&adks=2128035842&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D2%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D120%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-2-0%26hb_opt%3D0.02%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D348ebee37f9fa5e%26lb%3D240%26reqt%3D1684132276111&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276163&lmt=1684132276&dlt=1684132272249&idt=516&adxs=495&adys=215&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23233efbf283181e0d52affca81a96d1bcf2c5d7dfcd007c6c49b1e91186faf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 442
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_009.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 73 KB
73 KB 40ms
40ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_009.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f46bc2e6400bfa51fe25ad789ca0216b4402578998ddc0e727b2d70a76e0d35

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5lFrCwzZQHm%2B2V4tM5JzNfYLbd0pzeEnhGvEE1E3wVV4tTvwklzi6T5BMHp1O630vfNFPwgS6OPZmUcc0RrOK%2Bigek%2FcGZKTqX31M0%2BK40qH9owobdR1Pd0MH3KS1TNVJYWrTXhcoxUxhwXplBp9bZhr"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956461e335437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 74746

GET
H3 200 audio_010.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 35ms
35ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_010.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f79515d5d16cf253331fee7ace5c566fcc6a1bd414d0749c805dd708a63c99e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1122
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Zuj01lG2HkEI6%2BsJjJXRLD8GZ8V6HDH%2Fh04fXbshPOglygFn1ODzh%2FoMhYU6XZvMkJfqmpqvQx5Ucp%2FxjEQ9LgjApGL6UavjFXVsvszFTQu07ThesegQBBvn7by2Un4iZZUwWsJnVTZO%2FaH3nCR8mDr"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795646bef45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40877

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_010.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 90 KB
90 KB 37ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_010.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7b4e90e793ae0cbce9887c49e2bfb08ecc766919aee434a714fb18ffaa39513

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qoWJslDR5FLS6HbKADtX6MhRsfa1wZq0QrZB9XEtivTlOFh4umU76%2BDL9TUW8L%2FukMfb52Yjehto%2FeKD52Az3QKtLWVzkg3cpmlsseWQ4ariSi92qwycEVwG4C30Uu7NivTNNW7RS1OiYCLXcbzOerkE"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956470f535437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 91668

GET
H3 200 audio_011.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 36ms
35ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_011.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74d0a9a9e0d145656c7069a712c50134b5a286b96e62be77a06a5b003e37e39e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ka3EjGUJVP7mGLHMqWuyNQbPYMmjThCWjP%2Bd%2FwBDXe6KeiD9N7IkOzHrsf4zj0bQfJ%2BGagR63oVLTxoHhsy2iSBHr%2FZxWjSCkwEANSTFM8sgomGv20UhDQsndOFpch7RHhBrlqYQGcXRxOwUE7cDQfB5"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795647a8455437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40116

POST
H/1.1 200
OK log-viewability
log.outbrainimg.com/api/loggerBatch/ 4 B
371 B 75ms
20ms Ping
application/json 64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/api/loggerBatch/log-viewability
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:16 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 8b1691303c79230c6118128f25f8d15e
Content-Length: 4
Expires: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_011.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 76 KB
76 KB 44ms
44ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_011.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db425481211fb9006edbcab3970564bc370a0d60b22515fba61060b62847c956

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZDFCX95SdWmhrSRwK4jq4ATWzv1GU%2F8pYEPOEkaR7cwcKfmP25twqW8d2yxP6OUA1NHC0ohDO8Fghmv2fOgtZ%2BF8NJygNcHV1QCOzKM5ZJp64%2BLFUNEenrgyjh0MyJBrg8Fo51Cp2o3Aj8VGuE5SK%2Bc"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564818bf5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77616

GET
H3 200 audio_012.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 39ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_012.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2834d27a295ae1d61767976cc9c23ee5c43ea160c8adcb48bdffc3972b2d3298

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xR3Ue456thUPHCYW4h9F%2BE8VDYxdQb2k314Srkqz6sRo8aCIbfNj87OcPlqe9RhANU3W6CvMW5RbQAebMkQS3%2FTcZPiEpjICpjvO1P2LdtW37s%2FPc%2BN6922CGTCdDIjVBl2EERTVPG6nJG7H1DkMn71e"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564879325437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40851

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B9C6 2 KB
3 KB 23ms
22ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=70220724&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 290dcf587dd7b138943be8229a5131b6696a3449e9185292d53b488c417c9b06

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame D8C2
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDNWFVN0l3Nk1BQUNLaWtsbVpYQQ&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAC5aU7Iw6MAACKiklmZXA&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Csyn%252C...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Csyn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4857008915831342889&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAC5aU7Iw6MAACKiklmZXA&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D4857008915831342889%26gdpr%3D0%26gdpr_consen...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=4857008915831342889&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=A...
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAC5aU7Iw6MAACKiklmZXA&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D4857008915831342889%26gdpr%3D0%26gdpr%3D0%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=4857008915831342889&gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAC5aU7Iw6MAACKiklmZXA&gdpr=0

42 B
200 B

20ms
19ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAC5aU7Iw6MAACKiklmZXA&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:16 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAC5aU7Iw6MAACKiklmZXA&gdpr=0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 74C6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:102b6461-d1b1-4f00-b06c-5186e28fb05c&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

19ms
19ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 15 May 2023 06:31:16 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A383
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=189a1818-f2ea-11ed-9e3b-e9c9016fe91b

42 B
243 B

24ms
23ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=189a1818-f2ea-11ed-9e3b-e9c9016fe91b
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
content-type: image/gif
date: Mon, 15 May 2023 06:31:16 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=189a1818-f2ea-11ed-9e3b-e9c9016fe91b
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: lga-delivery-8

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 7CCD
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2829111677345209672&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

19ms
18ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 15 May 2023 06:31:14 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 03BD
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=7Kf8a76iqGv3p_4-v_DnaOKmrjz3oPs_ufHaBySX
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

20ms
19ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 15 May 2023 06:31:15 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame E023
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_c03d2db792a3476da7342
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

19ms
18ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 15 May 2023 06:31:16 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 5D60 43 B
362 B 24ms
23ms Document
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:15 GMT
expires: Mon, 15 May 2023 00:00:00 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 455394
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B83D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:WDaPIhCo1PYrJO5&gdpr=0&gdpr_consent=

42 B
301 B

24ms
23ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:WDaPIhCo1PYrJO5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Mon, 15 May 2023 06:31:16 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:WDaPIhCo1PYrJO5&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-036ce2552879161b4@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame D621
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=fxwlYUubUiBvJ8uiP7oHl5U4mbc&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

19ms
18ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 15 May 2023 06:18:35 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9D92
Redirect Chain

https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=

42 B
308 B

24ms
23ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:18:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:15 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 sd
us-u.openx.net/w/1.0/ Frame B9C6 43 B
61 B 14ms
13ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK Martin
crb.kargo.com/api/v1/dsync/ Frame B9C6 43 B
504 B 106ms
24ms Image
image/gif 54.237.176.110
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Martin?exid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.237.176.110 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-237-176-110.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:16 GMT
X-Accel-Expires: 0
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204 sync
sync.bfmio.com/ Frame B9C6 0
425 B 108ms
23ms Image
text/plain 54.83.230.178
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=187&uid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.83.230.178 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-83-230-178.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Connection: keep-alive
Date: Mon, 15 May 2023 06:31:15 GMT

GET
H/1.1 200 syncMe
synchroscript.deliveryengine.adswizz.com/ Frame B9C6 0
397 B 409ms
101ms Image
text/plain 52.212.31.172
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.31.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-31-172.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:16 GMT
X-Clacks-Overhead: GNU Terry Pratchett
X-Adswizz-request-id: 18becd20-f2ea-11ed-ab85-0a7a22a214ab
Connection: keep-alive
Content-Length: 0
X-Application-Context: application:production
Instance-id: i-0e07c81295576f732

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
682 B 315ms
314ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1803705436291142&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=15&adks=2423740102&sfv=1-0-40&ists=1&fas=8&prev_scp=tap%3Dswiftmoves_blog-pixel1-1297728224135626%26ap%3D9999%26reft%3Dn%26avc%3D186%26ic%3D3%26d%3D284837%26br1%3D100%26br2%3D180%26iid1%3D1297728224135626%26bra%3Dmod178%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26ga%3D2497208%26bvr%3D8%26al%3D1006%26ezoic%3D1%26lb%3D140&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132276634&lmt=1684132276&dlt=1684132272249&idt=516&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfcf533f3345c47ce880c6478f97cb593321af109eb3ebdec1767570b8c01a48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 653
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_012.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 24 KB
25 KB 44ms
43ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_012.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4378fc555e9495724f7f60fb39d02bbe3d988cbd6048dc597e3f07a6a154a3b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=41mc2qlOH9ilkvX%2Bq8AQhG7SbIGEE4ztTh%2Fl7Oy87K6tn9WeElGpUVq6Jypvcy36MlSQzbsBiYumffsg8OsqWpF0R1dcJI%2B7IaW%2BurY8GLhrVx%2BATZjrQnvOZh7AWQBcuvVJnKFmiTakhENVTmz3QOSw"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956491a205437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 25009

GET
H3 200 audio_013.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 33ms
32ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_013.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14efbc5af7ce5c7eaacb0b8629889ad9a9fb90728b13069026c61e3732bcce71

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XuMxQEHR34rO5EQNjbTC%2BhBr%2Bw%2BEFQWVcpoAcmqw0UC9TXEeXVvUqBgoaArWS2PfvcBPIfOJlS8%2BN6465PsWmdbhANnEDYYNVmnJVDtcHOSp75txts0R3%2Bd14FPRI29ZyVlu%2BGeZrAfCco4dLoqq240w"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956496aa45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40429

GET
H/1.1 200
OK recordOBV Show response
videoevents.outbrain.com/events/ 41 B
380 B 75ms
20ms Fetch
application/json 64.202.112.159
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://videoevents.outbrain.com/events/recordOBV?eventType=VIDGET_PLAYER_VIEWABILITY&abTestList=11984-89554-83708&abTestVal=11984-89554-83708&adBlocker=false&cardIdx=1&ccpaPrivacy=1---&configuredNative=never&configuredProvidersCount=2&configuredReloadCount=1&docId=4543702453&featureFlag=GA&feedVersion=2&gdpr=0&iframe=false&obRecsAbtestAndVars=1024-3192%2C833-3369%2C386-1123%2C1090-3454%2C1154-3763%2C1155-3748%2C1094-3468%2C1159-3755%2C1223-4077%2C1161-3766%2C1164-3777%2C1165-3783%2C1231-4109%2C1103-3714%2C1168-4046%2C784-2396%2C1105-3514%2C1169-3790%2C1172-3813%2C1045-3874%2C792-2427%2C927-3026%2C998-3234%2C1069-3352%2C1008-3129%2C1137-3751%2C1203-4057%2C822-2522%2C951-2935%2C888-3161%2C1146-3694%2C1082-3419%2C699-2183%2C1086-3443&placementType=footer&playerLocation=aboveWidget&publisherId=6420&screenResolution=1200x1600&sessionId=ebd5844e-a1b9-b825-4615-58574d98b22f&sourceDocUrl=https%3A%2F%2Fswiftmoves.blog%2F&sourceId=7473619&sourcePvId=c62632dad57dd6a33aa5cac54e8c6521&sourceRequestId=ed74607366c018e947d5d6270acd8282&sourceSubWidgetId=FMS_CP_1&sourceWidgetId=AR_2&version=v1.174.0&waterfall=Vidazoo%2COPA&widgetIdx=1001&externalId=284837_1_191_100x240&isAdnginControl=false&isOnyxFeed=false&currentReload=0&description=viewability+percentage+threshold%3A+50&playingType=OUTSTREAM&viewability=75&orientation=LANDSCAPE&providersStatus=%7B%22Vidazoo%22%3A%7B%22playedAds%22%3A0%2C%22loadedAds%22%3A0%7D%2C%22OPA%22%3A%7B%22playedAds%22%3A0%2C%22loadedAds%22%3A0%7D%7D&videoClickUrl=3c2e4127-3725-688f-82d9-912baa789586&localTime=Mon+May+15+2023+06%3A31%3A16+GMT%2B0000+%28GMT%29&playMode=UNKNOWN
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.159 Chicago, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 3649cae0069d73cdaa9422b1e69672afd111cd7c4cc3fa8d9a91c4033d5cf8c8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:16 GMT
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
Connection: close
X-TraceId: eec677311ae6cf81654690c8bf89c25a
Content-Length: 41

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 4746 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:16 GMT
AN-X-Request-Uuid: d8378783-dd5f-4f0f-b53e-32e4cd391072
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_013.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 107 KB
107 KB 39ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_013.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 411446cdc3f37ebd5274441c6e00c10942968ec945b3b37e880a9c0ed7ce6f44

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u2Lq6WzYIz5oOFFOKPlSqawHXWPcjrW0NYQY65jvsvizPGLsajsVNiIsQDL5moIoGiZS0znbR3rAzDWGVw3HUSrEGeX%2B%2BJokA5w1nlPfyf%2F9dXSENwSKBdO78KYFmh2zKJ%2F4AALaoaOiEMGFsEc2SETW"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795649fb4d5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 109237

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 2F0A 2 KB
3 KB 23ms
23ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=58468110&p=162412&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 26fe4a72c404b40c4510d83711dffa7db5d099f65f38b23a0823dd817a61c16d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 audio_014.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 37ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_014.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4deec72a7fa115c619aa7cddf76c15eadce3fa3b26ede664e9751ff9b089a75

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CFLqDG4Zcs9nDKatYrrFcNe3S53Zs%2B3dH%2BSPxAGkPCwEN9ilEbOeZrxjtGy5NZ45an8GXuPzUkj4TSqR2kvZwnEBhczU6z66khK%2FqIfDbETlFs59zBuKgnj9Wd3MTmKm4aA%2B9A8E7883P%2FkLuH9USBsZ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564a3bac5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40737

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 8DBA
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=8e9dc087-2158-4fcf-8240-7929be66ece2&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=41DA1833-16BC-41FB-8168-95B4325D28EC

42 B
491 B

24ms
23ms

Document
image/gif

18.233.122.89
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.233.122.89 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-122-89.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:16 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 15 May 2023 06:31:16 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=41DA1833-16BC-41FB-8168-95B4325D28EC
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 46AC
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=779825805037

42 B
290 B

24ms
23ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=779825805037
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:18:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=779825805037

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 40BB
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

24ms
23ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Mon, 15 May 2023 06:31:17 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame C423
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
447 B

103ms
101ms

Document
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7c79564b1d7c33ff-YUL
content-length: 43
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:17 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7c79564a7cf833ff-YUL
content-type: text/html
date: Mon, 15 May 2023 06:31:16 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 4857

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame ABE4
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F1508%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=2971377223
https://sync.1rx.io/usersync3/mediamathtest/1508/102b6461-d1b1-4f00-b06c-5186e28fb05c?zcc=0&sspret=1
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

42 B
255 B

24ms
23ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:18:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:16 GMT
ETag: RX48fe24f188bf46cd87343bca0e84d201005
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server: Tengine
Transfer-Encoding: chunked

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame BE95
Redirect Chain

https://gocm.c.appier.net/pubmatic
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EFf5fRMmDWmRDBPotdFhZA

42 B
279 B

22ms
21ms

Document
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EFf5fRMmDWmRDBPotdFhZA
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-store
content-length: 153
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:17 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EFf5fRMmDWmRDBPotdFhZA
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 9BD5 43 B
369 B 76ms
41ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Mon, 15 May 2023 06:31:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 2D27
Redirect Chain

https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=1b0ca87f-9866-4c61-a73f-819f908aaca0

1 B
72 B

20ms
19ms

Document
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=1b0ca87f-9866-4c61-a73f-819f908aaca0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Mon, 15 May 2023 06:31:16 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=1b0ca87f-9866-4c61-a73f-819f908aaca0
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 sync Show response
ads.servenobid.com/ Frame 3FF1 0
357 B 27ms
24ms Document
text/html 3.224.156.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/sync?pid=316&uid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.156.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-156-32.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
amp-access-control-allow-source-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length: 0
content-type: text/html;charset=ISO-8859-1
date: Mon, 15 May 2023 06:31:16 GMT

GET
H3

200

362588.gif
idsync.rlcdn.com/ Frame 2F0A
Redirect Chain

https://idsync.rlcdn.com/712188.gif?partner_uid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveramp&ttd_tpi=1
https://idsync.rlcdn.com/362588.gif?partner_uid=cb640652-5013-46a4-8cfe-1b84d3b7b490

42 B
60 B

41ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362588.gif?partner_uid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:16 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://idsync.rlcdn.com/362588.gif?partner_uid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2 200 gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=41DA1833-16BC-41FB-8168-95B4325D28EC/gdpr=0/ Frame 2F0A 49 B
265 B 84ms
29ms Image
image/gif 52.54.128.17
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=41DA1833-16BC-41FB-8168-95B4325D28EC/gdpr=0/gdpr_consent=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.128.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-128-17.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:16 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.4.133
content-length: 49
expires: 0

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame 2F0A 95 B
123 B 48ms
43ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

static.2.86.88.23.clients.your-server.de

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame 2F0A 43 B
109 B 130ms
72ms Image
image/gif 52.72.142.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=20909&user_id=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.142.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-142-149.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2F0A
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7246762434369164995

42 B
324 B

24ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7246762434369164995
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:17:59 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=7246762434369164995
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 2F0A
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=2829111677345209672

42 B
95 B

23ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=2829111677345209672
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:15 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 15 May 2023 06:31:16 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f9b40ec5-2849-4657-b0e9-50863bcf14b2
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_014.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 86 KB
86 KB 35ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_014.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a280a6e7290971b8eca52e628a68ae2b8cb6352bf4edcce3b416cc2d965e3250

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pMR%2F%2FdD6F4gBDufmaYIeuPJm5RDRpwLeSt5TIgGyfz7N9qg5CviyiaZT2u97kepDcPh0gU0Hc0DP6XWEsAtQJE3dOdK9pAVIFRXgaySKzReVdtUS4HngSU8NKCTLNlRtjrKTZyycnoWkT8mGFUAE%2Fkh%2F"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564b0cad5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 87633

GET
H3 200 audio_015.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 42ms
41ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_015.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12151f84a88df38389d22884859f4ed12a00d504782717f53197df4eeb18ba7f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:16 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxHhORnzDMDErpFjuTC2BvMZR11DqVVZu740MkG22Usnk16bIcGyjwFky%2B%2FsPMHOYG%2BSb89IZHKqxOL9DT6ITt2mPrxl1y5tDu%2FpyUUkqhMSaJM3WNedMf3QU4nNTUqTwsC15FmX5DDPGN0ZVX4rQA%2B7"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564b1cd45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40178

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C66C 1 KB
2 KB 23ms
23ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=2970444&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 36beea14588edfc2b4e4ab5d31af07c378f860daa5068fcf01ec7e2eb7c0ee47

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 15 May 2023 06:31:16 GMT
content-length: 1452
content-type: text/html; charset=UTF-8

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame 115A 0
0 313ms
99ms Document
text/plain 23.88.86.2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.88.86.2 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

nginx/1.23.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: keep-alive
Date: Mon, 15 May 2023 06:31:17 GMT
Server: nginx/1.23.1
Strict-Transport-Security: max-age=15768000

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 4870 43 B
277 B 491ms
136ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:17 GMT
Vary: Accept-Encoding
X-adserver-worker: avatar-cb404a175476@version_1.551
X-core-time: 0ms
X-server-arch: v2

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 4725
Redirect Chain

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7374186771452294615&uid=Q737418677145229...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7374186771452294615

42 B
95 B

26ms
26ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7374186771452294615
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:18:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: max-age=40250
Connection: keep-alive
Content-Length: 154
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:17 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7374186771452294615
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: Apache/2.4.6 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E17C
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:36881F8882764BFBBAB2F6595BB0DFFB&gdpr=0&gdpr_consent=

1 B
72 B

26ms
26ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:36881F8882764BFBBAB2F6595BB0DFFB&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:17:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Mon, 15 May 2023 06:31:17 GMT
expires: Sun, 14 May 2023 06:31:17 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:36881F8882764BFBBAB2F6595BB0DFFB&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame 2764 35 B
250 B 26ms
25ms Document
image/gif 54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:17 GMT
Expires: 0
Pragma: no-cache

GET
H/1.1

200
OK

sync
x.bidswitch.net/ Frame C66C
Redirect Chain

https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=41DA1833-16BC-41FB-8168-95B4325D28EC
https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=41DA1833-16BC-41FB-8168-95B4325D28EC&_li_chk=true&previous_uuid=38eeffddb2ae437f901ec5ea7813fc0d
https://mid.rkdms.com/bct?pid=bcccb40a-06d2-44fe-bdd2-a91ef4a5bfd0&&puid=38eeffdd-b2ae-437f-901e-c5ea7813fc0d&liid=&_ct=im
https://i.liadm.com/s/19948?bidder_id=178256&bidder_uuid=2f3f2ae2c52446bd67c35a16bffcc82b
https://x.bidswitch.net/sync?dsp_id=42&user_id=

43 B
235 B

36ms
35ms

Image
image/gif

35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=42&user_id=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=42&user_id=
Date: Mon, 15 May 2023 06:31:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 3

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame C66C 49 B
264 B 34ms
31ms Image
image/gif 54.235.118.90
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.118.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-118-90.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.5.120
content-length: 49
expires: 0

GET
H/1.1

204
No Content

/
io.narrative.io/ Frame C66C
Redirect Chain

https://io.narrative.io/?companyId=673&id=pubmatic_id:41DA1833-16BC-41FB-8168-95B4325D28EC
https://io.narrative.io/?io.narrative.guid.v2=18dfe9b0-f2ea-11ed-b479-0e71178f036d&companyId=673&id=pubmatic_id:41DA1833-16BC-41FB-8168-95B4325D28EC

0
247 B

24ms
24ms

Image
text/plain

34.233.181.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?io.narrative.guid.v2=18dfe9b0-f2ea-11ed-b479-0e71178f036d&companyId=673&id=pubmatic_id:41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 34.233.181.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-181-147.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:17 GMT
Cache-Control: no-cache
Server: nginx/1.22.1
Connection: keep-alive

Redirect headers

Location: https://io.narrative.io/?io.narrative.guid.v2=18dfe9b0-f2ea-11ed-b479-0e71178f036d&companyId=673&id=pubmatic_id:41DA1833-16BC-41FB-8168-95B4325D28EC
Date: Mon, 15 May 2023 06:31:17 GMT
Server: nginx/1.22.1
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame C66C
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=41DA1833-16BC-41FB-8168-95B4325D28EC
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=NTZnSk1EbUUzd3dTZC1VSXZGR3laTURsQQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=7246762434369164995&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

25ms
24ms

Image
image/png

52.5.106.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 52.5.106.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-106-217.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:18 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Mon, 15 May 2023 06:31:18 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame C66C
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:5f15d795-dbb4-4e95-b705-55f65133132e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

24ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:5f15d795-dbb4-4e95-b705-55f65133132e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:18:20 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:5f15d795-dbb4-4e95-b705-55f65133132e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Mon, 15 May 2023 06:31:17 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_015.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 16 KB
17 KB 32ms
32ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_015.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d66d34b7d4f8f0c712133fafacb231100e69516615a603507fc9c690c94b6ec

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FTZtpUsXORCnuZICMuV8zViXIbwGUL7HGcEkj2p%2F02HeqqYbz3vuukrZYRmFw701F%2FzaGep3yDAt%2BbmNKd%2BEY7iOjqgqxubkq2iSXSGIChEOHEWYsamST2P2lDAig11OFRpkD3mmdmCSGzIDzSdVIDUf"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564bfdbc5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16684

GET
H3 200 audio_016.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 34ms
32ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_016.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a13d1b0ca7ad2907b39779f93812ca7c66a1b04e7fd9f6b687f1453b8f74d2e5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pZznus2aK4V%2B27m%2FFsqbvSUs8m4strthnYbgrJrC4jxyVGuzde3Vq1p8c4FyoPgYfnVYXfsGhgwcmvOnVzrqHv%2Bczc3h7EbUguA5LyOEslQFufXpor7%2BHBNaRl9AGN%2Bdp39Z4MqwWPR3RBlHuIo6m1kY"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564c0dde5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40779

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 147 KB
45 KB 488ms
487ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3409728108225461&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=16&adks=2423740101&sfv=1-0-40&ists=1&fas=8&prev_scp=tap%3Dswiftmoves_blog-pixel1-1297728224135626%26ap%3D9999%26reft%3Dn%26avc%3D186%26ic%3D4%26d%3D284837%26br1%3D60%26br2%3D180%26iid1%3D1297728224135626%26bra%3Dmod178%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26ga%3D2497208%26bvr%3D8%26al%3D1006%26ezoic%3D1%26lb%3D100&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277150&lmt=1684132277&dlt=1684132272249&idt=516&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fcb2cafd38b3fc46d661346a7de2a164e98db8907f6b3dbceccd9273e3500c7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45831
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame F121 637 B
905 B 23ms
23ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=33621621&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 98906cfbf25852fc153a4e772b249662f6065ce971c22a746828078d3f38c9e8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 15 May 2023 06:31:16 GMT
content-length: 637
content-type: text/html; charset=UTF-8

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame 419A 35 B
591 B 18ms
18ms Document
image/gif 185.167.164.43
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.43 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Mon, 15 May 2023 06:31:17 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame F5EE 35 B
250 B 28ms
27ms Document
image/gif 54.87.127.173
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.87.127.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-87-127-173.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:17 GMT
Expires: 0
Pragma: no-cache

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame F121 43 B
657 B 59ms
57ms Image
image/gif 13.249.85.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-112.ord52.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
via: 1.1 3b3cb210495e4d1678591271d0921206.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: ORD52-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: 3gSZs9ZTFW7hp0I9sT2H-s843SYjb6VS3K63IZXMUzt0hWqLtvLolA==
expires: 0

GET
H/1.1 200
OK info
uipglob.semasio.net/pubmatic/1/ Frame F121 42 B
603 B 33ms
32ms Image
image/gif 50.57.31.206
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=41DA1833-16BC-41FB-8168-95B4325D28EC&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:17 GMT
Frontend-ID: 8
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Content-Type: image/gif
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin: *
Content-Length: 42
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame F121
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=0&gdpr_consent=
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=9aa0a57594b1aa858e0bef445a978940&gdpr=0
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-HE76Vx1E2pSYMDpFKxEwpIby9xrdb8C5cw--~A&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=0a50e155402c3334
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=fd8f7c5f-f86e-4824-47ea-a39fc358eedd&zclui...
https://mwzeom.zeotap.com/mw?google_gid=CAESEPPh5NCchziF1voC2lax8O4&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=fd8f7c5f-f86e-4824-47ea-a39...

95 B
163 B

132ms
119ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?google_gid=CAESEPPh5NCchziF1voC2lax8O4&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=fd8f7c5f-f86e-4824-47ea-a39fc358eedd&zcluid=0a50e155402c3334&zdid=1332
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://ads.pubmatic.com
access-control-allow-credentials: true
cf-ray: 7c795652fb05a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://mwzeom.zeotap.com/mw?google_gid=CAESEPPh5NCchziF1voC2lax8O4&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=fd8f7c5f-f86e-4824-47ea-a39fc358eedd&zcluid=0a50e155402c3334&zdid=1332
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 469
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_016.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 15 KB
16 KB 58ms
57ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_016.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0924ac3431ad4238878a53b7ad5d8604de2f51bbff27d9509300ace451c9c01

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2BL1rqEhtNfuTZKR60Wm%2BP50T2oxg5s6l%2BaDQM2K4NdTutaVt6xUcosyWAEChskVrDvC%2B9eXEDhT0xaS5gLWsD5B07iaKHgJv9TjQp7aiF1ranfcY38VPcrhIxk9YRYq3t0aft51AZrRVI8T42BI4MCJ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564ccebd5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15557

GET
H3 200 audio_017.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 48ms
48ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_017.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a7affe9654ab172abff60c5d5595a4a9d0bd45ee1e48061fa8adb52404e7db3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z2wtOBOiTz9XfwB0soZCLPmbBM8c6lGdpvHShu5%2FoqhsWpIRmhHFwRP0q7p9yVQREecE5YKrvgF6RoyRLliSd16TgTKCfEHKGZsvCmlCRMaPNa%2FNaCLQYgp6QFaE2RkdmLOWHptn2QD7UGRRixkkoGrV"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564ceeea5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40851

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ 483 B
1015 B 24ms
23ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:17 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Wed, 23 Nov 2022 15:43:18 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 2429014
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T99LQgrgjNWjBJGrPUwqtpg0U33OnMmV7IJNpg4fXx9ymtG67kjm1tCwoWC0%2B2Xh9Tk6aXbHoFR4ERkIWwupByN07mP1OQAmu4GuOPopQ5RLEhQva0Fu2NbHtJgg8ZSKwjZ9LwTmiKTVSP0u"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 7c79564d6a97a1db-YYZ

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
258 B 182ms
153ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: a18e6f5467d7f69e316bc697d132885b869b0c9f7c3cad92d582249e1f77949b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 408ms
196ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-edge-2-0&w=160&h=600&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=742eaa55d60b96&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 412ms
201ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-edge-1-0&w=160&h=600&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=8562b40b772b98&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 410ms
198ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-box-2-0&w=250&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=9043de021f81f7&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 438ms
227ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-large-leaderboard-1-0&w=250&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=10bbc081d3ac109&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 406ms
195ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-box-1-0&w=250&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=110c40a1677b3e8&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 408ms
198ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-large-billboard-2-0&w=336&h=280&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=12604ba5af97bdb&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
212 B 403ms
193ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29829&adtype=banner&auc=div-gpt-ad-swiftmoves_blog-medrectangle-2-0&w=970&h=90&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=133e3772a47880e&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 114 KB
27 KB 311ms
311ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5ccdab71d3736956fd03e9b6a9c23ef7a52f3853ce98ec87d22213d9f76f999c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:17 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fbc75a28-19e2-47a5-94af-548441635417
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
508 B 238ms
152ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691b20174742046e2210bface012a&pos=8a9691b20174742046e221125d9d01b3&cmd=bid&eidcriteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&eidaudigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui&eidid5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&eidcrwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&eidquantcast.com=P0-637578525-1684132272823&eidpubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b&secure=1&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: 6eb16e55fb727deac77335ea6effa2912391fda3ce3503f6ab911ab3407dc153

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 80

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
113 B 260ms
174ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691b20174742046e2210bface012a&pos=8a9691b20174742046e221125d9d01b3&cmd=bid&eidcriteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&eidaudigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui&eidid5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&eidcrwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&eidquantcast.com=P0-637578525-1684132272823&eidpubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b&secure=1&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: ec5134678e4685222b161b25523a4f0a6844e59ca11f8e6d442cefdc45f8bc2c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 80

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
113 B 290ms
205ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691b20174742046e2210bface012a&pos=8a9691b20174742046e2211204b0018f&cmd=bid&eidcriteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&eidaudigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui&eidid5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&eidcrwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&eidquantcast.com=P0-637578525-1684132272823&eidpubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b&secure=1&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: 25fdc13083dda3b676988437cdd1978b43d801e328b44f3947b2ac967cf10c61

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 80

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
113 B 247ms
162ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691b20174742046e2210bface012a&pos=8a9691b20174742046e22111a8500160&cmd=bid&eidcriteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&eidaudigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui&eidid5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&eidcrwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&eidquantcast.com=P0-637578525-1684132272823&eidpubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b&secure=1&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: d0a69afd125389ba621c62822aaa630fdeabe44d637729c7c66938250259f3ac

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 80

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
115 B 253ms
168ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691b20174742046e2210bface012a&pos=8a9691b20174742046e2211258fd01b2&cmd=bid&eidcriteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&eidaudigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui&eidid5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&eidcrwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&eidquantcast.com=P0-637578525-1684132272823&eidpubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b&secure=1&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: 8d82ccb571386a9d1050e4bf61ce52c6903a583f1074c8db8290169d2108c19b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 79

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
113 B 299ms
215ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691b20174742046e2210bface012a&pos=8a969573017474204a2a2112183c0007&cmd=bid&eidcriteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&eidaudigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui&eidid5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA&eidcrwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&eidquantcast.com=P0-637578525-1684132272823&eidpubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b&secure=1&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: e2f48ba2e1afe6226b81cea39283b3d0e9610b93e8d9a1f41bd760f6d717d24d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 80

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 11 KB
1 KB 268ms
156ms XHR
application/json 2a06:8640:454::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:8640:454::2 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: dfcc353353810b7fac20beae6e28dc13ff6ed8af34ed4ec79cc03a5932b694b9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:17 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1158

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 303 B
338 B 319ms
139ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=9&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=ebecdaa5-d4a2-4df8-9aec-6d5804857d98&l_pb_bid_id=38e0d4b2798e227&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ebecdaa5-d4a2-4df8-9aec-6d5804857d98&rp_maxbids=1&slots=1&rand=0.05606210686181745
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 28720776416cb4c90fd73791105e49c207c6c75deceaaf9ab146a1603f5d516c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 303
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 303 B
338 B 333ms
154ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=9&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=a6bbcf08-6dae-40ea-a3cc-01f78feef9b5&l_pb_bid_id=39750a3b159133d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=a6bbcf08-6dae-40ea-a3cc-01f78feef9b5&rp_maxbids=1&slots=1&rand=0.7979133000328538
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: e278367484622d207d51e6bf066907318902d319e836b29c9d683d1cdb493262

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 303
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 304 B
339 B 286ms
107ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=14&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=f4e48235-4352-46ec-8c6e-be9921dde244&l_pb_bid_id=4046f46ba655507&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=f4e48235-4352-46ec-8c6e-be9921dde244&rp_maxbids=1&slots=1&rand=0.48356267522603646
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 86d36a04c62580e4bf701bdb7b6e44f5b32dd8b13d53aa1732250a2ea1780376

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 304
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 304 B
566 B 279ms
100ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=14&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=176c1647-89a6-4692-b768-948ba8fceb45&l_pb_bid_id=4166e9e2aa2f57e&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=176c1647-89a6-4692-b768-948ba8fceb45&rp_maxbids=1&slots=1&rand=0.13154907065404786
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d8e3083da759607cad9e7967b749319921a7137c2f0b68115ed7cd93bc5ecdd6

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 304
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 304 B
339 B 286ms
108ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=14&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=0f80009a-d802-4aca-88b2-688cdbbd5a6b&l_pb_bid_id=42012aa0426e72b&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=0f80009a-d802-4aca-88b2-688cdbbd5a6b&rp_maxbids=1&slots=1&rand=0.9139993181097701
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 8cb7866c6ad73d27ddf64b1d527e84fe8afdef4ef4c0345dbe1d2d4f3bc35a20

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 304
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 324 B
359 B 353ms
175ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=15&alt_size_ids=16&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=ef2709a0-d08c-459e-8965-8e118c9f1d2c&l_pb_bid_id=43865535c32c899&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ef2709a0-d08c-459e-8965-8e118c9f1d2c&rp_maxbids=1&slots=1&rand=0.16020693746730008
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a62b01f6474a9f3fc429515bf77fe3f3a4cf7d2e742399032d1ad8ec0ae51366

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 324
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 323 B
358 B 347ms
169ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=2&alt_size_ids=55&us_privacy=1---&rp_schain=1.0,1!ezoic.ai,144fa446ff6593f92ede4c464f341dd2,1,,,swiftmoves.blog&eid_criteo.com=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%5E1&eid_audigent.com=060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%5E1&eid_id5-sync.com=ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%5E1%5E&eid_crwdcntrl.net=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%5E1&eid_quantcast.com=P0-637578525-1684132272823%5E1&eid_pubcid.org=c6513184-5dd8-4f62-9bd9-8388c6e67d8b%5E1&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=fc153f9a-01ee-425e-b678-625623bd740c&l_pb_bid_id=44fabacafb8a39c&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=fc153f9a-01ee-425e-b678-625623bd740c&rp_maxbids=1&slots=1&rand=0.7252300350524272
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 496dbea8e68b444ac755e92699fe5857e9a2bc645d95be254295f3cbc0970d33

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 323
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
362 B 10ms
9ms XHR
application/json 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 1 KB
2 KB 126ms
107ms XHR
application/json 195.244.31.10
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fswiftmoves.blog%2F&PageUrl=https%3A%2F%2Fswiftmoves.blog%2F&PageReferrer=https%3A%2F%2Fswiftmoves.blog%2F&CanonicalUrl=https%3A%2F%2Fswiftmoves.blog%2F

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.10 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

22e46848fadb25abd232f12a6ab1bb9585a709bf194df3d1e0b4d653fd700746

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
x-content-type-options: nosniff
p3p: CP="CAO PSA OUR"
x-envoy-upstream-service-time: 89
content-length: 1248
pragma: no-cache
server: ayl-lb-usa02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 5 KB
3 KB 201ms
130ms XHR
application/json 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: bb2fbe536ab646703949fc5ee9d8d3e95e42a0f6173b7f5963f4d293f037ab74

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-openrtb-version: 2.3
content-encoding: gzip
content-type: application/json

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ 74 KB
23 KB 26ms
26ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:17 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 552888
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 23 Nov 2022 15:43:17 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sqA2qOIzRRhm9gKsviUaLynfErlfakEUX507qpBt%2BBe477GcgG%2BVFUGmUbVL%2BE%2F7D%2FsbNsL%2Fm2BVU0OOJmGVLhYSFObuIvJeW3AGylMez7ARIJ253SLKz0PWeODwfEASVvVCLZ6z1awaqcj7"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 7c79564dc970547f-YYZ

GET
H3 200 audio_018.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 40ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_018.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f6b1b3f6aca471c91255a736695a4cfe89fa0af5c609bb22ccb8ae6895bfd27

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gYxinijHDjkb2Rj058k6bJohaW%2FVwqHWOcwEMOmQ7Y3UdLhUjVxdFCmM%2BJ79O3LfESCn4HXT%2BKTdC3w80bGQvifQCkSgvzQAoPFv%2FjGpE%2B8JlY9Bjxdhi%2B5CQTnQwhN4NFv0BJQeGnsSSxBfbF76S07D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564e694d5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40745

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_017.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 15 KB
16 KB 35ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_017.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90055d115f25120195c4bf1004808708d2ece9dd1dcc679310a01ba1ef882714

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hKeGJqc1kIi7QU37oQPdmHBcUqiVKTW06oSRycgQZ8Iv8EdMTiaR8NsIi7ezsMSIct%2BnpgHaorY%2FZ8Cfd%2F1YdCn4YCSrLn2Lqz98XlEC5z6JoiZvDeeeAHG2FLSBzL7O6fugwyAKVpkAINDtSINh3M74"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564e694f5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15491

GET
H2 200 wp-emoji-release.min.js Show response
swiftmoves.blog/wp-includes/js/ 18 KB
5 KB 42ms
42ms Script
application/javascript 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/wp-includes/js/wp-emoji-release.min.js?ver=6.2
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx centminmod / centminmod
Resource Hash: 4f7fcb0e1aed73f7bdec63bd851e1d18232f64c592c06dc298aa991945536fdb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 UTC
content-encoding: br
display: staticcontent_sol
x-powered-by: centminmod
x-ezoic-cdn: Hit ds;mm;3b91e4320e6bb845185326c17ace16ec;2-284837-44;958d5013-7253-4ecc-77a8-cfd76bdc151d
x-middleton-display: staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Wed, 03 May 2023 17:04:23 GMT
server: nginx centminmod
etag: W/"6424f822-4904-gzip"
x-origin-cache-control: public, must-revalidate, proxy-revalidate, immutable, max-age=31536000, stale-while-revalidate=86400, stale-if-error=604800
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-hosted-by: BigScoots
x-ez-minify-js: 0.47% 18605 / 18692

GET
H2 200 frontend.min.js Show response
swiftmoves.blog/wp-content/plugins/link-whisper-premium/js/ 4 KB
2 KB 43ms
42ms Script
application/javascript 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/wp-content/plugins/link-whisper-premium/js/frontend.min.js?screx=1&sxcb=1a&ver=1673637308
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx centminmod / centminmod
Resource Hash: 03bd2d2836ebd07f722b44c6d5af1aa8e0e89958363032153d7744d31f978aec

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 UTC
content-encoding: br
display: staticcontent_sol
x-powered-by: centminmod
x-ezoic-cdn: Hit ds;mm;860dcfbfe06ed58f83ed794059e69536;2-284837-44;0815bc62-11a1-4fb1-6aed-8257fedb7a80
x-middleton-display: staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Wed, 03 May 2023 17:04:23 GMT
server: nginx centminmod
etag: W/"63c1adbc-1136-gzip"
x-origin-cache-control: public, must-revalidate, proxy-revalidate, immutable, max-age=31536000, stale-while-revalidate=86400, stale-if-error=604800
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-hosted-by: BigScoots
x-ez-minify-js: 0.07% 4499 / 4502

GET
H2 200 lasso-ga.min.js Show response
swiftmoves.blog/wp-content/plugins/lasso/admin/assets/js/ 4 KB
2 KB 49ms
48ms Script
application/javascript 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/wp-content/plugins/lasso/admin/assets/js/lasso-ga.min.js?screx=1&sxcb=1a&ver=1676424427
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx centminmod / centminmod
Resource Hash: 46cdb1d8dba7c7983b7cfcfabdc2822e50d397165e8a721fc7f24053785d181a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 UTC
content-encoding: br
display: staticcontent_sol
x-powered-by: centminmod
x-ezoic-cdn: Hit ds;mm;965002fca0a514b02eebc906f64126a2;2-284837-44;9c53ce7e-0092-41c4-405c-f5cf1f10319a
x-middleton-display: staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Wed, 03 May 2023 17:04:23 GMT
server: nginx centminmod
etag: W/"63ec34eb-1046-gzip"
x-origin-cache-control: public, must-revalidate, proxy-revalidate, immutable, max-age=31536000, stale-while-revalidate=86400, stale-if-error=604800
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-hosted-by: BigScoots

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_018.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 15 KB
16 KB 34ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_018.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 575bf6db9d20f290ca7a6fdbe1634e9fe7ad644fa15c08130de2fdb30ba11cbb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YtSQSV%2FWiU5Po6SF36FlHwIHH051MHfPgiGVI0KrWj6A7yOkOFrqh0S92qqxBlVmgU8AQ2QeCsRP17t36IdcV8DHznIJbf2h%2Feb6q2ouqVyd39X7YGa2Y3Fb2Nb7Oi8vwPwF8kyBcP%2F9dmK3w26HmzeA"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564f3a425437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15715

GET
H2 200 main.min.js Show response
swiftmoves.blog/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 42ms
42ms Script
application/javascript 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/wp-content/themes/generatepress/assets/js/main.min.js?screx=1&sxcb=1a&ver=3.0.4
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx centminmod / centminmod
Resource Hash: c0901279dec1117310802c450665b34a60788da4a00e066d2de367327cd13456

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 UTC
content-encoding: br
display: staticcontent_sol
x-powered-by: centminmod
x-ezoic-cdn: Hit ds;mm;aef7e2d1d75244eeaf1be8e10aa21bce;2-284837-44;4c487ef4-c6e5-43ec-5a77-ace4c80729c5
x-middleton-display: staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Wed, 03 May 2023 17:04:23 GMT
server: nginx centminmod
etag: W/"60fff876-1c98-gzip"
x-origin-cache-control: public, must-revalidate, proxy-revalidate, immutable, max-age=31536000, stale-while-revalidate=86400, stale-if-error=604800
vary: Accept-Encoding,User-Agent,Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-hosted-by: BigScoots
x-ez-minify-js: 0.00% 7320 / 7320

GET
H3 200 audio_019.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 36ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_019.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 734a1b76827961cad250818d1ac152a5190a11087117d3f052684bf0fc33b888

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1118
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NadUNYTfSE3T6CydPp3qtorwBc6gaqPZR6ZT1KLPuzkk%2FX%2Fe6KhmNdwb4HmpYW%2FhdsgqNcH%2FsmDzWaY0QDj6lWdkFq1w8MihCkN5Y5LBrGc%2B%2B7ryG9CwK%2F7EMDtDMkfnf8x3JSRplFLOCMfwkJaONgyI"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79564f4a555437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40294

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 40ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 36ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
815 B 25ms
10ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 15 May 2023 06:31:17 GMT
x-content-type-options: nosniff
content-encoding: br
age: 19861
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-yul12821-YUL
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 59 KB
17 KB 35ms
32ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d961a31d3d2fdb93a35a4024f9878b2ed896cd86a084ceb8df6af3bc53e29125

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: RSGA476WFW2MTKV7
age: 2636
etag: W/"110f0c3c343ee36404c8a2300f4755c3"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c79564f8a39a247-YYZ
x-amz-id-2: BRzSNWHa+gTkHvejV4mUN1sk3/WQU2C/I+GK3UBKJX+zzqOR1KbrVHSe4kXTXsBBRZr+Wa6H0pffnyhKdTj3aw==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 2 KB
2 KB 46ms
11ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3b89401fea631023de67ae75bf8f246b1af109a9a4247c3862016949eacc462b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:16:08 GMT
via: 1.1 google
age: 909
x-guploader-uploadid: ADPycdsjg8Gc4MCr7JI-FWcUyDRwkCS6Jf4340trjDwWKZCNVka87Sqi_E8B9pr6Q0f4u5ZcRyAlWIm4QV7EZF1UK0xEiQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1938
last-modified: Thu, 27 Apr 2023 19:53:17 GMT
server: UploadServer
etag: "0a4a90264145ed4c5c647dae5dfb0429"
x-goog-generation: 1682625197861193
x-goog-hash: crc32c=jhvysQ==, md5=CkqQJkFF7UxcZH2uXfsEKQ==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 1938
accept-ranges: bytes
expires: Mon, 15 May 2023 07:16:08 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 118ms
30ms Script
text/javascript 13.249.85.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-77.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cf4fc9350f69e442ebfdf130d4e601377e9273b642282a1ebb4f79d6116e8c5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 09:56:59 GMT
content-encoding: gzip
via: 1.1 e3bd3151a67fbf39759e8f681890f01e.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 00:14:05 GMT
server: AmazonS3
x-amz-cf-pop: ORD52-C1
age: 74059
x-amz-server-side-encryption: AES256
etag: W/"37e703da55f96b973658b8e7aeed0e93"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 0bnM5o6onElTiIaRwG-dD_4B3a6m11kNTn4U_5DQjmkQTPBnNDNMzQ==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 146ms
31ms Script
text/javascript 2600:9000:24f7:7200:a:e047:752:b361
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f7:7200:a:e047:752:b361 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 00:14:11 GMT
Via: 1.1 7d7f7790ad8ab9e81e905351df020944.cloudfront.net (CloudFront)
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
Server: AmazonS3
X-Amz-Cf-Pop: CMH68-P1
Age: 22627
x-amz-server-side-encryption: AES256
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1858
X-Amz-Cf-Id: DZ9H9GEzpPUIT1YbP2cGEUj_jhFWXbwi7sld4LHZILPDteG97XpHQg==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 49ms
12ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 19 Apr 2023 23:36:41 GMT
content-encoding: gzip
age: 2184876
x-guploader-uploadid: ADPycdtN0isEc5QSyz-7igCp3CdeQ5DOCcg6MFW504fz-H4BXTZsQLogi-2JnB1NeYZfqyAqxkhypOs108gwREU1dCrhEg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 18 Apr 2024 23:36:41 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 97ms
41ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-9c21"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 16 May 2023 06:31:17 GMT

GET
H2 200 container.html Show response
6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D4A2 6 KB
3 KB 37ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:13 GMT
expires: Tue, 14 May 2024 06:31:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 bluemonkey.gif Show response
swiftmoves.blog/detroitchicago/ 43 B
333 B 25ms
24ms XHR
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOm51bGwsImZyb21fY2FjaGUiOjAsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiYXVjdGlvbl9pZCI6IjQxY2FlMGY1LTkyN2QtNDM5ZS1iNWFmLTFmOTNiYzQ4ODc1MSIsImFkX3VuaXRfY29kZSI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMi0wIiwiYWRhcHRlcl9jb2RlIjoiYXBwbmV4dXMiLCJvcmlnaW5hbF9jcG0iOjAuMDc2MTgyLCJjcG0iOjAuMDc2MTgyLCJhZGp1c3RtZW50IjoxLCJtZWRpYV90eXBlIjoiZGlzcGxheSIsInRpbWVfdG9fcmVzcG9uZCI6MzU4LCJyZXNwb25zZV9zaXplIjoiMTYweDYwMCIsInJlcXVlc3Rfc2l6ZSI6IjE2MHg2MDAiLCJkb21haW5faWQiOjI4NDgzNywiZm9ybV9mYWN0b3JfaWQiOjEsInBvc2l0aW9uX3R5cGUiOjM5LCJzdGF0X3NvdXJjZV9pZCI6MTAwODcsInJlZnJlc2hfY291bnQiOjAsInNvdXJjZSI6ImNsaWVudCIsImFiX3Rlc3RfaWQiOiJtb2QxNzgifQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
content-length: 49
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 200 bluemonkey.gif Show response
swiftmoves.blog/detroitchicago/ 43 B
82 B 30ms
22ms XHR
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOm51bGwsImZyb21fY2FjaGUiOjAsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiYXVjdGlvbl9pZCI6IjQxY2FlMGY1LTkyN2QtNDM5ZS1iNWFmLTFmOTNiYzQ4ODc1MSIsImFkX3VuaXRfY29kZSI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0yLTAiLCJhZGFwdGVyX2NvZGUiOiJhcHBuZXh1cyIsIm9yaWdpbmFsX2NwbSI6MC4wNDA5MDksImNwbSI6MC4wNDA5MDksImFkanVzdG1lbnQiOjEsIm1lZGlhX3R5cGUiOiJkaXNwbGF5IiwidGltZV90b19yZXNwb25kIjozNjIsInJlc3BvbnNlX3NpemUiOiIyNTB4MjUwIiwicmVxdWVzdF9zaXplIjoiMjUweDI1MCIsImRvbWFpbl9pZCI6Mjg0ODM3LCJmb3JtX2ZhY3Rvcl9pZCI6MSwicG9zaXRpb25fdHlwZSI6MSwic3RhdF9zb3VyY2VfaWQiOjEwMDg3LCJyZWZyZXNoX2NvdW50IjowLCJzb3VyY2UiOiJjbGllbnQiLCJhYl90ZXN0X2lkIjoibW9kMTc4In0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
content-length: 49
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 200 bluemonkey.gif Show response
swiftmoves.blog/detroitchicago/ 43 B
82 B 29ms
24ms XHR
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOm51bGwsImZyb21fY2FjaGUiOjAsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiYXVjdGlvbl9pZCI6IjQxY2FlMGY1LTkyN2QtNDM5ZS1iNWFmLTFmOTNiYzQ4ODc1MSIsImFkX3VuaXRfY29kZSI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJhZGFwdGVyX2NvZGUiOiJhcHBuZXh1cyIsIm9yaWdpbmFsX2NwbSI6MC4wNzYxODIsImNwbSI6MC4wNzYxODIsImFkanVzdG1lbnQiOjEsIm1lZGlhX3R5cGUiOiJkaXNwbGF5IiwidGltZV90b19yZXNwb25kIjozNjYsInJlc3BvbnNlX3NpemUiOiIzMDB4MjUwIiwicmVxdWVzdF9zaXplIjoiMzM2eDI4MCIsImRvbWFpbl9pZCI6Mjg0ODM3LCJmb3JtX2ZhY3Rvcl9pZCI6MSwicG9zaXRpb25fdHlwZSI6MzQsInN0YXRfc291cmNlX2lkIjoxMDA4NywicmVmcmVzaF9jb3VudCI6MCwic291cmNlIjoiY2xpZW50IiwiYWJfdGVzdF9pZCI6Im1vZDE3OCJ9
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
content-length: 49
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 200 bluemonkey.gif Show response
swiftmoves.blog/detroitchicago/ 43 B
82 B 26ms
25ms XHR
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOm51bGwsImZyb21fY2FjaGUiOjAsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiYXVjdGlvbl9pZCI6IjQxY2FlMGY1LTkyN2QtNDM5ZS1iNWFmLTFmOTNiYzQ4ODc1MSIsImFkX3VuaXRfY29kZSI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLW1lZHJlY3RhbmdsZS0yLTAiLCJhZGFwdGVyX2NvZGUiOiJhcHBuZXh1cyIsIm9yaWdpbmFsX2NwbSI6MC4wNTYwNzgsImNwbSI6MC4wNTYwNzgsImFkanVzdG1lbnQiOjEsIm1lZGlhX3R5cGUiOiJkaXNwbGF5IiwidGltZV90b19yZXNwb25kIjozNjgsInJlc3BvbnNlX3NpemUiOiI3Mjh4OTAiLCJyZXF1ZXN0X3NpemUiOiI5NzB4OTAiLCJkb21haW5faWQiOjI4NDgzNywiZm9ybV9mYWN0b3JfaWQiOjEsInBvc2l0aW9uX3R5cGUiOjUsInN0YXRfc291cmNlX2lkIjoxMDA4NywicmVmcmVzaF9jb3VudCI6MCwic291cmNlIjoiY2xpZW50IiwiYWJfdGVzdF9pZCI6Im1vZDE3OCJ9
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
content-length: 49
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 204 greenoaks.gif
swiftmoves.blog/detroitchicago/ 0
35 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjU0NzMifV19XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
22ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5NzcyODIyNDEzNTYyNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJzd2lmdG1vdmVzX2Jsb2ctcGl4ZWwxIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjk3NzI4MjI0MTM1NjI2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6InN3aWZ0bW92ZXNfYmxvZy1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiYzM1MmJhNTgxYmQzZmZkOGNlYTYwOGNmMmQ1NWY1MTkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTc3MjgyMjQxMzU2MjYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0Ijoic3dpZnRtb3Zlc19ibG9nLXBpeGVsMSIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDYsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDEsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjk3NzI4MjI0MTM1NjI2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6InN3aWZ0bW92ZXNfYmxvZy1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1OTEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTc3MjgyMjQxMzU2MjYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0Ijoic3dpZnRtb3Zlc19ibG9nLXBpeGVsMSIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5NzcyODIyNDEzNTYyNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJzd2lmdG1vdmVzX2Jsb2ctcGl4ZWwxIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDUtMTUifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5NzcyODIyNDEzNTYyNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJzd2lmdG1vdmVzX2Jsb2ctcGl4ZWwxIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYXVjdGlvbl9lcG9jaCI6MTY4NDEzMjI3OCwiYWRfcG9zaXRpb24iOjk5OTksImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MjgwLCJiaWRfZmxvb3JfcHJldiI6MTAwLCJiaWRfZmxvb3JfZmlsbGVkIjo2MCwiYXVjdGlvbl9jb3VudCI6NCwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NTQ5LCJtdWx0aV9hZF91bml0IjpudWxsLCJtdWx0aV9hZF9jb3VudCI6bnVsbCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:18 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:18 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
476 B 392ms
389ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=86672675587743&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=17&adks=798944132&sfv=1-0-40&ris=2&rcs=2&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D3%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3Ddfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJK4zlLT5pSJZwr0ZflCbYmQAAAGIHhsbAgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDjdWM0%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D120%26reqt%3D1684132276661&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277762&lmt=1684132277&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRiw2-zwgTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBix2-zwgTFIAFICCGQSFwoIcnRiaG91c2UYsdvs8IExSABSAghkEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcYsNvs8IExSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLHb7PCBMUgAUgIIZBIUCgVvcGVueBix2-zwgTFIAFICCGQ.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b65e172c1915c9b2c20ac2c20c397e81308526f4f71a0148e188fe9208935

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 447
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
472 B 277ms
277ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=64334211275438&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=18&adks=1937768148&sfv=1-0-40&ris=2&rcs=2&prev_scp=a%3D%257C0%257C%26iid1%3D9208762842146216%26eid%3D9208762842146216%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1127%26sap%3D1127%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D3%26at%3Dmbf%26adr%3D398%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dswiftmoves_blog-box-1-9208762842146216%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D120%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJHrZWHjL83chvnl7_FvuGisAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICALX6OG%26amznsz%3D250x250%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%26hb_opt%3D0.14%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D3644e0050a428d%26lb%3D160%26reqt%3D1684132276661&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277770&lmt=1684132277&dlt=1684132272249&idt=516&adxs=1095&adys=275&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=280x264&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRiw2-zwgTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBix2-zwgTFIAFICCGQSFwoIcnRiaG91c2UYsdvs8IExSABSAghkEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcYsNvs8IExSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLHb7PCBMUgAUgIIZBIUCgVvcGVueBix2-zwgTFIAFICCGQ.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95590d1b7dc0cc75b5519cee77229d665c932a2eafe449d4607aaf33603d41c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 443
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
475 B 295ms
295ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=2095076953029717&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=19&adks=2650088509&sfv=1-0-40&ris=2&rcs=2&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D3%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJCehygsYoEzMwpI8sbWhhxwAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBri1Pp%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D140%26reqt%3D1684132276660&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277774&lmt=1684132277&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRiw2-zwgTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBix2-zwgTFIAFICCGQSFwoIcnRiaG91c2UYsdvs8IExSABSAghkEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcYsNvs8IExSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLHb7PCBMUgAUgIIZBIUCgVvcGVueBix2-zwgTFIAFICCGQ.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df88fa1219c8b3f3ab13709fe5e60e4ae98fcafa4c311aa04d5608cbbd00b483

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 446
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 107ms
106ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

fa8bf7d96832553f35139c56ea09e7a21b6acb70f74c17315bc864f7628f9c5b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:17 GMT
AN-X-Request-Uuid: 1f56cb05-2728-4150-886f-f1135a0c52ce
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 536 B
873 B 175ms
100ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: 3d13ae99c61dac3c97f36eddb6bcd21fc3bf68a345e201bb7083eb22cb95868c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 357

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
411 B 93ms
27ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: dfa20380035d4556f377636134cf28ad703cbf17e791f6f934836030aaf98162

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 80ms
79ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 200ms
200ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=760522591389e7f&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=14&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
138 B 15ms
15ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 125e7273b2a8c318cb8c380365574bbfb895241a963012b1c95aedbeed023cbf

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
313 B 106ms
39ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.46.0&cb=31716096876&lsavail=1&bundle=wp_W_F9nRiUyQmM1RU5LM0pzMml3ckc0azE0RzEzSkxWUG1TRmIlMkZobWhwVWlxTjU0eXBaUEV6N0RMQ3VEZ0ZLa3VRVXR1VnVWRjVVeW1raEI2TTVINzN1VHUlMkJ5bmpKMVJWWldLT1R4V0xiV2traHBDSUNRRXFNVDhwSHhxRzhBYUZ0YnNPSQ

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 112ms
111ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H3 200 css2
fonts.googleapis.com/ Frame D4A2 4 KB
671 B 46ms
45ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com
URL: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 04:33:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:17 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame C2CD 2 KB
1009 B 35ms
34ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 19:13:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40664
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 28 May 2023 19:13:33 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/ Frame C2CD 22 KB
9 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/abg_lite_fy2021.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a4645a1aa31745840e1e5dee4a2788e78c1d09b094f4705a64ddda88d8bd235

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:03:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8891
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8754
x-xss-protection: 0
server: cafe
etag: 1905752258753453817
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 04:03:06 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame C2CD 3 KB
1 KB 40ms
40ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:54:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5781
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 04:54:56 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame C2CD 19 KB
8 KB 41ms
38ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 02:43:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 02:43:42 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C2CD 0
0 106ms
36ms Image
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRL-uYNP1EA_L7j1b2WVvjHZVylsoLkecPrlCnD4vDf3HXSSiCRCB5hZoIoEGChfOAWLpiWfu5TmB2SVwTwqSTuTJNLqw
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C2CD 169 KB
53 KB 109ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:17 GMT

GET
H2 200 9d5f24412120a376f470376f2f2984aa.js Show response
www.gstatic.com/mysidia/ Frame C2CD 32 KB
14 KB 110ms
35ms Script
text/javascript 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9d5f24412120a376f470376f2f2984aa.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cb71f31c08ff900d8bc1a5bc75ee0a966a2bc61561e8974e445ef0941d9ff55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6406
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13623
x-xss-protection: 0
last-modified: Tue, 09 May 2023 14:00:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 13 Aug 2023 04:44:31 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/ Frame D4A2 19 KB
8 KB 43ms
43ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com
URL: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fbe329e68d02bf400d47f86bb2728739171c2aec4abcba995d7467f0f62cf8ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 21:57:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8020
x-xss-protection: 0
server: cafe
etag: 10981734531507917325
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 28 May 2023 21:57:21 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D4A2 205 B
520 B 113ms
42ms Image
image/png 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com
URL: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 17:15:54 GMT
x-content-type-options: nosniff
age: 479723
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 08 May 2024 17:15:54 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D4A2 604 B
696 B 114ms
44ms Image
image/png 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com
URL: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 06:14:41 GMT
x-content-type-options: nosniff
age: 519396
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 08 May 2024 06:14:41 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
471 B 308ms
307ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1669551503055364&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=20&adks=2128035842&sfv=1-0-40&ris=2&rcs=2&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D3%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3Ddfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D80%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-2-0%26hb_opt%3D0.02%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D348ebee37f9fa5e%26lb%3D120%26reqt%3D1684132276677&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277856&lmt=1684132277&dlt=1684132272249&idt=516&adxs=495&adys=215&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRiw2-zwgTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBix2-zwgTFIAFICCGQSFwoIcnRiaG91c2UYsdvs8IExSABSAghkEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcYsNvs8IExSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLHb7PCBMUgAUgIIZBIUCgVvcGVueBix2-zwgTFIAFICCGQ.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05327b1bdded4e57ff6c9a119278cba9c3acb64e4c1bd985e496d056584209be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 442
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
483 B 300ms
299ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1552137493413836&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=21&adks=180521375&sfv=1-0-40&ris=2&rcs=2&prev_scp=a%3D%257C0%257C%26iid1%3D5923801764085628%26eid%3D5923801764085628%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D3%26at%3Dmbf%26adr%3D398%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dswiftmoves_blog-medrectangle-2-5923801764085628%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C14%2C0%2C67%2C0%2C131%2C153%2C0%2C192%2C209%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJOomfROQ1JNBqeVmTIEqlO8AAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAAzIFR%26amznsz%3D728x90%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-medrectangle-2-0%26hb_opt%3D0.03%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D38b530636b8d352%26lb%3D160%26reqt%3D1684132276676&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277859&lmt=1684132277&dlt=1684132272249&idt=516&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRiw2-zwgTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBix2-zwgTFIAFICCGQSFwoIcnRiaG91c2UYsdvs8IExSABSAghkEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcYsNvs8IExSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLHb7PCBMUgAUgIIZBIUCgVvcGVueBix2-zwgTFIAFICCGQ.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c97b51bec8d19236963c56b04cb054b6b08b0a0a540112635775464acc700612

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 454
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
482 B 586ms
586ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3940743003315932&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C336x280%7C200x200%7C234x60%7C300x250%7C120x240%7C320x100%7C180x150%7C125x125%7C320x50%7C250x250&fluid=height&ifi=22&adks=1801785216&sfv=1-0-40&ris=2&rcs=2&prev_scp=a%3D%257C0%257C%26iid1%3D7268655742164335%26eid%3D7268655742164335%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1134%26sap%3D1134%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D3%26at%3Dmbf%26adr%3D398%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D34%26al%3D1034%26compid%3D0%26tap%3Dswiftmoves_blog-large-billboard-2-7268655742164335%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%26amznbid%3Dm90cg%26amzniid%3DJI6RXb6JJCXDGvZ5XFg3AzsAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCfv8gz%26amznsz%3D336x280%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-large-billboard-2-0%26hb_opt%3D0.01%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D374416fc9f12789%26lb%3D160%26reqt%3D1684132276711&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132277862&lmt=1684132277&dlt=1684132272249&idt=516&adxs=1040&adys=1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=360x264&msz=360x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRiw2-zwgTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBix2-zwgTFIAFICCGQSFwoIcnRiaG91c2UYsdvs8IExSABSAghkEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcYsNvs8IExSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGLHb7PCBMUgAUgIIZBIUCgVvcGVueBix2-zwgTFIAFICCGQ.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54354faf467528b465dcba0eb97246f18f318763e11f977446c0ae2a46e86621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 453
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
324 B 102ms
102ms XHR
text/plain 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 387ms
354ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Mon, 15 May 2023 06:31:18 GMT
server: Google Frontend
vary: Origin
via: 1.1 google
x-cloud-trace-context: b6793de8192ee55eb5d36192e7e68274

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 221 B
314 B 364ms
363ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 38afd9a8745d231f3d551054a0e05555d04b6f3e71aa4237ea746ad4c820bd93

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 4ff0c606a344259a15ba0309e9aa7eea
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 221

GET
H2 200 esp Show response
oajs.openx.net/ 85 B
325 B 86ms
52ms Fetch
application/json 34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fswiftmoves.blog%2F&rid=esp
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: f4311462962ccfc95311c60c3794997ec8a157b82bbcde5db4cc33bcbbe4d1c5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-8hqD+e6B1u3v2BUmfmJIjPItx/k"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 0389 15 KB
6 KB 26ms
25ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=swiftmoves.blog

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

386d466b8bdd0cda283c79718d2aec07f38b9f9ed81eebe6d5266bb20cd42c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:17 GMT
server: Kestrel
server-processing-duration-in-ticks: 348344
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1330 1 KB
1001 B 107ms
35ms Document
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com
URL: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 45956
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 14 May 2023 17:45:22 GMT
etag: 48472445140208031
expires: Mon, 15 May 2023 17:45:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sid Show response
mug.criteo.com/ Frame 0389
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=swiftmoves.blog&sn=ChromeSyncframe&so=3&topUrl=swiftmoves.blog&bundle=wp_W_F9nRiUyQmM1RU5LM0pzMml3ckc0azE0RzEzSkxWUG1TRmIlMkZobWhwVWlxT...
https://mug.criteo.com/sid?cpp=nhqpUHw5MmhjU0lFT3czQTl4eFc1eElOOVNQbmJOSnBUVlN5V05QdDlSZk5TZXNWbHlPUzQwTzZPTm9zOG1rdWZuUHpUT0dVa1l2ei8xd043ZCsvMHBvU1Ntdm1MeVJvNGVZMXpOZVhRUXJ6Vnc0QzI5QTBXOEp5NGhrbH...

431 B
655 B

26ms
25ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=nhqpUHw5MmhjU0lFT3czQTl4eFc1eElOOVNQbmJOSnBUVlN5V05QdDlSZk5TZXNWbHlPUzQwTzZPTm9zOG1rdWZuUHpUT0dVa1l2ei8xd043ZCsvMHBvU1Ntdm1MeVJvNGVZMXpOZVhRUXJ6Vnc0QzI5QTBXOEp5NGhrbHNEYnJiZGJiSVZzUW9xRHluZzJ3V25IUXZKWHdTa2tiZTJYU3pSdUR4VlcwdFNyVzBNN2hJRjRyOUN1WFcxTXd0YS9hZk5leXpqQzBQUzkzMmp3YVdqQ0FjT3Q0QVdKZlV5ZTd2UTg2TnBTVzJQZzRwaUhuL0NjaXJXSWlHOWk0LzhmRkFRSCt3T1k4dFV1ZjlWNWtNaVE1enpkN1lZRXladHFtdHNhZlhoNDJqZ29uVHA4bz18&cppv=2

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ad22c8a12e7d020d6cc624c3b5d4560af6dc6988ba5953a0a4367b3c722d8fe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2374832
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=nhqpUHw5MmhjU0lFT3czQTl4eFc1eElOOVNQbmJOSnBUVlN5V05QdDlSZk5TZXNWbHlPUzQwTzZPTm9zOG1rdWZuUHpUT0dVa1l2ei8xd043ZCsvMHBvU1Ntdm1MeVJvNGVZMXpOZVhRUXJ6Vnc0QzI5QTBXOEp5NGhrbHNEYnJiZGJiSVZzUW9xRHluZzJ3V25IUXZKWHdTa2tiZTJYU3pSdUR4VlcwdFNyVzBNN2hJRjRyOUN1WFcxTXd0YS9hZk5leXpqQzBQUzkzMmp3YVdqQ0FjT3Q0QVdKZlV5ZTd2UTg2TnBTVzJQZzRwaUhuL0NjaXJXSWlHOWk0LzhmRkFRSCt3T1k4dFV1ZjlWNWtNaVE1enpkN1lZRXladHFtdHNhZlhoNDJqZ29uVHA4bz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 397503
content-length: 0
expires: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_019.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 46 KB
47 KB 35ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_019.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1972e204b94fc1975388729a16a125de2201d31d0a997dec489ebeae20d0af62

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K8UQtlNikn30lnc%2FPfn%2Bs2oIvDCAgKnZr4P5j0%2BpUokMg0KDchKL6rMrZp%2Bvn6Y87UtEnRXttOFK3Ccei9Yg8eUegxYZFTcg4RCt4KaNWG6YmC5QDmls8Nco74y6OTaihgss%2BMGds6wn4hzLPWcNMFvp"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956514caf5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 47475

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame BEF7 638 B
703 B 24ms
14ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: a53ab9e1915e341acbfc9e4cbd13582939e2ebe40a701cf799b255f0891c2910

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 378
content-type: text/html
date: Mon, 15 May 2023 06:31:17 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BEF7
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=4&cm=a7ff6926-d3e1-0727-3bd7-76864a84176e&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537073026%26val%3D%7Bvisitor_id%7D
https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:9cfc3af708bb49c808e6d8d75839a9eb

43 B
61 B

15ms
15ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:9cfc3af708bb49c808e6d8d75839a9eb
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:18 GMT
server: Aorta/20230424.0cea469ad
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
location: https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:9cfc3af708bb49c808e6d8d75839a9eb
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 2f1bbd527b8c
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H3

200

dds
rtb.openx.net/sync/ Frame BEF7
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=ZyfX_ygdgkerNqFwfa8j5Q==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
64 B

15ms
15ms

Image
image/gif

35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: dut94ihad6t8h4pktqddvggbe66lts59

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BEF7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://us-u.openx.net/w/1.0/sd?id=536872786&val=102b6461-d1b1-4f00-b06c-5186e28fb05c

43 B
61 B

38ms
38ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=536872786&val=102b6461-d1b1-4f00-b06c-5186e28fb05c
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:18 GMT
Server: MT3 851 9bd98ae master ord-pixel-x21 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://us-u.openx.net/w/1.0/sd?id=536872786&val=102b6461-d1b1-4f00-b06c-5186e28fb05c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:17 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BEF7
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=da289973-f669-4adc-a84d-be5c17460972

43 B
61 B

13ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=da289973-f669-4adc-a84d-be5c17460972
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=da289973-f669-4adc-a84d-be5c17460972
Date: Mon, 15 May 2023 06:31:18 GMT
Connection: keep-alive
X-CI-RTID: d81c7579-62b5-4adb-b138-543a67e33c34
Content-Length: 112
Content-Type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BEF7
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=

43 B
61 B

14ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:17 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 37ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 33ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1330
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESEBFOtFcVPhjATvu6mOC5N88&google_cver=1&google_push=ATf1kGPLChIekJZf5CxrW9p8h0EZ4XY_FK7JToy6i4w36pYb4Kypdg_oWdDFq2C7dAm38iaBk0Jdf4wh8z28OVb1zN2yDwsT_jk
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=ATf1kGPLChIekJZf5CxrW9p8h0EZ4XY_FK7JToy6i4w36pYb4Kypdg_oWdDFq2C7dAm38iaBk0Jdf4wh8z28OVb1zN2yDwsT_jk&google_cver=1&google...

170 B
188 B

39ms
38ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=ATf1kGPLChIekJZf5CxrW9p8h0EZ4XY_FK7JToy6i4w36pYb4Kypdg_oWdDFq2C7dAm38iaBk0Jdf4wh8z28OVb1zN2yDwsT_jk&google_cver=1&google_gid=CAESEBFOtFcVPhjATvu6mOC5N88&google_hm=UTczNzQxODY3NzE0NTIyOTQ2MTVQ

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:18 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=ATf1kGPLChIekJZf5CxrW9p8h0EZ4XY_FK7JToy6i4w36pYb4Kypdg_oWdDFq2C7dAm38iaBk0Jdf4wh8z28OVb1zN2yDwsT_jk&google_cver=1&google_gid=CAESEBFOtFcVPhjATvu6mOC5N88&google_hm=UTczNzQxODY3NzE0NTIyOTQ2MTVQ
Content-Type: text/html
Cache-Control: max-age=16391
Connection: keep-alive
Content-Length: 154

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1330
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEJORPi0-IcuKq2BN9UqkH_s&google_cver=1&google_push=ATf1kGP6H4soSPqq1oBqnvJUtoPyy3D1FzFACaNBCmwIvK68rQVA00IGQ3SkfUhyYGJxtIqEKwox_-nynd_Qoj6OXIhUnqB8Ig
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=36881F8882764BFBBAB2F6595BB0DFFB&google_push=ATf1kGP6H4soSPqq1oBqnvJUtoPyy3D1FzFACaNBCmwIvK68rQVA00IGQ3SkfUhyYGJxtIqEKwox_-nynd_Qoj6...

170 B
188 B

39ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=36881F8882764BFBBAB2F6595BB0DFFB&google_push=ATf1kGP6H4soSPqq1oBqnvJUtoPyy3D1FzFACaNBCmwIvK68rQVA00IGQ3SkfUhyYGJxtIqEKwox_-nynd_Qoj6OXIhUnqB8Ig

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=36881F8882764BFBBAB2F6595BB0DFFB&google_push=ATf1kGP6H4soSPqq1oBqnvJUtoPyy3D1FzFACaNBCmwIvK68rQVA00IGQ3SkfUhyYGJxtIqEKwox_-nynd_Qoj6OXIhUnqB8Ig
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 14 May 2023 06:31:18 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1330
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESED74OMinpUDAr8jdw5G9JwE&google_cver=1&google_push=ATf1kGOwdUh1s5aemD5Zhz8hegLggf5Eh0_bYWUEjhGxOWV070OvNXTpTBCpLb_eYxzP5K1Z0WqCy7e3Nb6UNOMu1t1nEeb9ykY
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QzZGOEExODJDN0VEREU0RA==

170 B
188 B

44ms
43ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QzZGOEExODJDN0VEREU0RA==

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QzZGOEExODJDN0VEREU0RA==
date: Mon, 15 May 2023 06:31:18 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1330
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEGEY0sDCF_NGNjJI9H1ng8c&google_cver=1&google_push=ATf1kGMJs5MfGqHHxTIIQLITyQtXa7eG1dU4PZ_15QNuKn43OsChGh8cKXvcvor_V8ktNzUA1291FOl60IdJ3iCv...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=9SLjgQaKR_OWKa_5DSxFrg2&google_push=ATf1kGMJs5MfGqHHxTIIQLITyQtXa7eG1dU4PZ_15QNuKn43OsChGh8cKXvcvor_V8ktNzUA1291FOl60IdJ3iCvD2c8yANoL1Y

170 B
188 B

40ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=9SLjgQaKR_OWKa_5DSxFrg2&google_push=ATf1kGMJs5MfGqHHxTIIQLITyQtXa7eG1dU4PZ_15QNuKn43OsChGh8cKXvcvor_V8ktNzUA1291FOl60IdJ3iCvD2c8yANoL1Y

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=9SLjgQaKR_OWKa_5DSxFrg2&google_push=ATf1kGMJs5MfGqHHxTIIQLITyQtXa7eG1dU4PZ_15QNuKn43OsChGh8cKXvcvor_V8ktNzUA1291FOl60IdJ3iCvD2c8yANoL1Y
x-host: tde-deliveryengine-production-68bf66644b-xcrw7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1330
Redirect Chain

https://dsum-sec.casalemedia.com/cma?google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1&google_push=ATf1kGOstle90xMjNDr2uvxsiq7RMRdbhz5Qttaovd2ZarZ0a6wnmjh_70fBG-JpY8tJipZqN75K3VMfHr0vpS01KZCRigg...
https://sync.srv.stackadapt.com/sync?nid=68
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=fxwlYUubUiBvJ8uiP7oHl5U4mbc

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=fxwlYUubUiBvJ8uiP7oHl5U4mbc
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:18 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=fxwlYUubUiBvJ8uiP7oHl5U4mbc
Date: Mon, 15 May 2023 06:31:18 GMT
Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1330
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEOM2c-8j0vv2v1EkwXxxt14&google_cver=1&google_push=ATf1kGP0Gg69Ny9p8YRxVo3aZJa2A_1aF9Lp0MM3q7nfSQK5QtMviQLmTzSNHzI4I9LLyzlZOtxhOt...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ATf1kGP0Gg69Ny9p8YRxVo3aZJa2A_1aF9Lp0MM3q7nfSQK5QtMviQLmTzSNHzI4I9LLyzlZOtxhOtLKvPyOMhWeky1XXJsOow&google_hm=NDg1NzAwODkx...

170 B
188 B

39ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ATf1kGP0Gg69Ny9p8YRxVo3aZJa2A_1aF9Lp0MM3q7nfSQK5QtMviQLmTzSNHzI4I9LLyzlZOtxhOtLKvPyOMhWeky1XXJsOow&google_hm=NDg1NzAwODkxNTgzMTM0Mjg4OQ%3D%3D

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=ATf1kGP0Gg69Ny9p8YRxVo3aZJa2A_1aF9Lp0MM3q7nfSQK5QtMviQLmTzSNHzI4I9LLyzlZOtxhOtLKvPyOMhWeky1XXJsOow&google_hm=NDg1NzAwODkxNTgzMTM0Mjg4OQ%3D%3D
date: Mon, 15 May 2023 06:31:17 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1330
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEG-D6oa897dUDcMwPpxiz3U&google_cver=1&google_push=ATf1kGNQVu4GhCgMvJgSRwxmuH6KY_BtPgrVQoS3ptLzUnM7N-qT2hpXev-0af0BTJPJZ_6A57CKzjKEcxXDBEjKU...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=Nzk4OTcyMTQtOGFmOS00OGI1LTg1YTItMjZmMTIzNWEyYTc5&google_push=ATf1kGNQVu4GhCgMvJgSRwxmuH6KY_BtPgrVQoS3ptLzUnM7N-qT2hpXev-0af0B...

170 B
188 B

40ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=Nzk4OTcyMTQtOGFmOS00OGI1LTg1YTItMjZmMTIzNWEyYTc5&google_push=ATf1kGNQVu4GhCgMvJgSRwxmuH6KY_BtPgrVQoS3ptLzUnM7N-qT2hpXev-0af0BTJPJZ_6A57CKzjKEcxXDBEjKUXtnUXs3LRt_

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=Nzk4OTcyMTQtOGFmOS00OGI1LTg1YTItMjZmMTIzNWEyYTc5&google_push=ATf1kGNQVu4GhCgMvJgSRwxmuH6KY_BtPgrVQoS3ptLzUnM7N-qT2hpXev-0af0BTJPJZ_6A57CKzjKEcxXDBEjKUXtnUXs3LRt_
date: Mon, 15 May 2023 06:31:18 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1330 0
12 B 39ms
36ms Image
text/html 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ism_w6fgrxy-ZT4A5Ysq43hT4oMSL7U9fBv6Oshi-M5hzqJJCuPKWo-HZDc58wX9_MQS4otg

Requested by

Host: 6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com
URL: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
655 B 392ms
319ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=945716155493363&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3D04b5efc3207e2390972f099a6a3c4757%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132278100&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=ve4_td6_tt5_pd6_la6000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 728F 37 KB
15 KB 38ms
37ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6e94b29d16b40500497173fd832ac401.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540909
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 33ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
476 B 327ms
326ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=142380633252629&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=23&adks=798944132&sfv=1-0-40&ris=1&rcs=3&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D4%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3D8fc09e60bfd78aa82afac0405213359a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D48%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJK4zlLT5pSJZwr0ZflCbYmQAAAGIHhsbAgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDjdWM0%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D80%26reqt%3D1684132278276%26hb_bidder%3Dappnexus%26hb_adid%3D8421a8a0bb4268c%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132278284&lmt=1684132278&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e28c1ffeca35e7178362b0e0ea4bc6d42657793eff6f55d697fa46a7a415bae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 447
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
472 B 465ms
465ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=2979919775776084&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=24&adks=1937768148&sfv=1-0-40&ris=1&rcs=3&prev_scp=a%3D%257C0%257C%26iid1%3D9208762842146216%26eid%3D9208762842146216%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1127%26sap%3D1127%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D4%26at%3Dmbf%26adr%3D398%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dswiftmoves_blog-box-1-9208762842146216%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D70%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C3154%2C7%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJHrZWHjL83chvnl7_FvuGisAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICALX6OG%26amznsz%3D250x250%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%26hb_opt%3D0.14%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D3644e0050a428d%26lb%3D120%26reqt%3D1684132278280&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132278288&lmt=1684132278&dlt=1684132272249&idt=516&adxs=1095&adys=275&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=280x264&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b64f8d95af5d47948b432bf6e881be323eddd0ce2590b76852289db6a6fb316

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 443
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
475 B 427ms
427ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=4053762138447716&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=25&adks=2650088509&sfv=1-0-40&ris=1&rcs=3&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D4%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJCehygsYoEzMwpI8sbWhhxwAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBri1Pp%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D100%26reqt%3D1684132278293%26hb_bidder%3Dappnexus%26hb_adid%3D85c1f58f2d2254e%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132278298&lmt=1684132278&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f7752ac0bc31b7752d648859dddc5b90259831a0e237b27177b1a1827d6c27a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 446
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 37ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
472 B 516ms
516ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=90920385415591&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=26&adks=2128035842&sfv=1-0-40&ris=1&rcs=3&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D4%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3D8fc09e60bfd78aa82afac0405213359a%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D48%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%26hb_bidder%3Dappnexus%26hb_adid%3D86ca6052547a1bb%26hb_opt%3D0.04%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D348ebee37f9fa5e%26lb%3D80%26reqt%3D1684132278359&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132278366&lmt=1684132278&dlt=1684132272249&idt=516&adxs=495&adys=215&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

94d77aa73b9f28741b726dcfa6ac5607499a714c86fd7cb6cd2a792744704e67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 443
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 378ms
377ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3142994277180539&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=27&adks=180521375&sfv=1-0-40&ris=1&rcs=3&prev_scp=a%3D%257C0%257C%26iid1%3D5923801764085628%26eid%3D5923801764085628%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D4%26at%3Dmbf%26adr%3D398%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dswiftmoves_blog-medrectangle-2-5923801764085628%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C14%2C0%2C67%2C0%2C131%2C153%2C0%2C192%2C209%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C3154%2C7%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJOomfROQ1JNBqeVmTIEqlO8AAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICAAzIFR%26amznsz%3D728x90%26amznp%3D1k1hwjk%26hb_bidder%3Dappnexus%26hb_adid%3D905f0f1d822e346%26hb_opt%3D0.05%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D38b530636b8d352%26lb%3D120%26reqt%3D1684132278376&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132278380&lmt=1684132278&dlt=1684132272249&idt=516&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f51c0e476a264c2c2bcc3f65338a617905dae76e5dfbca63a3ebc157e54d4505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10453
x-xss-protection: 0
google-lineitem-id: 6018790531
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138416276085
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 37ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
32ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
483 B 359ms
359ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3851558745460917&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C336x280%7C200x200%7C234x60%7C300x250%7C120x240%7C320x100%7C180x150%7C125x125%7C320x50%7C250x250&fluid=height&ifi=28&adks=1801785216&sfv=1-0-40&ris=1&rcs=3&prev_scp=a%3D%257C0%257C%26iid1%3D7268655742164335%26eid%3D7268655742164335%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1134%26sap%3D1134%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D4%26at%3Dmbf%26adr%3D398%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D34%26al%3D1034%26compid%3D0%26tap%3Dswiftmoves_blog-large-billboard-2-7268655742164335%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C3154%2C7%2C8%2C9%2C835%26amznbid%3Dm90cg%26amzniid%3DJI6RXb6JJCXDGvZ5XFg3AzsAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCfv8gz%26amznsz%3D336x280%26amznp%3D1k1hwjk%26hb_bidder%3Dappnexus%26hb_adid%3D898b61a7154be21%26hb_opt%3D0.07%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D374416fc9f12789%26lb%3D120%26reqt%3D1684132278454&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132278463&lmt=1684132278&dlt=1684132272249&idt=516&adxs=1040&adys=1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=360x264&msz=360x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5a8a52da2c6bfa3087cabd0f5935f1c7ed91c5dd87c66280585088b06bcec3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 454
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 854C 0
234 B 1061ms
370ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lhogveqt&c=5765839120568&slotId=2882919560284&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 143 B
1 KB 113ms
112ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5d42859a812de26ac8ab15cd7d45fcbdd48afc8222441c2f18a636a6a73c8693

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:18 GMT
AN-X-Request-Uuid: 4d1db9d5-1aa1-4746-b6ac-95b99526a9e6
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 143
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 287 B
772 B 120ms
120ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: d1c88a0f23730f5bfbc861fed12ad233ca90da5bf145d22a889d96f26540beb3

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 256

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
410 B 27ms
27ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: 36a3e68137d67059668b4a8784516d9bb104bf9d50544df668c455002f5eaeda

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 75ms
75ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 197ms
197ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=107eaf744fa23033&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=12&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:18 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 17ms
16ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 3c5505bb748b94d8381cdbaf21fd09b3a5a5bfd2f19ff8782c43e76e21bffac5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 39ms
39ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.46.0&cb=28307835658&lsavail=1&bundle=3L-yN19nRiUyQmM1RU5LM0pzMml3ckc0azE0RzNsRkJETTYlMkY2aVB6RE9MbU9ueGpHY2RKT1VpTElJN0hKVDBIY3JpQU15c0F3N3p4WmtGcGhhNjN1ZlNoYnplYSUyQnY5eGF2SjBZWFAyN3hEU0tuVGwxYU1wTG5TQndpODRuVWlDNUZYejNrM3g2aUp6SkRFbGdia3llJTJCNFQwRWlFQSUzRCUzRA

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 93ms
92ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:18 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame B9C6 0
128 B 21ms
19ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 73B7 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssDZWhXfhSSslqKRYR7D-RCvEEX1_O7t0oDSC9G9_CZSPoUhpg2oF5viDhJQgyp5AWBHmREy4v-akbsDqx9_QBndyr7LbL2hpNAhB_PTcS7yo_nTgtjNoQs4XgvsPKFvdw8oAxGafCPyhj4xrWKkqcw4Z254MW7_4MocOEewYzX-5uG3AQdaT1RI37gM43RW_2W7OXCW5sdZSFRTuXirjXHyhuqXeiAYEYlNv_Ei_dc2yaGkfpVH9nNTamVzffi4vbEsghoYCYl61ua4TVuVXhzrssEwB8yKwiXfFOW2e5YxMx_tUqL0-LyjrOMcjsli_0eAYd-dQG6lq7hkVJw-ncVwOHUxIt1ekS2Y2_LS_zBfw&sai=AMfl-YQYO2ALLdubp2z8GtJ0ZvwhCwBqyddrjzgL9aZqfSSXTowsoM9wqSkBfJH-3iMvzJrxadsOxEPtSxAIV-ASzM5PTf1kO-TStiVPDia6jTjPUs4XQK3gRFqBCckVe-w&sig=Cg0ArKJSzNL9HbXVlafUEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 4 KB
2 KB 98ms
41ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6317a81010aa7a0c60252ac3bc3db0ff0025eefdb89de9db33a8853eb50fbfe0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 08:03:19 GMT
server: cloudflare
age: 8865
etag: W/"e7c-5fba2c57ab98a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7c795656de87cab4-YYZ
expires: Mon, 15 May 2023 05:03:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 73B7 169 KB
52 KB 38ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:18 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjU5MjM4MDE3NjQwODU2MjgiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjAxODc5MDUzMSwiY3JlYXRpdmVfaWQiOjEzODQxNjI3NjA4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjUyN2U1MmMxMDYzNWFjODEzNmE0Yzg0MDk0ZWU0OWE4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1OTIzODAxNzY0MDg1NjI4IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDA3LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNywiYmlkX2Zsb29yX3ByZXYiOjAuMDAxMiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzg0MTYyNzYwODUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjU5MjM4MDE3NjQwODU2MjgiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjAxODc5MDUzMSwiY3JlYXRpdmVfaWQiOjEzODQxNjI3NjA4NSwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNjAxODc5MDUzMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:18 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:18 GMT

GET
H3 200 6018790531 Show response
go.ezodn.com/dac/ 0
633 B 38ms
36ms XHR
text/plain 2606:4700:e4::ac40:a702
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/6018790531
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/porpoiseant/banger.js?cb=195-0&bv=226&v=74&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a702 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Mon, 15 May 2023 06:12:36 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QDPGXh5MxLP0hHxW7g4H0GilklkPKL18VAxG07Gkg2TMt5UV1wteOFF9BZoFKcWJd5zaplbyBXyxnOp%2BM2LWTw4GR9t6a2e600Css83X8PTq2yLrRhxxgxLS%2FVct%2F6%2B%2FpnZ7jQFNBQ%2B9Tqk%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 7c795656ae04196c-EWR
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNS0xNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjYifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:17 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:17 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 25ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYXVjdGlvbl9lcG9jaCI6MTY4NDEzMjI3OSwiYWRfcG9zaXRpb24iOjExMDAsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MzAwLCJiaWRfZmxvb3JfcHJldiI6MTIwLCJiaWRfZmxvb3JfZmlsbGVkIjo3MCwiYXVjdGlvbl9jb3VudCI6NCwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NDE2LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjYwMTg3OTA1MzF9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:19 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:19 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 2F0A 0
128 B 20ms
19ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=162412&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
DATA 200
OK truncated
/ Frame 73B7 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82ae510a650d59910c139d7683b28f1f2e0ceb1815565565855f90e7c0521b80

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 73B7 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-inF964yEaGnag72p23l0e6EdWnMiiOWWw5kic0n1ShHmrr9XKi2NbEyQkXlH6dR2JvCpFUZfHoSNoAaq4TIO9zWN4B-2EUWNGPr7jT7uFSO1wD7WQ_HJF5njbCzHTdEHnSjjSq428raMSTLaiRjU9nptIWU_x_chsrvl68lUl-KA5S5eop273vGXWdNa5wGzDLLzIpwBwNDmF7-JAAnyYb3G6ncw7Y8XfLFae1H0tveK1geAlni2JvCS9um6cqqMioJq1YDh-hESZXi0iLzuHO0mNXfRVsqM85a_9gGXUcy8tCDplWV99fAylek0mgyx9TwvZxsHbd5VH2jn3rIVMJepIg&sai=AMfl-YToB0UJgnuIX-5lXhxdtPdv--ppI4JY8TPLkOSNBeY0UeetU1hku9BGkyfYKYlhcWzFeD9LjZZPxnCuTqau7xZlpqJdeqQOtxBMc1PefvuseKzv_oCTjAKYeLPFpKY&sig=Cg0ArKJSzI9Hdx4bOJl6EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:18 GMT

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1855.073-3.027/ 186 KB
57 KB 37ms
37ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7f54ce85221f2bd0ecf87e42e73455e50c5943646822d23aadbd15ee5f5b576

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 11 May 2023 08:28:12 GMT
server: cloudflare
age: 5893
etag: W/"2e92a-5fb66c4e88294"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c7956572eafcab4-YYZ
expires: Wed, 14 Jun 2023 04:53:05 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 6FE8 10 KB
2 KB 74ms
59ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5f28789af8a335f879653598352ac0dcf6526f1909645196fbf89e3e4680ffd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 7c795657df53cab4-YYZ
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:19 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 283 B
306 B 69ms
60ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30bb169e41b6d0bb622fefcd8b946c3004172a96dbbea3cadf3c00c7c9a969ca

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript;charset=ISO-8859-1
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 7c795657df5acab4-YYZ

GET
H2 200 gsd Show response
router.infolinks.com/ 323 B
549 B 65ms
58ms Script
text/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3300706&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F&jsv=1855.073-3.027&_cb=16841322790000
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a71e5fefa31f0799fa35c4d0d6e9b159085ad6bb599231eca6c6fe657f93a63

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 7c795657df57cab4-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 audio_020.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 38ms
37ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_020.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c7601604ba28e80b333a47a4640035cf9c0f21a62c53c59779e69e4a9e5ffa6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4vOrMtmN0vYlZsmdtcTMQ0scXid6Jgvu3RaJGvLcKT%2FdirHRdRUmtqG13OffOVY7%2BAU8l%2FzkNsLq2Y%2FG736xLZGjJtcgTOw7jcMFaY5Ug6jPzLrHLcju7fZ0%2FpxXncB84yTf0ovR5dGMOwxHxJkqEVOv"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795657dd215437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40466

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 47CE
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

96ms
28ms

Document
text/html

67.202.105.31
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.31 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip31.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 58de2e9973df2f35c14a198d9b1fdce2cc549cd1b853d4bff72a7a3b9681896b

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1392
content-type: text/html
date: Mon, 15 May 2023 06:31:18 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Mon, 15 May 2023 06:31:18 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 19A4 2 KB
2 KB 60ms
21ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 80f5f925e25ac0611112ad94784bf3ceaa8efb1c83270ecd825c82f020fd3ddd

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1823
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:19 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame FB21 2 KB
814 B 17ms
9ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 6FE8
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D41DA1833-16BC-41FB-8168-95B4325D28EC
https://router.infolinks.com/dyn/pbm-usync?uid=41DA1833-16BC-41FB-8168-95B4325D28EC
https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=41DA1833-16BC-41FB-8168-95B4325D28EC
https://dpm.demdex.net/ibs:dpid=540&dpuuid=c141b74b-22ea-414f-bc66-57ef6830a0e2&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

95 B
123 B

41ms
40ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

DCS: dcs-prod-usw2-2-v044-0e258c36d.edge-usw2.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: pjCggEYRSEs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://router.infolinks.com/dyn/apn-usync?user_id=2829111677345209672

35 B
186 B

58ms
54ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=2829111677345209672
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658cfcecab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:19 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 82e5b1ad-5649-4c4e-81ee-1ca270ad7e98
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://router.infolinks.com/dyn/apn-usync?user_id=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ox-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://router.infolinks.com/dyn/ox-usync?uid=93e67f52-924f-0ce5-0c8d-da355611bcca

35 B
254 B

56ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ox-usync?uid=93e67f52-924f-0ce5-0c8d-da355611bcca
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658afc4cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://router.infolinks.com/dyn/ox-usync?uid=93e67f52-924f-0ce5-0c8d-da355611bcca
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 6FE8
Redirect Chain

https://ups.analytics.yahoo.com/ups/58422/occ
https://router.infolinks.com/dyn/VR-usync?uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3399&partner_device_id=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A
https://dpm.demdex.net/ibs:dpid=540&dpuuid=c141b74b-22ea-414f-bc66-57ef6830a0e2&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

95 B
123 B

42ms
41ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

DCS: dcs-prod-usw2-2-v044-05b71754b.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: JYMS3wCdToM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2C%2C
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
sync.targeting.unrulymedia.com/csync/ Frame 6FE8
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005&rndcb=8590180111
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=283&user_id=f4253dd0-827b-4799-a0f7-76907cf54808&expires=1&user_group=5&ssp=adconductor&bsw_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=
https://sync.1rx.io/usersync/bidswitch/0c031c75-0dc5-47ab-a78c-92793a44c6bb?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

43 B
452 B

29ms
29ms

Image
image/gif

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:19 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TN...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHU3WO4LVJMYTITSIIM3UOMTKMVEWUZTMNY
https://router.infolinks.com/dyn/zmn-usync?uid=7gquK14NHC7G2jeIjfln

35 B
225 B

55ms
54ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=7gquK14NHC7G2jeIjfln
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c79565ab8dbcab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Content-Type: text/html; charset=utf-8
Location: https://router.infolinks.com/dyn/zmn-usync?uid=7gquK14NHC7G2jeIjfln
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

tplift
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://router.infolinks.com/dyn/tplift?uid=2394646913815972036409

35 B
189 B

59ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/tplift?uid=2394646913815972036409
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658cfd3cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

location: https://router.infolinks.com/dyn/tplift?uid=2394646913815972036409
date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=277a2357-1e32-4313-9dd0-85518179de6d

35 B
202 B

55ms
55ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=277a2357-1e32-4313-9dd0-85518179de6d
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c7956590ff4cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://router.infolinks.com/dyn/sonobi-usync?uid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

imd-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://router.infolinks.com/dyn/imd-usync?user_id=48d10cb6-8639-4910-8bd3-c6b0a94824d0&partner_id=1531

35 B
200 B

60ms
57ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/imd-usync?user_id=48d10cb6-8639-4910-8bd3-c6b0a94824d0&partner_id=1531
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658cfd2cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

location: https://router.infolinks.com/dyn/imd-usync?user_id=48d10cb6-8639-4910-8bd3-c6b0a94824d0&partner_id=1531
access-control-allow-origin: *
date: Mon, 15 May 2023 06:31:19 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://router.infolinks.com/dyn/outh-usync?uid=y-E57vQf5E2uFvI270kxMYiWIzk0jz59ZB~A

35 B
260 B

54ms
54ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-E57vQf5E2uFvI270kxMYiWIzk0jz59ZB~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c7956590feecab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-E57vQf5E2uFvI270kxMYiWIzk0jz59ZB~A
date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://router.infolinks.com/dyn/sovrn-usync?uid=GpfHAPZHSyvkYo7GRcqvmKxM

35 B
196 B

53ms
53ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=GpfHAPZHSyvkYo7GRcqvmKxM
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c7956590ff2cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:19 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=GpfHAPZHSyvkYo7GRcqvmKxM
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

usersync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://image4.pubmatic.com/AdServer/SPug?p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3D41DA1833-16BC-41FB-8168-95B4325D28EC
https://router.infolinks.com/dyn/usersync?pmuservalue=41DA1833-16BC-41FB-8168-95B4325D28EC

0
163 B

59ms
56ms

Image
text/plain

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/usersync?pmuservalue=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 7c795658ffeacab4-YYZ
content-length: 0

Redirect headers

location: https://router.infolinks.com/dyn/usersync?pmuservalue=41DA1833-16BC-41FB-8168-95B4325D28EC
date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

mnet-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://cs.media.net/cksync?cs=41&ovsid=setstatuscode&type=inf&redirect=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmnet-usync%3Fuid%3D%3Cvsid%3E
https://router.infolinks.com/dyn/mnet-usync?uid=3271338731455172000V10

35 B
217 B

59ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mnet-usync?uid=3271338731455172000V10
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658efe4cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://router.infolinks.com/dyn/mnet-usync?uid=3271338731455172000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Mon, 15 May 2023 06:31:19 GMT

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=infolinks
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005&rndcb=3442415725
https://p.rfihub.com/cm?in=1&pub=20513&ssp=adconductor&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=2810035086818332396&expires=30&ssp=adconductor
https://sync.1rx.io/usersync/bidswitch/0c031c75-0dc5-47ab-a78c-92793a44c6bb?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

35 B
227 B

57ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795659e867cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:19 GMT
Server: Tengine
ETag: RX48fe24f188bf46cd87343bca0e84d201005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

qc-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://cms.quantserve.com/pixel/p-u1vdacBMXAcfT.gif?idmatch=0
https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=VF1wVwZYJFdPXXICBwprVFpcIgBPWncDAQsvfqgE

35 B
214 B

62ms
59ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=VF1wVwZYJFdPXXICBwprVFpcIgBPWncDAQsvfqgE
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658cfd5cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=VF1wVwZYJFdPXXICBwprVFpcIgBPWncDAQsvfqgE
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=2810035086818332396

35 B
187 B

59ms
55ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=2810035086818332396
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658cfcfcab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=2810035086818332396
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

disus
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fdisus%3Fuid%3D%24UID&partner=infolinks
https://ads.betweendigital.com/match?bidder_id=45188&callback_url=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D32%26buyeruid%3Dua-e4a4457e-1c56-352b-8fc7-d44670c6882d%26r%3DCid1YS1lNGE0NDU3ZS0xY...
https://ssp.disqus.com/match?bidder=32&buyeruid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d&r=Cid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg4MmQQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmN...
https://us.shb-sync.com/409e9d20-7266-4e54-9c40-4c5c2374fcfe.gif?puid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d&redir=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D31%26buyeruid%3D%5BUID%5D%26r%3DC...
https://ssp.disqus.com/match?bidder=31&buyeruid=2690444b-6cc0-4c19-8c26-4430c471655f&r=Cid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg4MmQQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS...
https://router.infolinks.com/dyn/disus?uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d

35 B
215 B

55ms
54ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/disus?uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795659e866cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

location: https://router.infolinks.com/dyn/disus?uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d
pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame 6FE8
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=212163770660309

35 B
192 B

62ms
60ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=212163770660309
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658cfd8cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
referrer-policy: unsafe-url
server: 33XP014
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=212163770660309
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame 6FE8
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&3rddpi=1177082855&3rdpcid=2810035086818332396&3rddpi=1239766150&...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&3rddpi=1177082855&3rdpcid=2810035086818332396&3rddpi=1239766150...

43 B
961 B

144ms
58ms

Image
image/gif

108.156.184.75
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&3rddpi=1177082855&3rdpcid=2810035086818332396&3rddpi=1239766150&3rdpcid=93e67f52-924f-0ce5-0c8d-da355611bcca&ckls=true&ci=gyhTGylRoC&nc=false&trid=594021121
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Server: 108.156.184.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-184-75.cmh68.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 22459bbbd30dde841847a0907f3ba96c.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: CMH68-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: UzjvQapGw4bT2YZaaFABwsDvRl8GdVYhlRUDVke-SQsxhMGIQb-D1Q==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 5bbf9ff531c5eebbeb82768a75b80422.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: CMH68-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&3rddpi=1177082855&3rdpcid=2810035086818332396&3rddpi=1239766150&3rdpcid=93e67f52-924f-0ce5-0c8d-da355611bcca&ckls=true&ci=gyhTGylRoC&nc=false&trid=594021121
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: -XmII1KrQKViFkFlyJ8BiWgY5NFjIS4oKGVAw4hNU2zWrOujOUtpgA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 doq.htm Show response
rt3020.infolinks.com/action/ 2 KB
2 KB 188ms
134ms XHR
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3020.infolinks.com/action/doq.htm?pcode=utf-8&r=16841322791031
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa255afe05ee86854db4891bb17f7f37b1addd3d5c9500cad31c65db0b587e35

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: en-CA
cf-ray: 7c795658eb5a542b-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame C66C 0
128 B 20ms
19ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 iqusync-1.24.min.js Show response
resources.infolinks.com/static/usync/ 4 KB
2 KB 33ms
33ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.24.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3300706&wsid=0&pdom=swiftmoves.blog&purl=https%3A%2F%2Fswiftmoves.blog%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc86842287e5db6d7692d21ca45d997e653b6f7f42f067e3d397b2ff8ec74fd3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:30:02 GMT
server: cloudflare
age: 3557
etag: W/"ef8-5f7cf4cd2b9e9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c7956589fbfcab4-YYZ
expires: Wed, 14 Jun 2023 05:32:02 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_020.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 89 KB
89 KB 34ms
33ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_020.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32252639797e2bd77f9ecca7147e46736857ce2cfaa9f18116bbb667ef8bf794

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=otbdlrxC3XqX7%2Bb0qaeo1n%2FVF8S5kAWGJEaYOtoq8rYs%2FSawXBiBChTh6nC%2FpUKBmi7x6R2QcNwH7x3pY5JWMH%2BhH0UDieqbA8%2Bo6kBZno5PzguSfTpCC3pF6RmS0Ewyd0qDP2sHom9bVw%2FSX0a36Frv"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795658ae1d5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 91048

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 194 B
1 KB 143ms
58ms XHR
text/html 13.249.85.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&iiqidtype=2&iiqpcid=fa678900-5f04-4c44-a283-1707447ba265&iiqpciddate=1684132279169&dbsaved=true&fbp=2503514551
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.24.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-10.ord52.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: 155fe6cb061850930e1f69dae09e3424d00acdf61538f74a8c5dd085629163e8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 663c3ff8ad8a7a9be2880cc75b0ba2c8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
server: Apache-Coyote/1.1
vary: Origin
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 3600
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: s74QlaL1xgnXLqpj5n2Phwvfqa_Pgx45t4nT8ss3W2jR57Di9ocUBA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iquid.js Show response
resources.infolinks.com/static/ 54 KB
13 KB 35ms
33ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.24.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c35a725ae1976af59c99556ad69e993dd9cf474033a75bb9406d59819d573d4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
age: 2481
etag: W/"d8c3-5f7533fc75a6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c795658dfdecab4-YYZ
expires: Wed, 14 Jun 2023 05:49:58 GMT

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 22 KB
7 KB 91ms
27ms Script
application/javascript 104.18.35.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.24.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.34 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 309fbcf91dae9f9e1145e08ca871067719df878dbae37613b989c17027b12b7c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 08 May 2023 16:11:35 GMT
server: cloudflare
age: 9431
etag: W/"64591f37-5742"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 7c7956593e50a246-YYZ
expires: Tue, 16 May 2023 06:31:19 GMT

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 36ms
33ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.24.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
server: cloudflare
age: 7544
etag: W/"e65f-5f7cf3aed6f0f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c795658dfe0cab4-YYZ
expires: Wed, 14 Jun 2023 04:25:35 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 19A4
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2829111677345209672

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2829111677345209672
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:19 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: de098959-9dd2-4a17-bcee-a1828b196334
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 19A4 43 B
603 B 36ms
28ms Image
image/gif 2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 19A4
Redirect Chain

https://ad.turn.com/r/cs?pid=21
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8575394200595948846

43 B
632 B

31ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8575394200595948846
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8575394200595948846
pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 19A4
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAC5aU7Iw6MAACKiklmZXA&expiration=1685341879

43 B
632 B

24ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAC5aU7Iw6MAACKiklmZXA&expiration=1685341879
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAC5aU7Iw6MAACKiklmZXA&expiration=1685341879
Date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 19A4
Redirect Chain

https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=de370d98-bf85-4e34-be86-7788a9892ec3&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null

43 B
632 B

55ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=de370d98-bf85-4e34-be86-7788a9892ec3&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=de370d98-bf85-4e34-be86-7788a9892ec3&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
date: Mon, 15 May 2023 06:31:19 GMT
server: _
content-length: 0

GET
H2

200

ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 19A4
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

43 B
603 B

32ms
27ms

Image
image/gif

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D

Protocol

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

rum
r.casalemedia.com/ Frame 19A4
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&partner_url=https%3A%2F%2Fr.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26exte...
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=

43 B
632 B

102ms
25ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 19A4
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662102567755307

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662102567755307
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:19 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 4
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662102567755307
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7c795658e9e433ff-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame 19A4 35 B
197 B 61ms
55ms Image
image/gif 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c795658ffe9cab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 23ms
22ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5NzcyODIyNDEzNTYyNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJzd2lmdG1vdmVzX2Jsb2ctcGl4ZWwxIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MDAsMTIwMF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTc3MjgyMjQxMzU2MjYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0Ijoic3dpZnRtb3Zlc19ibG9nLXBpeGVsMSIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5NzcyODIyNDEzNTYyNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJzd2lmdG1vdmVzX2Jsb2ctcGl4ZWwxIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiJ1bmRlZmluZWQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 91 B
925 B 100ms
56ms XHR
text/html 13.249.85.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=fa678900-5f04-4c44-a283-1707447ba265&iiqpciddate=1684132279169&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=740_1684132279210&fbp=2503514551&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-10.ord52.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: b3d2d4e2f3ea4267e7ad9276a1939f2f41fa7a6c95fb8b04dd91f383d513d919

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 663c3ff8ad8a7a9be2880cc75b0ba2c8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
server: Apache-Coyote/1.1
vary: Origin
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 3600
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: 32a20G-_TpSIyLfQLz1Gq_4mdsuDJAtmoUAp6bgX3fxrZWDC7oIF7A==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=359927&iiqidtype=2&iiqpcid=fa678900-5f04-4c44-a283-1707447ba265&iiqpciddate=1684132279169&tsrn...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=359927&iiqidtype=2&iiqpcid=fa678900-5f04-4c44-a283-1707447ba265&iiqpciddate=1684132279169&tsr...

43 B
960 B

143ms
57ms

Image
image/gif

108.156.184.75
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=359927&iiqidtype=2&iiqpcid=fa678900-5f04-4c44-a283-1707447ba265&iiqpciddate=1684132279169&tsrnd=834_1684132279211&fbp=2503514551&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=36v1XsPHHp&nc=false&trid=-1129826569
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 108.156.184.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-184-75.cmh68.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 22459bbbd30dde841847a0907f3ba96c.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: CMH68-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: ud97wN5i-FkXi079XDrZBRGrkiYykb36dM_J98RXHkvY01q7Cbxp4A==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 5bbf9ff531c5eebbeb82768a75b80422.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: CMH68-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=359927&iiqidtype=2&iiqpcid=fa678900-5f04-4c44-a283-1707447ba265&iiqpciddate=1684132279169&tsrnd=834_1684132279211&fbp=2503514551&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=36v1XsPHHp&nc=false&trid=-1129826569
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: Cj7uiKXIlRu4teXk8bX3EkV5ufcBuyOFkVD6-J5ExpxWqmM3oolBVQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
402 B 102ms
102ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

854c743401bc2bd05bc0e0f0b4af8e179fff23691d16c8c9195888ff8f4bb47d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 42 B
243 B 71ms
38ms XHR
application/json 2600:1901:0:8344::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=0.4.0&us_privacy=1---
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ima.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:8344:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 in_search.js Show response
resources.infolinks.com/js/1855.073-3.027/ 225 KB
89 KB 35ms
35ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1855.073-3.027/in_search.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9dd2e35c345a092f3e1444855a4906f005229a2bd76f6a1d1d22c6abf9c0e074

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 11 May 2023 08:28:12 GMT
server: cloudflare
age: 5704
etag: W/"382f5-5fb66c4e88294"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c795659c84dcab4-YYZ
expires: Wed, 14 Jun 2023 04:56:15 GMT

GET
H3 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 360 KB
120 KB 37ms
36ms Script
text/javascript 2607:f8b0:400c:c14::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c14::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fca970e379ea0c0d2aca05506e906a4dd475a4acf7f8767187c84d71c2014322

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122883
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:19 GMT

GET
H2 200 pbice.js Show response
resources.infolinks.com/js/pbice/3.025/ 279 KB
86 KB 45ms
45ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/pbice/3.025/pbice.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95efc6a1b0e18636b608c1280049e1e31e5dac2f28c111ae489cea912f8b927b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:31:06 GMT
server: cloudflare
age: 3545
etag: W/"45adc-5f7534347a084"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c795659c84fcab4-YYZ
expires: Wed, 14 Jun 2023 05:32:14 GMT

GET
H2 200 container-2.0.html Show response
resources.infolinks.com/static/ Frame C4B5 925 B
537 B 39ms
38ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-2.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a37336acc4462da1425a726d686a4d82b027c1d4d996bfe1776c630162ac4a71

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 267
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 7c795659d85fcab4-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:19 GMT
expires: Wed, 14 Jun 2023 06:26:52 GMT
last-modified: Wed, 03 May 2023 17:45:02 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame DA99
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

334ms
224ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:19 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:19 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

match
events-ssc.33across.com/ Frame 47CE
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=the33across&gdpr=0&user_id=c_iOeSH92nlo-IwsIK-Ven353C5o_4ktJq7XB9ex
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

29ms
26ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
referrer-policy: unsafe-url
server: 33XP012
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 47CE
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1684132279305.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fe...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=102b6461-d1b1-4f00-b06c-5186e28fb05c

68 B
225 B

56ms
28ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=102b6461-d1b1-4f00-b06c-5186e28fb05c
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

Date: Mon, 15 May 2023 06:31:19 GMT
Server: MT3 851 9bd98ae master ord-pixel-x17 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=102b6461-d1b1-4f00-b06c-5186e28fb05c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:18 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 47CE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-WG0GHHRE2uGXHoOXp1y1b6lzm7leLrFU~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-WG0GHHRE2uGXHoOXp1y1b6lzm7leLrFU%7EA&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

57ms
29ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-WG0GHHRE2uGXHoOXp1y1b6lzm7leLrFU%7EA&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
referrer-policy: unsafe-url
server: 33XP009
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-WG0GHHRE2uGXHoOXp1y1b6lzm7leLrFU%7EA&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame 47CE
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=67afe5a02aa4232a&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAMfi2JneWFTgNUa8jLAAAAAAA&expiration=1684218679&is_secure=true&us_privacy=
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMfi2JneWFTgNUa8jLAAAAAAA&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

28ms
27ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMfi2JneWFTgNUa8jLAAAAAAA&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAMfi2JneWFTgNUa8jLAAAAAAA&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 47CE
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=2394646913815972036409
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2394646913815972036409&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

63ms
29ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2394646913815972036409&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:18 GMT
referrer-policy: unsafe-url
server: 33XP010
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=2394646913815972036409&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

POST
H/1.1 200 535.json Show response
id5-sync.com/g/v2/ 594 B
1 KB 104ms
103ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/535.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

81197d640df51448b10afe5f0feedc3d0442179d18953a31205963e0372b8996

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="CAO PSA OUR"
access-control-allow-credentials: true

GET
H2 200 getads.htm Show response
rt3020.infolinks.com/action/ 4 KB
3 KB 381ms
380ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3020.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22design%22%2C%22scs%22%3A%22kFvoejX3ix%22%7D%5D&rid=ba622a9b-91a5-4145-ab13-69205b3d8460&jsv=1855.073-3.027&sr=1600X1200&rts=1684132279381&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=113.0.5672.92&dv=p&ce=t&purl=https%3A%2F%2Fswiftmoves.blog%2F&tzo=-0000&c=c&strg=true&pitc=95~XTkRJfq2EqQn-Yg2yO-bQmG4be_yfC3v&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=pF_1rQg9Xyo5uCBzRXl-RppzQ_EXBH37U4gpkjOEpFv7N4jAOrcK9dZGx2vA_VJNAz966-KdskcQVu7WTnE9SAGaARL7tsIsx80v6apB9t0BxrxB6lQQ7tFBa4JancZgTSh8uD0HzwZdfB_EUzrvNjVEveYYpu-H99mfRRRH56A&rsk=78&rcs=nUeUQrG5bnRquI0LQZwtHQ&cuid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&_iiq_pcid=fa678900-5f04-4c44-a283-1707447ba265&_pubcid=efc6dd67-eb86-4443-a034-9da4b203b609&ique=&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50022479a2be52aee5ed98513181640e1a5a94ad1efe0ce0ce5f6e6a30171c15

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-CA
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7c79565a2894cab4-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ta-usync
router.infolinks.com/dyn/ Frame C4B5
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_device_id=37dfd06d-bc8e-458e-a86c-7ccdd516632e=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7BTA_DE...
https://dpm.demdex.net/ibs:dpid=540&dpuuid=c141b74b-22ea-414f-bc66-57ef6830a0e2&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=24598744723586606653258633915388414695&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2Chttps%253A%252F%252Frouter.infolinks.com%...
https://router.infolinks.com/dyn/ta-usync?uid=c141b74b-22ea-414f-bc66-57ef6830a0e2

35 B
198 B

58ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ta-usync?uid=c141b74b-22ea-414f-bc66-57ef6830a0e2
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 7c79565bc95bcab4-YYZ
content-length: 35
expires: Sun, 15 May 2022 06:31:19 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://router.infolinks.com/dyn/ta-usync?uid=c141b74b-22ea-414f-bc66-57ef6830a0e2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 vidice.js Show response
resources.infolinks.com/js/vidice/2.1/ 282 KB
71 KB 41ms
40ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/vidice/2.1/vidice.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d31b1ca3f9a47ef07a5458a6d8e40ec216b607a05d2e938ded9d6fe9535a2f08

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:31:12 GMT
server: cloudflare
age: 224
etag: W/"4674f-5f75343a1fb78"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7c79565a88c1cab4-YYZ
expires: Wed, 14 Jun 2023 06:27:35 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
573 B 167ms
167ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=2&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A1200%2C%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22id5%22%3A%22ID5*X3rv7u3_cnLFFTJUGMXVEWBwYlXH4aRueHVIg5sefAFJ2WGHG6mx5o4BOlqb96nCSdoZJWIIb8bYJblX-Rhb7A%22%2C%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

53ae1834e72c4f8861c6dc6c2f822e9df78d771d5bdfd2fb8461811394a34abc

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: KPV1SZ0SMXKS8XDP3V1Y
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: w_iGjSOFhaPRa3DzWzH07EHZmtCFjM3OBhxwtLbHTSCwX2I9o12apQ==

GET
H3 200 audio_021.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 31ms
31ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_021.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ddce4cb6babea1df5cdf5e73cca5aacea22a2cd2bbeb1804051e90d32b57d1d3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1118
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f2CThidfHbei%2BS%2F3BTzOZf5yIl0uQi%2FuFAF%2FPmT6vSrNVxTSj5JQW4QLCmZ0ndbFNaZo3r8dCxbO4aHRnLnkQhjqtkdbIaBVPQzWIPVP8GsIvNSa0ZjfqagaMgCwWNKPNYGDTjE6l5TY03FIgsCZ5S8i"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79565bc9bf5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40675

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
185 B 353ms
351ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=2320137887434351&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3D736e09a0771285737509ab8954c475a7%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132279709&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=ve4_td8_tt7_pd8_la8000_er0.0.0.0_vi0.0.1200.1600_vp0_ts2_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame DA99 34 KB
10 KB 123ms
122ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:19 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66786
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H2 200 adview.htm
rt3020.infolinks.com/action/ 0
119 B 107ms
106ms Image
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rt3020.infolinks.com/action/adview.htm?rid=ba622a9b-91a5-4145-ab13-69205b3d8460&bdc=1&midx=0&emd=OTl-MTg0OQ&rts=1684132279767&prod_t=d&jsv=1855.073-3.027&skin=sidebar&theme=nologo&sdata=design&scs=kFvoejX3ix&rsd=pF_1rQg9Xyo5uCBzRXl-RppzQ_EXBH37U4gpkjOEpFv7N4jAOrcK9dZGx2vA_VJNAz966-KdskcQVu7WTnE9SAGaARL7tsIsx80v6apB9t0BxrxB6lQQ7tFBa4JancZgTSh8uD0HzwZdfB_EUzrvNjVEveYYpu-H99mfRRRH56A&rsk=78&rcs=nUeUQrG5bnRquI0LQZwtHQ
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7c79565cca22cab4-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4542 136 KB
46 KB 46ms
46ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: blank
URL: about:blank

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c07803acefb4b1db6914a5762549a1af41e84e17d4c85483210937cccb5371b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47449
x-xss-protection: 0
server: cafe
etag: 1472651435824666839
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:19 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_021.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 86 KB
87 KB 32ms
32ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_021.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e418ca0dae3a89ca3f0e7cae6c32de4308f9d5549c149f0ab2f1a588f420dc15

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1119
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jKb8di6uc25%2FTvQ0ohStFCaeF6SDdFf7Qb53BcQb2CwAmfE52mdeiXziMKNLrKgN7o0ij3V3Z4BY2lunoxUAeG3bXei1Ogyun9IddfXmKPoJu7K17%2F6TlKQYE8dqvRbDwr5CJ4EBghJKGWdY8TZM9i2n"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79565ceb215437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 88124

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 38ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 34ms
33ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 16 May 2023 06:31:19 GMT

GET
H2 200 lasso-event-tracking.min.js Show response
js.getlasso.co/ 5 KB
3 KB 60ms
20ms Script
application/javascript 2606:4700:3108::ac42:28d4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.getlasso.co/lasso-event-tracking.min.js?ver=314
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/wp-content/plugins/lasso/admin/assets/js/lasso-ga.min.js?screx=1&sxcb=1a&ver=1676424427
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:28d4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19b05cd39bad5158232286d390c8ac305cd6b922752202fd710ddd0b45c36825

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
via: 1.1 7c55514b62254664b7255cfc5da6dc92.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: JFK50-P6
age: 492292
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 14 Mar 2023 13:03:44 GMT
server: cloudflare
etag: W/"1fe689b0f77f1bb735d8c5cb53021225"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dbuYkgWbq4QircDslk4%2Byei%2BY14xMCtmwrH2xiz%2F%2BAMa7FKmS18yc56nt7f4K6K1D0F%2FERZg01%2B5z4a53uZNKPRU87bZKI0YllqmjGiyGHwpSBCl0YMQlJNuyWD4EDbfT38Z5q4hFgUBmtN8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 7c79565d3f3733fb-YUL
x-amz-cf-id: BoOTszqW4ZBjMC5b811_ov7ocMqxa6VEuYs2PreyD7Q19B9C6naacA==

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:20 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:20 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
471 B 324ms
323ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1634751117239424&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=29&adks=1937768148&sfv=1-0-40&ris=2&rcs=4&prev_scp=a%3D%257C0%257C%26iid1%3D9208762842146216%26eid%3D9208762842146216%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1127%26sap%3D1127%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D5%26at%3Dmbf%26adr%3D398%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dswiftmoves_blog-box-1-9208762842146216%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D36%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJHrZWHjL83chvnl7_FvuGisAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICALX6OG%26amznsz%3D250x250%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%26hb_opt%3D0.14%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D3644e0050a428d%26lb%3D70%26reqt%3D1684132278801&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132279835&lmt=1684132279&dlt=1684132272249&idt=516&adxs=1095&adys=275&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=280x264&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c064cb78c85cf65ceeaf724572627951876de464ceb135b14e0bfd4ea94d5794

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 442
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
478 B 318ms
317ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=4233324459044297&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=30&adks=798944132&sfv=1-0-40&ris=2&rcs=4&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D5%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3De66c30deca31b19eda212eeca1258584%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D24%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJK4zlLT5pSJZwr0ZflCbYmQAAAGIHhsbAgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDjdWM0%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D48%26reqt%3D1684132278800%26hb_bidder%3Dappnexus%26hb_adid%3D8421a8a0bb4268c%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132279840&lmt=1684132279&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc8ce721ce19f8c306a28e31933b63e270d2a84b1628491521cb834583cbd616

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 448
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
475 B 557ms
556ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=54728032652094&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=31&adks=2650088509&sfv=1-0-40&ris=2&rcs=4&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D5%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3D54d0fa6d5f6aabe7623cb24faa42a441%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D30%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJCehygsYoEzMwpI8sbWhhxwAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBri1Pp%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D60%26reqt%3D1684132278827%26hb_bidder%3Dappnexus%26hb_adid%3D85c1f58f2d2254e%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132279846&lmt=1684132279&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a93fc624b1db228b41bc7da7bd5269e53af8871af765b24fe5f9a0d0c0921c1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 446
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame DA99
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LHOGVEZ1-17-H6WS
https://ssc-cms.33across.com/ps/?xi=1&xu=LHOGVEZ1-17-H6WS
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LHOGVEZ1-17-H6WS&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

27ms
27ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LHOGVEZ1-17-H6WS&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:19 GMT
referrer-policy: unsafe-url
server: 33XP020
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LHOGVEZ1-17-H6WS&ts=1684132279&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 73B7 42 B
64 B 106ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuEJqxD6Tz5UgGTUdElXa4TzqxRNRLn8GhRJ6mwjzx3FZdujP2ONJszYels-KIWwRtwld7jWcx39lZXvWN-pdqWNcH83GInV9Wd7ELaoSTQOjVAhqCX&sig=Cg0ArKJSzBG6iAsgt3pOEAE&id=lidar2&mcvt=1019&p=1110,315,1200,1285&mtos=1019,1019,1019,1019,1019&tos=1019,0,0,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=180521375&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132278783&rpt=101&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 37ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 70ms
24ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 16 May 2023 06:31:19 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame 4542 356 KB
120 KB 64ms
64ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:19 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230510/r20190131/ Frame 4D85 10 KB
5 KB 105ms
34ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230510/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 576
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:21:44 GMT
etag: 15057649708203361565
expires: Mon, 29 May 2023 06:21:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bots.min.json Show response
js.getlasso.co/ 59 KB
15 KB 63ms
46ms XHR
application/json 2606:4700:3108::ac42:28d4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.getlasso.co/bots.min.json
Requested by: Host: js.getlasso.co
URL: https://js.getlasso.co/lasso-event-tracking.min.js?ver=314
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:28d4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb1547bfa10f3b67c910439886989a85d858ef60d660b683b1768c4e4e1bf935

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
via: 1.1 0252b483f7b420504a413a83f987b080.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 279678
x-amz-cf-pop: JFK50-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 14 Mar 2023 13:03:44 GMT
server: cloudflare
etag: W/"435ad62c1088d021459626e434fc8a2d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Fqrs2DdeFeygh7XGdjRNP9vAOFqq%2Fa6IrJSSptl9lNbjXEtslLwB7d5EhVbsZevH8eaVHQCqsUbnI9%2B3lvzU5OuM7NyH%2FTuc6UYLUs6CrjIIRo960yR47VCVn0EQBsvbKN6vDbzYSsMyyyW"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-apo-via: origin,host
cf-ray: 7c7956606f9333fa-YUL
x-amz-cf-id: I2GFfhkGEHSarPZf2G3UIXeQMEXI3FM5lSJ5tNfv-d7DdkBoDtAeVQ==

POST
H2 200 tracking Show response
lasso.link/events/ 35 B
311 B 433ms
372ms XHR
application/json 35.171.218.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lasso.link/events/tracking
Requested by: Host: js.getlasso.co
URL: https://js.getlasso.co/lasso-event-tracking.min.js?ver=314
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.218.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-218-193.compute-1.amazonaws.com
Software: /
Resource Hash: 7e7bcfb161434fc323e8c29e90a0ad3e8cd2a549933352499053debf5f23abbc

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
x-amzn-requestid: cc86b7fd-2d2b-45fe-af26-b15cddccc24e
x-amzn-trace-id: Root=1-6461d1b8-27c4e4f539f0514579800e5b;Sampled=0;lineage=79f7b78f:0
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: E8204HWHoAMFt0g=
content-length: 35
access-control-allow-headers: *

POST
H2 204 csi
csi.gstatic.com/ Frame 854C 0
54 B 377ms
376ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lhogvisk&c=5765839120568&slotId=2882919560284&ghmsh_eids=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
472 B 319ms
318ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=142583492053541&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=32&adks=2128035842&sfv=1-0-40&ris=2&rcs=4&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D5%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3De66c30deca31b19eda212eeca1258584%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D24%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%26hb_bidder%3Dappnexus%26hb_adid%3D86ca6052547a1bb%26hb_opt%3D0.04%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D348ebee37f9fa5e%26lb%3D48%26reqt%3D1684132278910&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132280477&lmt=1684132280&dlt=1684132272249&idt=516&adxs=495&adys=215&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de9a3c5aa47579ff7eaa546b49e019fe41fc9701a741aa155ffa79d50583eca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 443
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 greenoaks.gif
swiftmoves.blog/detroitchicago/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjM2MjM2MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI2In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMjY4NjIwIn0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMSJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX3B4IiwidmFsIjoiNDk0MzAwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfY291bnQiLCJ2YWwiOiI2In0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19weCIsInZhbCI6IjI3MzgwMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIxIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjE3MjczNjAwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjEwNzk2In1dfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:20 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:20 GMT

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 30ms
29ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:20 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: 1a881e4a-12eb-bbd8-68f1-1e733348d4fc

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
253 B 26ms
26ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:20 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: ec176020-ddb1-3ecd-adbe-8cdac50ef140

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbOTcwLDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTkyMzgwMTc2NDA4NTYyOCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MDE4NzkwNTMxLCJjcmVhdGl2ZV9pZCI6MTM4NDE2Mjc2MDg1LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjU5MjM4MDE3NjQwODU2MjgiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjAxODc5MDUzMSwiY3JlYXRpdmVfaWQiOjEzODQxNjI3NjA4NSwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

POST
H2 204 greenoaks.gif
swiftmoves.blog/detroitchicago/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjcyNDcyMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIxMiJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjUzNzI0MCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6Ijk4ODYwMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiMTIifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiNTQ3NjAwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjIifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiMTcyNzM2MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMTA3OTYifV19XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 163ms
129ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5180478b05ce1d35a35e16e7de5e8b99ce86493504be34b65b596af264b75149

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:20 GMT
AN-X-Request-Uuid: 6cc8cfa2-88c0-423e-96a1-2a99f9012c71
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 376 B
773 B 141ms
92ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: 3598f7ed1a99b4e6da0f3573fbda9b6002163724f87dff86c081f41e5024ee9e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 257

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
410 B 26ms
26ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: 0cd573a04fabc68e83829b6e7aa50b3ed32567d8ba98f17d1b03473928be2635

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 82ms
81ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 196ms
195ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=1235b95fa1f6083d&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=9.5&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:20 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 17ms
17ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 64b26ee1a79e4619d1edb1f1d73e4da4ee23c5796a56bf45455a048a89da9a25

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 57ms
56ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=135&profileId=185&av=35&wv=7.46.0&bundle=3L-yN19nRiUyQmM1RU5LM0pzMml3ckc0azE0RzNsRkJETTYlMkY2aVB6RE9MbU9ueGpHY2RKT1VpTElJN0hKVDBIY3JpQU15c0F3N3p4WmtGcGhhNjN1ZlNoYnplYSUyQnY5eGF2SjBZWFAyN3hEU0tuVGwxYU1wTG5TQndpODRuVWlDNUZYejNrM3g2aUp6SkRFbGdia3llJTJCNFQwRWlFQSUzRCUzRA&cb=24268916644

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 87ms
86ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:20 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 26ms
25ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: 30bfa94d022b73f10daaa8ddf2fb705b9a915da2cf0ae218a1a428ec2cdb1202

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 371ms
371ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3815331243194448&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C336x280%7C200x200%7C234x60%7C300x250%7C120x240%7C320x100%7C180x150%7C125x125%7C320x50%7C250x250&fluid=height&ifi=33&adks=1801785216&sfv=1-0-40&ris=2&rcs=4&prev_scp=a%3D%257C0%257C%26iid1%3D7268655742164335%26eid%3D7268655742164335%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1134%26sap%3D1134%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D5%26at%3Dmbf%26adr%3D398%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D34%26al%3D1034%26compid%3D0%26tap%3Dswiftmoves_blog-large-billboard-2-7268655742164335%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%26amznbid%3Dm90cg%26amzniid%3DJI6RXb6JJCXDGvZ5XFg3AzsAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCfv8gz%26amznsz%3D336x280%26amznp%3D1k1hwjk%26hb_bidder%3Dappnexus%26hb_adid%3D898b61a7154be21%26hb_opt%3D0.07%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D374416fc9f12789%26lb%3D70%26reqt%3D1684132279004&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132280566&lmt=1684132280&dlt=1684132272249&idt=516&adxs=1040&adys=1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=360x264&msz=360x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

89bd051f6c1a1ee5d613fe335fea808b8743dab117f4fb62d2312fa344111dad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10577
x-xss-protection: 0
google-lineitem-id: 6209765922
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138421003730
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
476 B 330ms
329ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=1532228862393935&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=34&adks=798944132&sfv=1-0-40&ris=1&rcs=5&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D6%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3D291d27313eb66c50243129b23df8a579%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D10%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJK4zlLT5pSJZwr0ZflCbYmQAAAGIHhsbAgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDjdWM0%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D24%26reqt%3D1684132280536%26hb_bidder%3Dappnexus%26hb_adid%3D8421a8a0bb4268c%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132280571&lmt=1684132280&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9d0790f54b83f517c6996963d6e435fca55c2677281fe4b86d054f2d94c113f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 447
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 322ms
322ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3900416714984148&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=35&adks=1937768148&sfv=1-0-40&ris=1&rcs=5&prev_scp=a%3D%257C0%257C%26iid1%3D9208762842146216%26eid%3D9208762842146216%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1127%26sap%3D1127%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D6%26at%3Dmbf%26adr%3D398%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dswiftmoves_blog-box-1-9208762842146216%26eb_br%3Dad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D14%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2764%2C2765%2C3054%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C20%2C2351%2C2526%2C2527%2C2761%2C2763%2C3044%2C3154%2C8%2C9%2C835%2C17%2C20%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C3044%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C3154%2C7%2C8%2C9%2C835%2C17%2C19%2C20%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3053%2C3154%2C4276%2C7%2C8%2C9%2C835%2C17%2C18%2C19%2C20%2C1428%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3052%2C3053%2C3154%2C3856%2C4276%2C7%2C8%2C9%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJHrZWHjL83chvnl7_FvuGisAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICALX6OG%26amznsz%3D250x250%26amznp%3D1k1hwjk%26hb_bidder%3Dmedianet%26hb_adid%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%26hb_opt%3D0.14%26hb_format%3Dbanner%26hb_ssid%3D11307%26hb_rt%3Dow%26pwtsid%3D3644e0050a428d%26lb%3D36%26reqt%3D1684132280539%26pwtbst%3D1&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132280575&lmt=1684132280&dlt=1684132272249&idt=516&adxs=1095&adys=275&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=280x264&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c817438486ed72ca0dd9eaa348431d28353c6df62aa0feab6c15e26485cba5e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10493
x-xss-protection: 0
google-lineitem-id: 6218524503
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138426060751
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame 4542 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 4542 107 B
122 B 48ms
48ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8208 65 KB
19 KB 296ms
295ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=2751417950&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132279942&bpp=11&bdt=131&idt=646&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=316049107.1684132281&ga_sid=1684132281&ga_hid=486890624&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=31071756%2C44719339%2C44788442%2C44790154&oid=2&pvsid=3738170952900814&tmod=1216205239&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&cms=2&fu=4&bc=31&ifi=1&uci=1.iqw71zd6mwhg&fsb=1&dtd=661

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a976d2820a05e23970aea73fc84aabd6d4ed00beaafe166283bcb4557f2ace05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 19068
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
485 B 407ms
406ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=980656791562562&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=36&adks=2650088509&sfv=1-0-40&ris=1&rcs=5&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D6%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3D14e8a85d4c42ff1db8790cbef9e33493%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D12%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJCehygsYoEzMwpI8sbWhhxwAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBri1Pp%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D30%26reqt%3D1684132280578%26hb_bidder%3Dappnexus%26hb_adid%3D85c1f58f2d2254e%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132280621&lmt=1684132280&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98da15d7dbdaa6dabc698a0a405289a8f23b72df03286bd06c4a3a50ca80c7ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 448
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 events
bidder.criteo.com/csm/ 0
216 B 23ms
23ms Ping
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 699 B
811 B 90ms
24ms XHR
application/json 2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?ccpa=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c7c9e022a7d72bd15a924b8c9dde299d31da4a087e14c78223d665fb828c1251

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 79BB 145 B
1 KB 145ms
111ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

a42a40681c0353ade8b5794396fba0bb8f341bf85d9b865c3f64c38a04f34f09

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:20 GMT
AN-X-Request-Uuid: 470a4a6e-3ebb-40c5-8e6b-5aa74ab550f1
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 26ms
26ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: 7d848aff53dde19612ac4bc16a905dad363dd5a89c4efc96215bbe1e74533b88

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

GET
H3 200 avjp Show response
outbrain-d.openx.net/v/1.0/ Frame 79BB 106 B
127 B 51ms
51ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://outbrain-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fswiftmoves.blog%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=bcb7de91-e483-4a2d-a7a5-2f31febecae5&nocache=1684132280680&sua=%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D&us_privacy=1---&criteoid=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&id5id=ID5*Biwi9bSpv2mcQ_9PQZMYCjkmr06et2l1ISOFmMJIsRpJ2elYAkEw2wEFjI_VPvsqSdqNsIFt1m-DMbKSc_YrdA&lotameid=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&parrableid=null&pubcid=efc6dd67-eb86-4443-a034-9da4b203b609&ttduuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&schain=1.0%2C1!outbrain.com%2C006ca10119b62fceba0024c827780cdc78%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A734%2C%22h%22%3A412%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22maxduration%22%3A60%2C%22minduration%22%3A0%2C%22linearity%22%3A1%2C%22api%22%3A%5B2%5D%2C%22placement%22%3A3%7D%7D%5D%7D&auid=540492000&vwd=734&vht=412&vos=101&aumfs=4680
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/cri?r=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dLG12RV9nU1lRZHA3dHFoODJFMVNBSFhvdUtHYXlTM3k3MDE2JTJGNEZ5TWhYbGNPbGMlM0Q%26u%3d%24%7bUSER_ID%...
https://ssp-sync.criteo.com/user-sync/match?p=LG12RV9nU1lRZHA3dHFoODJFMVNBSFhvdUtHYXlTM3k3MDE2JTJGNEZ5TWhYbGNPbGMlM0Q&u=AAC5aU7Iw6MAACKiklmZXA&us_privacy=1---

0
141 B

23ms
23ms

Image
text/plain

2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=LG12RV9nU1lRZHA3dHFoODJFMVNBSFhvdUtHYXlTM3k3MDE2JTJGNEZ5TWhYbGNPbGMlM0Q&u=AAC5aU7Iw6MAACKiklmZXA&us_privacy=1---

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
cache-control: no-store,max-age=0
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

location: https://ssp-sync.criteo.com/user-sync/match?p=LG12RV9nU1lRZHA3dHFoODJFMVNBSFhvdUtHYXlTM3k3MDE2JTJGNEZ5TWhYbGNPbGMlM0Q&u=AAC5aU7Iw6MAACKiklmZXA&us_privacy=1---
Date: Mon, 15 May 2023 06:31:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=GF_KWF8lMkJMZDhXY3JDSkJydUJJdlM5ak81WVRWNlRwM0JDNyUyRiUyRm54QlNTVWhDVyUyQmclM0Q&gdpr=&gdpr_consent=&us_privacy=1---&cr_user_id=k-Xau0lxCJvYBiyCuL...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=criteo&bsw_custom_parameter=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=criteo&bsw_custom_parameter=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=9baf2f99-25f8-48cc-b9a1-c1bc81538c30&ssp=criteo&expires=30&user_group=5&bsw_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://ssp-sync.criteo.com/user-sync/match?p=GF_KWF8lMkJMZDhXY3JDSkJydUJJdlM5ak81WVRWNlRwM0JDNyUyRiUyRm54QlNTVWhDVyUyQmclM0Q&u=0c031c75-0dc5-47ab-a78c-92793a44c6bb

0
141 B

23ms
23ms

Image
text/plain

2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=GF_KWF8lMkJMZDhXY3JDSkJydUJJdlM5ak81WVRWNlRwM0JDNyUyRiUyRm54QlNTVWhDVyUyQmclM0Q&u=0c031c75-0dc5-47ab-a78c-92793a44c6bb

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
cache-control: no-store,max-age=0
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

Location: //ssp-sync.criteo.com/user-sync/match?p=GF_KWF8lMkJMZDhXY3JDSkJydUJJdlM5ak81WVRWNlRwM0JDNyUyRiUyRm54QlNTVWhDVyUyQmclM0Q&u=0c031c75-0dc5-47ab-a78c-92793a44c6bb
Date: Mon, 15 May 2023 06:31:20 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://sync.taboola.com/sg/criteoscod/1/cm?redirect=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dSjhqR19DOWI4OEQwdzFsQXR3RmpydXZ0bnlRbUclMkJWJTJGdjhYWU55bDBXMzBYNDk4SSUzRA%26u%3d%3c...
https://ssp-sync.criteo.com/user-sync/match?p=SjhqR19DOWI4OEQwdzFsQXR3RmpydXZ0bnlRbUclMkJWJTJGdjhYWU55bDBXMzBYNDk4SSUzRA&u=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

0
141 B

24ms
24ms

Image
text/plain

2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=SjhqR19DOWI4OEQwdzFsQXR3RmpydXZ0bnlRbUclMkJWJTJGdjhYWU55bDBXMzBYNDk4SSUzRA&u=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
cache-control: no-store,max-age=0
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

location: https://ssp-sync.criteo.com/user-sync/match?p=SjhqR19DOWI4OEQwdzFsQXR3RmpydXZ0bnlRbUclMkJWJTJGdjhYWU55bDBXMzBYNDk4SSUzRA&u=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
date: Mon, 15 May 2023 06:31:20 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 21796

GET
H/1.1 200
OK metric
report2.hb.brainlyads.com/statistics/ Frame 79BB 463 B
751 B 23ms
23ms Image
image/png 54.84.92.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://report2.hb.brainlyads.com/statistics/metric?event=noBid&bidder=appnexus64520d892126d5b60b1c1d8a&source=pbjs&placements=29926568
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.84.92.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-92-154.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 64faef43f59f0d829a290bb25e0b5c24308c0381b590d9717e460a8344912ba3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:20 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Powered-By: Express
ETag: W/"1cf-XHssOe1+WUPy43P3Ckt9sJ3fhf4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 463

GET
H2 200 dcl.htm Show response
rt3020.infolinks.com/action/ 0
60 B 114ms
113ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3020.infolinks.com/action/dcl.htm?rid=ba622a9b-91a5-4145-ab13-69205b3d8460&prod_t=d&sdata=design&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7c7956632e3acab4-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 22ms
22ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fswiftmoves.blog%2F&domain=swiftmoves.blog&bundle=wp_W_F9nRiUyQmM1RU5LM0pzMml3ckc0azE0RzEzSkxWUG1TRmIlMkZobWhwVWlxTjU0eXBaUEV6N0RMQ3VEZ0ZLa3VRVXR1VnVWRjVVeW1raEI2TTVINzN1VHUlMkJ5bmpKMVJWWldLT1R4V0xiV2traHBDSUNRRXFNVDhwSHhxRzhBYUZ0YnNPSQ&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 15 May 2023 06:31:20 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 261008
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

set Show response
id.a-mx.com/
Redirect Chain

https://id.a-mx.com/sync/?tagId=&ref=null&u=https://swiftmoves.blog/&tl=https://swiftmoves.blog/&nf=0&rt=true&v=7.46.0&av=2.0&vg=epbjs&us_privacy=1---&am=null&gdpr=0&gdpr_consent=
https://c3.a-mo.net/b?gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fid.a-mx.com%2Fset%3Fuid%3D
https://id.a-mx.com/set?uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=0&gdpr_consent=&us_privacy=1---

99 B
514 B

23ms
22ms

XHR
application/json

2606:4700:3031::6815:29fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/set?uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 2606:4700:3031::6815:29fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af58b87dbe3ba207c305c41aca342c2b328a3c60df330f5690460a7dd63652ee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wO0VuaDAPnS0qqQdd6nz0vWS%2Fjr426n9IkpIiTZ3uoEeQfj0JJoqdLYUKgEksvMMRKupAfg5cslxYBZiHIyVhb%2BqGkG%2BoHMtSF1ZNfrS3oRqvZZdaFEfJVl96h6Kqma6fK4gMyYhYDJwCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: null
access-control-allow-credentials: true
cf-ray: 7c7956652c593ff7-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
location: https://id.a-mx.com/set?uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=0&gdpr_consent=&us_privacy=1---
access-control-allow-origin: null
access-control-allow-credentials: true
cf-ray: 7c795664aceb7142-YUL
content-length: 0

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fswiftmoves.blog%2F&domain=swiftmoves.blog&bundle=wp_W_F9nRiUyQmM1RU5LM0pzMml3ckc0azE0RzEzSkxWUG1TRmIlMkZobWhwVWlxTjU0eXBaUEV6N0RMQ...
https://mug.criteo.com/sid?cpp=H5TNWXxYUStjMjUvYk1XWDN6WjRRSEQ5WFhhU21iVHFYczk5SlVsTXpGYmhSU0VMU2c0TmRiSmJRMUZYaFhSSzlVT3NTWFBwVnlSaktldm9LS05HMFRRb2R0NEFwSjh3MmFNcmw2ZW41K0YrNWJNWXI0VktMdnJ0KzVqQ3...

466 B
721 B

26ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=H5TNWXxYUStjMjUvYk1XWDN6WjRRSEQ5WFhhU21iVHFYczk5SlVsTXpGYmhSU0VMU2c0TmRiSmJRMUZYaFhSSzlVT3NTWFBwVnlSaktldm9LS05HMFRRb2R0NEFwSjh3MmFNcmw2ZW41K0YrNWJNWXI0VktMdnJ0KzVqQ3YwTWQvM3ZUMnF0NFlZb2RWdDhuOUZVbzhpOHQwY3FmbTR0WVJEUm84VGJwTXEvdGkxZ092QWVZQjgxeGdQK0FjY3d4YWRrS25PM2NkaGUvQmpGNVJFNVhRWEhDQXpWcGlHd056akNkUUxETTAvQ2J5R016eVlUeUZFNFpvaEFPL21ZYUxJaFprYjhVbm5JLzFYY0VyTTlZMlhXZ0J4dDhYNDZKMU5kZzFzekQ4NjhVek9WWT18&cppv=2

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c45184eb9f21ab7be99f75068613b4b98d65476b25e270d1232ccd26a29962a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1694873
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
location: https://mug.criteo.com/sid?cpp=H5TNWXxYUStjMjUvYk1XWDN6WjRRSEQ5WFhhU21iVHFYczk5SlVsTXpGYmhSU0VMU2c0TmRiSmJRMUZYaFhSSzlVT3NTWFBwVnlSaktldm9LS05HMFRRb2R0NEFwSjh3MmFNcmw2ZW41K0YrNWJNWXI0VktMdnJ0KzVqQ3YwTWQvM3ZUMnF0NFlZb2RWdDhuOUZVbzhpOHQwY3FmbTR0WVJEUm84VGJwTXEvdGkxZ092QWVZQjgxeGdQK0FjY3d4YWRrS25PM2NkaGUvQmpGNVJFNVhRWEhDQXpWcGlHd056akNkUUxETTAvQ2J5R016eVlUeUZFNFpvaEFPL21ZYUxJaFprYjhVbm5JLzFYY0VyTTlZMlhXZ0J4dDhYNDZKMU5kZzFzekQ4NjhVek9WWT18&cppv=2
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 780571
content-length: 0
expires: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C5BB 16 KB
6 KB 25ms
25ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr={gdpr]&gdpr_consent={gdpr_consent}&us_privacy=1---&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D558003%26extuid%3D
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33842
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:20 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 pd Show response
ezoic-d.openx.net/w/1.0/ Frame 133D 834 B
839 B 32ms
14ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 0cb3b51ebabe623b2e85a848ce12f7a767bf30f26896252934e5f675f174d772

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 495
content-type: text/html
date: Mon, 15 May 2023 06:31:20 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame F763 281 B
554 B 123ms
122ms Document
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:20 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 94FA 2 KB
814 B 10ms
9ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=59a18369e249bfb

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2

200

/ Show response
ads.us.e-planning.net/uspd/1/ Frame 0DCB
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

2 KB
1 KB

28ms
27ms

Document
text/html

172.98.26.245
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.245 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 71eceb3bb6aa58add0cb24e42ce9dc6792785a9df3ffa2547c8d53f51ad48ef3

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Mon, 15 May 2023 06:31:20 GMT
expires: Mon, 15 May 2023 06:31:20 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1219

Redirect headers

content-type: text/html; charset=iso-8859-1
date: Mon, 15 May 2023 06:31:20 GMT
location: /uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1219

GET
H2

200

/ Show response
de.tynt.com/deb/ Frame D914
Redirect Chain

https://ic.tynt.com/r/d?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X

2 KB
3 KB

29ms
28ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: d8f5db49998d0c677507352bb899dab9b63fc97b9adf0c14f6c6e55bbe0675cc

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 2011
content-type: text/html
date: Mon, 15 May 2023 06:31:20 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
content-length: 171
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:20 GMT
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
location: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
server: nginx/1.16.1

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2241 16 KB
6 KB 25ms
24ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983&us_privacy=1---
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33842
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:20 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame EE34 52 KB
17 KB 31ms
11ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 542
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:20 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 814
X-Served-By: cache-lga13626-LGA, cache-yul12829-YUL
X-Timer: S1684132281.911191,VS0,VE0

GET
H2 200 pbcas Show response
ads.yieldmo.com/ Frame A40E 1 KB
1 KB 25ms
24ms Document
text/html 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 890680e8d55e54fa111ef1809c13c2290d4474c900b36dc0e2de5bcf6bea8b23

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Mon, 15 May 2023 06:31:20 GMT
pragma: no-cache
vary: accept-encoding

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 47ED 2 KB
1 KB 440ms
17ms Document
text/html 23.227.152.162
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.152.162 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 6344c20f5e2a231f73e2f211e982630c32ea054347f57d2de05a175ea856837d

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://swiftmoves.blog
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 862
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:20 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C855 2 KB
814 B 11ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1684132277403&us_privacy=1---

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 79BB 996 B
1 KB 98ms
98ms XHR
application/json 23.105.12.131
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.131 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 2bed2b04dfbfcbef8467fd9718382abdfd6d1b0bf32b35aac414edc2190ddb0d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

GET
H3 200 css
fonts.googleapis.com/ Frame 8208 9 KB
932 B 54ms
48ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=2751417950&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132279942&bpp=11&bdt=131&idt=646&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=316049107.1684132281&ga_sid=1684132281&ga_hid=486890624&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=31071756%2C44719339%2C44788442%2C44790154&oid=2&pvsid=3738170952900814&tmod=1216205239&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&cms=2&fu=4&bc=31&ifi=1&uci=1.iqw71zd6mwhg&fsb=1&dtd=661

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b1289ccca476df0a33259965671579525261926bf8ea0a9f4fb3ba67535c4f69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 04:32:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 8208 2 KB
765 B 35ms
34ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 19:13:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40667
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 28 May 2023 19:13:33 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 133D
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7246762434369164995

43 B
114 B

34ms
11ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7246762434369164995
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7246762434369164995
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 133D
Redirect Chain

https://cms.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=f-MK0i3mXtJk4wiHLLQR0XHiWIVk5A2GKrUfOpvI

43 B
61 B

20ms
17ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=f-MK0i3mXtJk4wiHLLQR0XHiWIVk5A2GKrUfOpvI
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=f-MK0i3mXtJk4wiHLLQR0XHiWIVk5A2GKrUfOpvI
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 133D
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=openx&bsw_custom_parameter=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=3135ab51-7600-4853-8940-06363dfdc48f&ssp=openx&bsw_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://us-u.openx.net/w/1.0/sd?id=537072968&val=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=

43 B
61 B

13ms
12ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: //us-u.openx.net/w/1.0/sd?id=537072968&val=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&us_privacy=
Date: Mon, 15 May 2023 06:31:21 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 133D
Redirect Chain

https://p.rfihub.com/cm?pub=25&in=1
https://us-u.openx.net/w/1.0/sd?id=537073062&val=2810035086818332396

43 B
61 B

15ms
15ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073062&val=2810035086818332396
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537073062&val=2810035086818332396
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 133D
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=36881F8882764BFBBAB2F6595BB0DFFB

43 B
61 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=36881F8882764BFBBAB2F6595BB0DFFB
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=36881F8882764BFBBAB2F6595BB0DFFB
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 14 May 2023 06:31:21 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ Frame 133D
Redirect Chain

https://i.liadm.com/s/57424?bidder_id=206088&bidder_uuid=b8c78147-b641-0118-0fc4-11c12420d8b0
https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=206088&bidder_uuid=b8c78147-b641-0118-0fc4-11c12420d8b0&previous_uuid=b7f74b90ea104b8db0e64bd568efbece
https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8575394200595948846
https://mid.rkdms.com/bct?pid=bcccb40a-06d2-44fe-bdd2-a91ef4a5bfd0&&puid=38eeffdd-b2ae-437f-901e-c5ea7813fc0d&liid=&_ct=im
https://i.liadm.com/s/19948?bidder_id=178256&bidder_uuid=2f3f2ae2c52446bd67c35a16bffcc82b
https://x.bidswitch.net/sync?dsp_id=42&user_id=

43 B
235 B

39ms
36ms

Image
image/gif

35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=42&user_id=
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: HTTP/1.1
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=42&user_id=
Date: Mon, 15 May 2023 06:31:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 4

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 133D 43 B
656 B 57ms
53ms Image
image/gif 13.249.85.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212314908&puid=a4f3bdbd-ce57-00f8-2700-614d2e708b79
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-112.ord52.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 3b3cb210495e4d1678591271d0921206.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: ORD52-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: aIcJjJDQYgur-2qJ70slr0H5K_8MlUymSzvxQl_9t_kztGxHMoKcsQ==
expires: 0

GET
H2 200 37274
stags.bluekai.com/site/ Frame 133D 62 B
466 B 115ms
111ms Image
image/gif 23.192.32.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/37274?limit=1&id=9f650565-b4ec-06e8-37b5-72e335e679ec
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.32.8 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-32-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
cache-control: max-age=0, no-cache, no-store
content-length: 62
bk-server: f030
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 709996.gif
id.rlcdn.com/ Frame 133D 42 B
60 B 46ms
42ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709996.gif
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 133D
Redirect Chain

https://idpix.media6degrees.com/orbserv/hbpix?pixId=856286&pcv=125&ptid=23&tpuv=00&tpu=14dcc849-9903-1e5f-ba6b-a6348b7b599d
https://us-u.openx.net/w/1.0/sd?id=537072960&val=1hvdyo2ivzx5y

43 B
61 B

14ms
14ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072960&val=1hvdyo2ivzx5y
Requested by: Host: ezoic-d.openx.net
URL: https://ezoic-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ezoic-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://us-u.openx.net/w/1.0/sd?id=537072960&val=1hvdyo2ivzx5y
cache-control: no-cache
cf-ray: 7c795664dda8ca5f-YUL
content-length: 0

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame A40E
Redirect Chain

https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
https://ads.yieldmo.com/v000/sync?userid=2829111677345209672&pn_id=an

43 B
793 B

29ms
24ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?userid=2829111677345209672&pn_id=an
Requested by: Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

Date: Mon, 15 May 2023 06:31:20 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e041e446-5bb2-4060-aab6-ee4c49433ac9
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ads.yieldmo.com/v000/sync?userid=2829111677345209672&pn_id=an
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
sync-pm.ads.yieldmo.com/ Frame A40E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
https://image4.pubmatic.com/AdServer/SPug?p=160648&pmc=1&pr=https%3A%2F%2Fsync-pm.ads.yieldmo.com%2Fsync%3Fpn_id%3Dpub%26id%3D41DA1833-16BC-41FB-8168-95B4325D28EC%26gdpr%3D-1%26gdpr_consent%3D
https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=-1&gdpr_consent=

43 B
912 B

66ms
24ms

Image
image/gif

34.236.25.118
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=-1&gdpr_consent=
Requested by: Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe
Protocol: H2
Server: 34.236.25.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-25-118.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

location: https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=41DA1833-16BC-41FB-8168-95B4325D28EC&gdpr=-1&gdpr_consent=
date: Mon, 15 May 2023 06:31:20 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame A40E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D
https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=6785565542
https://sync.1rx.io/usersync/rubicon/LHOGVEZ1-17-H6WS
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-48fe24f1-88bf-46cd-8734-3bca0e84d2...
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

43 B
1 KB

24ms
24ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: Tengine
ETag: RX48fe24f188bf46cd87343bca0e84d201005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame A40E
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=6f15a88d-e42c-4017-8276-dff2b21d7926&secure=1
https://ads.yieldmo.com/v000/sync?userid=d4913566-b629-4f71-b374-716a359efae6&pn_id=b

43 B
1 KB

24ms
24ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?userid=d4913566-b629-4f71-b374-716a359efae6&pn_id=b
Requested by: Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

x-servername: Track001-iad
pragma: no-cache
date: Mon, 15 May 2023 06:30:50 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://ads.yieldmo.com/v000/sync?userid=d4913566-b629-4f71-b374-716a359efae6&pn_id=b
cache-control: private,no-cache
content-length: 206
expires: -1

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame A40E
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=76&redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fmm_user_id%3D%5BMM_UUID%5D
https://ads.yieldmo.com/v000/sync?mm_user_id=102b6461-d1b1-4f00-b06c-5186e28fb05c

43 B
908 B

25ms
24ms

Image
image/gif

35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?mm_user_id=102b6461-d1b1-4f00-b06c-5186e28fb05c
Requested by: Host: ads.yieldmo.com
URL: https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe
Protocol: H2
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 43

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: MT3 851 9bd98ae master ord-pixel-x24 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://ads.yieldmo.com/v000/sync?mm_user_id=102b6461-d1b1-4f00-b06c-5186e28fb05c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:20 GMT

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame 4284 43 B
473 B 110ms
18ms Document
image/gif 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=558003&extuid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr={gdpr]&gdpr_consent={gdpr_consent}&us_privacy=1---&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D558003%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:20 GMT
Etag: 89635513e8a94d67
Server: Adtelligent

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 23ms
23ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 15 May 2023 06:31:20 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 233338
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 11CD 0
0 41ms
41ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuA9sERZtie5797Pch9WODtJlNAn3Q9npnGNrII48IsnFqWHqdSYIha_SqQuU4WddhtnsDZDNWEdn4MHvYMaNgUSNJaZOr73mQr0Vk8ZTdRlhKshY1IRbR5QfRxFowUGTZT8aBYdXNtCDOWxTfr_Nl7yIBnm0Gvj6iMOa4wJbvupzHswWjN4HjBYU2leH8rkHdMoV50V_Rtu8pwlsdBS4467DmNRlqsRXC-o4GpSMxfc8GMQvLYwbq1_KbVJXPj0tSRPegx7wE0Q4_q20ynjzUsYSpzzcaPJDLmz9bmxTt54gZWdv5ejhZmu2BbPKqfSR3E1ITtm9I&sai=AMfl-YQYwHHhPC4aX-n9tvfViU-NPs26BA5jH49DmTgfmTMb-ERj68cvQyGEjCbhBY9CQmJlQnZq3KJd6zYaBUAZlI4rlKZcijuZZ_5aDzZ5p9ApWO56L18YIFVUIW3norY&sig=Cg0ArKJSzNIqDghb8zWtEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 wt Show response
t.pubmatic.com/ 17 B
94 B 23ms
22ms XHR
text/plain 8.28.7.92
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://t.pubmatic.com/wt?pubid=162833&purl=https%3A%2F%2Fswiftmoves.blog%2F&tst=1684132281&iid=4c977e05-66c0-4802-8729-2c609a37e9f1&bidid=7bc15212-d630-4ead-9f9d-b77128ef3aef&origbidid=189b3e097db200e&pid=9311&pdvid=8&slot=div-gpt-ad-swiftmoves_blog-box-1-0&au=%2F1254144%2C22534415887%2Fswiftmoves_blog-box-1&pn=medianet&bc=medianet&en=0.14&eg=0.14&kgpv=.*%40.*%40.*&piid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.92 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 0d111d61901004eafd87c672f12f6cd54b3c376513aa672bf58100506dfe76f5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 17
expires: 0

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame 8D0D 122 KB
44 KB 46ms
44ms Script
text/javascript 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CUB63XV6&ydspr=1

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

6252213baac49d7bb7a1394f332145aeee3cb94bd44ee41cdc5133c218cada74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-mnt-h: 22-jxfb
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
etag: "b7e6629577462cfd8b602178cb67fef7"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-jxfb
timing-allow-origin: *
expires: Mon, 15 May 2023 06:36:21 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 8D0D 35 B
296 B 95ms
18ms Image
image/gif 104.117.182.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&ckfl=0&vplcmtt=-1&lper=&app_type=prod&bdr_typ=2&ss_d1=1600&ogerpm=0.0000&ss_d2=1200&stid=div-gpt-ad-swiftmoves_blog-box-1-0&content_context=-1&content_channel=&other_prv=294%7C262&jar_err=&current_day=1.0&adtyp=0&req_id=4c977e05-66c0-4802-8729-2c609a37e9f1&bd_m3=0.0000&dmm_d36=NA&bidfp=0.0000&bd_m2=0.0000&pvag_id=&bd_m1=0.0000&ugd=4&dim10=false&predicted_wr=4.7025&exp=&deal_id=&ctr=-1.0&fdbk_id=&second_bidder=294&search_res=24&floor_bucket=0.00&gpid_format=&seat=262&rc=-1&size=250x250&f_seg=&prdp=0.1444&ogcbdp=0.1900&dfpbd=0.1444&server=1&ogerpm_wd_bkt=0-1&vskip=-1&model_version=202305150229_generic_prebid_2-cid_0&viewability=0.6900&dmm_r=0.5270&cut=24&dmm_l=0.5270&as_cache=0&tcyerpm=&content_language=&sc=QC&send_erpm=true&dmm_m9=0.0000&sd=0&hb_exp=&seg=&dmm_m4=0.0000&erpm_bucket=0.15&ugd_ver=&requrl=swiftmoves.blog%2F&bidrestime=1684132273043&cc=CA&strg=harmony&ss=1600x1200&video_maxdur=-1&current_hour=6&time_stamp=2023-05-15+06%3A31%3A13&content_network=&model_key=generic_prebid_2-cid_0&rvshhon=&mul_ratio=0.0000&bdp=0.1900&ct=montreal&akey=&mnckfl=0&content_genre=&dmm_ctr=-1.0000&asn=16276&bdp_bucket=0.20&algo=default&dc=east_sc&dim5=000&splid=div-gpt-ad-swiftmoves_blog-box-1-0&dim4=exploration&erpm_mult=1.000000&dn=swiftmoves.blog&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F113.0.5672.92+Safari%2F537.36&buyer_id=&dmm_m10=1165791&bdp_wider_bucket=1&acid=4f51319245484e32b8d4ff9b61ca15a8&zone=d&infl=&o_ver=NT+10.0&br_ver=113.0.5672.92&bdmm_m6=1.0000&bdmm_m7=0.6540&bdmm_m5=1.0480&ver=9.4.2&totalTimeBucket=3&visibility=-1&totalTime=3613471&dmm_m1=2023-05-15+06%3A31%3A13.059009430&e_rpm=0.1590&dmm_m22=0.1590&gdpr=&vsid=&log_less=false&content_userrating=&gpid_sent=false&ogerpm_used=false&sfm_key=&bdmm_m12=0.6860&cid=8CUPV1T76&bcrid=S0300080711068100250025099999900&rawbid=0.1900&seat_id=262&sub_bidder=0&pst=EMS&pbshr=100.0000&dmm_d10=0.0000&o_id=101&clisp=rtb-common-845cdff797-pq2f2.SC&dfp_bucket=0.1&adblk=&itype=prebid&pvid_seat=262_262&vcmplrt=-1.0&video_mindur=-1&cliIP=2503514551&advurl=content.businessinfoline.com%2F&level_base=0&crid=559647184&sat=1&br_id=265&cut_bkt=25&gpid=&iwb=1&dmm_d22=0.03&second_bid=0.008500&sc_pvid=262&capd=0&other_bids=0.0085%7C0.19
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.117.182.8 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 release-20230329-99-adperformance.js Show response
warp.media.net/rtb/resources/ Frame 11CD 71 KB
25 KB 52ms
31ms Script
application/javascript 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20230329-99-adperformance.js

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

529040ffb31edc3b458168066d513769520e983e2cc9ffb8d6c9ea0d98c57a11

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Mon, 15 May 2023 06:31:21 GMT
x-guploader-uploadid: ADPycdvIA07uolGXKB2ssiwsyDgqMV4zKQeEzrGWzE-0qe0mB_SYBHuFlR0hWZLANlGZBaEyJeskGsWCcGiO_fk5GCOg0Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25080
server: UploadServer
etag: "821663833b8f83b3092ebbca9ed4a6f2"
vary: Accept-Encoding
x-goog-hash: md5=ghZjgzuPg7MJLrvKntSm8g==, crc32c=XNaW9A==
content-type: application/javascript
x-goog-generation: 1680095338448196
cache-control: max-age=3600
x-goog-stored-content-length: 73074
expires: Mon, 15 May 2023 07:31:21 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 23ms
22ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI2In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MjA4NzYyODQyMTQ2MjE2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEyNywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiYWQwMDYxYTM4ZGQ3YzZmN2JjYjY5MmFlZTg4ZGZkYTQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkyMDg3NjI4NDIxNDYyMTYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAuMDAwMTQwMDAwMDAwMDAwMDAwMDEsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyNywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTQwMDAwMDAwMDAwMDAwMDEsImJpZF9mbG9vcl9wcmV2IjowLjAwMDM2LCJzdGF0X3NvdXJjZV9pZCI6MTEzMDcsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoic3RhdF9zb3VyY2VfaWQiLCJ2YWwiOiIxMTMwNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6Im1lZGlhX3R5cGUiLCJ2YWwiOiJiYW5uZXIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkyMDg3NjI4NDIxNDYyMTYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwcmViaWRfc291cmNlIiwidmFsIjoib3cifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:20 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:20 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MC4wMDAxNDAwMDAwMDAwMDAwMDAwMSwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDAxNDAwMDAwMDAwMDAwMDAwMSwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMzYsInN0YXRfc291cmNlX2lkIjoxMTMwNywiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 11CD 169 KB
52 KB 38ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 92ms
18ms Image
image/gif 104.117.182.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=4c977e05-66c0-4802-8729-2c609a37e9f1&cid=&crid=559647184&adunit_count=1&dn=swiftmoves.blog&requrl=https://swiftmoves.blog/&istop=true&event=client_bid_won&value=0.14&rd=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.117.182.8 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 log
hblg.media.net/ Frame 11CD 35 B
200 B 40ms
23ms Image
image/gif 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYQEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAMNAAUDcyMjk1NDMyOTU2NTAzXzE0NzQxODQ2NzRfNTU5NjQ3MTg0MTI2MjFANGY1MTMxOTI0NTQ4NGUzMmI4ZDRmZjliNjFjYTE1YTiMBFK4HoXrUcg_Lmh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nBENBHnN3aWZ0bW92ZXMuYmxvZxI4Q1VQVjFUNzYIDjI1MHgyNTAKMC4xNDQOZWFzdF9zYwxQUkVCSUQGYWRtAAAAAAAAQFFApu7Y4YNiBC0xAAAAAAAA8L88cnRiLWNvbW1vbi04NDVjZGZmNzk3LXBxMmYyLlNDQFMwMzAwMDgwNzExMDY4MTAwMjUwMDI1MDk5OTk5OTAwAhBlMmY2NDU1OAJkAg&cpr=0.6388915843929799

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 clog
hblg.media.net/ Frame 11CD 35 B
200 B 41ms
25ms Image
image/gif 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?logid=awlog&pixel_len_bucket=5643&lper=1&itypeid=3&itype=PREBID&cc=CA&cid=8CUPV1T76&reqid=4c977e05-66c0-4802-8729-2c609a37e9f1&vid=4c977e05-66c0-4802-8729-2c609a37e9f1&dn=swiftmoves.blog&rawDn=swiftmoves.blog&pid=8PRL4E7N3&ugd=4&fleet=common&requrl=https%3A%2F%2Fswiftmoves.blog&cliIPType=v4&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=QC&ct=montreal&pubid=pub-8CUPV1T76&tgtval=pub-8CUPV1T76&csip=rtb-common-845cdff797-pq2f2.SC&dtc=east_sc&zone=d&ptype=23&tmax=250&xtmax=205&gdpr=0&app=0&sat=1&screeninfo=1600x1200&asn=16276&sckfl=0&usp_status=0&usp_enf=1&pexid=PREBID-162833&geoll=false&is_ortb=true&s_ip=162.248.19.199&s_city=redwood+city&commit_id=e2f64558&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-05-12+00%3A00%3A00&pbasrc=-1&dummy_vsid=false&amptype=1&second_call=false&ipcc=CA&is_msnnative_src=false&rtttime=78&pvid=262&prvAccId=714553356&prvApiId=8CUB63XV6&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=559647184&prspt=headerBid&prvReqId=72295432956503_1474184674_55964718412621&reqsize=250x250&size=250x250&chnl=HARMONY&bdp=0.190&cbdp=0.144&og_cbdp=0.190&ogbdp=0.19&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&cat=IAB-3&advUrl=content.businessinfoline.com&dfpBd=0.144&dt=O&dbf=1&epc=714553356&s=1&snm=SUCCESS&pcrid=8CUB63XV6-714553356-20-27&tpbTkn=false&exid=31&bidflr=0.000&pbidflr=0.000&opbidflr=0.000&spbf=0&viewability=69&slotVisibility=-1&adpos=0&iframingState=0&sbdrid=99&bdata=%7Ebx_len%3D955%7Ebid%3D0.190%7Ebx_asn%3D16276%7Ebx_ginsu%3D0%7Ebx_iab%3DIAB19-9%7Ebx_intmd%3D0%7Ebx_rh%3D47DEQpj8HB%7Ebx_rpc%3D0000001%7Ebx_size%3D250x250%7Ebx_tmax%3D150%7Ebx_tml_suffix%3D%2F%7Ecity%3DMONTREAL%7Edc%3Dgcp-us-east1-d%7Edmm_d12%3D1%7Edmm_d15%3D1%7Edmm_d16%3D3%7Edmm_d17%3D1%7Edmm_d18%3D50%7Edmm_d19%3D0100%7Edmm_d2%3DT%7Edmm_d21%3D-1%7Edmm_d22%3D0.03%7Edmm_d24%3D5%7Edmm_d25%3Ddef_def%7Edmm_d29%3D0.00%7Edmm_d36%3DNA%7Edmm_d37%3DT%7Edmm_d4%3D10%7Edmm_d40%3D0%7Edmm_d44%3Dprod%7Edmm_d45%3D0%7Edmm_d46%3DR%7Edmm_d52%3D0.00%7Edmm_l%3D0.030%7Edmm_m1%3D0.159%7Edmm_m10%3D1.000%7Edmm_m11%3D1.000%7Edmm_m12%3D0.686%7Edmm_m13%3D1.000%7Edmm_m14%3D1.000%7Edmm_m15%3D1.023%7Edmm_m16%3D0.527%7Edmm_m2%3D0.044%7Edmm_m21%3D1.000%7Edmm_m23%3D1.000%7Edmm_m24%3D1.000%7Edmm_m25%3D1.000%7Edmm_m29%3D1.000%7Edmm_m3%3D1.000%7Edmm_m30%3D1.000%7Edmm_m34%3D1.000%7Edmm_m39%3D5.000%7Edmm_m40%3D5.000%7Edmm_m43%3D3.111%7Edmm_m5%3D1.048%7Edmm_m52%3D0.690%7Edmm_m6%3D1.000%7Edmm_m7%3D0.654%7Edmm_m9%3D1.000%7Edmm_r%3D0.527%7Ee_rpm%3D0.159%7Eerpm%3D0.159%7Ehc%3D0+%2B+0%7Eitype%3DPREBID%7Er_cc%3DCA%7Er_ip%3D149.56.153.183%7Er_sc%3DQC%7Erbo%3D5_3%7Eseller_tag_id%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%7Estd%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%7Euah%3Dtif1Tz4XKG-kz1c%7Esupply_tag_id%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%7Eamp%3D1%7Ecbdp%3D0.144%7Edmm%3Dharmony%7Esuid%3D%7Edtc%3Deast_sc%7Epos%3D0%7Edalg%3Ddefault%7Ehtml%3D1%7Esobp%3D0.01%7Ebdpcapd%3D0%7Edmm_erpm%3Dfalse%7Ebflr%3D0.000%7Eogbid%3D0.190%7Eac_type%3D1%7Eitype_id%3D3%7Eseller_tag_id%3Ddiv-gpt-ad-swiftmoves_blog-box-1-0%7EcarrierId%3D0%7Edcut%3D25%7Edogb%3D0-1%7Eibc%3D1%7E&exp=sce%3D1%7CssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Cfl_rl%3D1%7Cdbr%3D1%7Ctpi%3D1&mnrf=0&ortbseat=262&brsrclk=0&bidrestime=1684132273043&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.159&dmm_erpm=true&dmm_ogerpm=false&bcrid=S0300080711068100250025099999900&strg=HARMONY&stagid=div-gpt-ad-swiftmoves_blog-box-1-0&pgcatiab=IAB19-9&pgcatiab2=632&pgcatsprig=1158&vls=0&scrid=S0300080711068100250025099999900&mang=1&pvdTmax=151&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&apTags%3C%3E=75&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_sbp=-10.0&mx_sua_cvg=0001000&mx_epbc=8CUB63XV6&mx_SPRIG=1&mx_bsBucket=0&mx_ssProfile=0&mx_int_dsp_id=32&mx_lr=0&mx_TAS=1&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CUBCB617&mx_SC=1&mx_lr_seg_deal=1&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=div-gpt-ad-swiftmoves_blog-box-1-0&mx_tgs=250x250&mx_bsProfileRa=0&mx_IAB2=1&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=2&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_nids%3C%3E=neVlAkMT8OXA&mx_gpid_sent=false&mx_commit_id=250a703d73&acid=4f51319245484e32b8d4ff9b61ca15a8&rtime=3.0&wsip=mowx-756d4d48-9zrht&ltime=54.0&act=headerBid&abs=0%7C0%7Cxtmax%3D205%7Cbrr%3D1&adtypes=0&impId=div-gpt-ad-swiftmoves_blog-box-1-0&reftime=15000&reftype=0&keywordSellerId=false&dsid=div-gpt-ad-swiftmoves_blog-box-1-0&mowxReqId=4f51319245484e32b8d4ff9b61ca15a8_1&renderer=0&ifst=0&ifdp=0&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=-1&dfpDiv=div-gpt-ad-swiftmoves_blog-box-1-0&pub_pbslot=div-gpt-ad-swiftmoves_blog-box-1-0&mnrfc=-1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=69&v_mkey=gen-vblt_prebid_test_2_1&v_mver=202305141422_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&actltime=69&mp_seg%3C%3E=60332%23%23100049%23%23100051%23%23100057%23%23100059%23%2362146%23%2360909%23%23100066%23%23100109%23%2361083%23%2360097%23%23100087%23%23100110%23%23100111%23%2360878%23%2365936%23%2310003113%23%2310000733%23%2310003073%23%2361079%23%2360909%23%2366833%23%2365943%23%2310003069%23%2310003076%23%2365935%23%2367567%23%2310003079%23%2360878%23%2310000864%23%2362140%23%2310003883%23%2365932%23%2317212%23%2313462%23%2360909%23%23100169%23%2317191%23%2360878%23%2362119&debug_ts=2023-05-15+06%3A31%3A13&__expireat=1684132873312&mview=1&sc_pvid=294&sc_ogbdp=0.01&sc_adj0=0.0&sc_adj1=0.0&sc_adj2=15.0&sc_prspt=headerBid&sc_bdp=0.010&sc_cbdp=0.009&sc_cat=IAB-3&sc_advUrl=related.icananswerthat.com&rme=adm&utime=7903&sf=0&cpr=0.0595413111001617

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3 200 16724293977746283999
tpc.googlesyndication.com/simgad/ Frame 8208 4 KB
4 KB 35ms
35ms Image
image/png 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16724293977746283999?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541bd46059c2b8987999b59ba85e695f38663ba0c3457f15d4b63ec710f06216

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 19:02:30 GMT
x-content-type-options: nosniff
age: 559731
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3670
x-xss-protection: 0
last-modified: Sun, 22 Mar 2020 15:22:16 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 07 May 2024 19:02:30 GMT

GET
DATA 200
OK truncated
/ Frame 8208 161 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29e4c24a2fa1b6c2218b217e252a8d838cb65819a3b959a73c1a3565067ec0d9

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/ Frame 8208 22 KB
9 KB 38ms
37ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a4645a1aa31745840e1e5dee4a2788e78c1d09b094f4705a64ddda88d8bd235

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:03:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8895
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8754
x-xss-protection: 0
server: cafe
etag: 1905752258753453817
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 04:03:06 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 8208 3 KB
1 KB 42ms
42ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:54:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5785
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 04:54:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 8208 19 KB
8 KB 43ms
39ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 02:43:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13659
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 02:43:42 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8208 0
0 40ms
34ms Image
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQQNPSDDE9PCRX5LLut86gpvw97uM0B3VfuR53Kn1UZ6ql8Ijmy8UPnHtAyt7_RYKCMEs7nXRefOUI5UJ60FJpjv0HGdA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=2751417950&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132279942&bpp=11&bdt=131&idt=646&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=316049107.1684132281&ga_sid=1684132281&ga_hid=486890624&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=31071756%2C44719339%2C44788442%2C44790154&oid=2&pvsid=3738170952900814&tmod=1216205239&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&cms=2&fu=4&bc=31&ifi=1&uci=1.iqw71zd6mwhg&fsb=1&dtd=661
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8208 169 KB
52 KB 45ms
41ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 9d5f24412120a376f470376f2f2984aa.js Show response
www.gstatic.com/mysidia/ Frame 8208 32 KB
13 KB 40ms
35ms Script
text/javascript 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9d5f24412120a376f470376f2f2984aa.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cb71f31c08ff900d8bc1a5bc75ee0a966a2bc61561e8974e445ef0941d9ff55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6410
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13623
x-xss-protection: 0
last-modified: Tue, 09 May 2023 14:00:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 13 Aug 2023 04:44:31 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame EE34 0
861 B 24ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
AN-X-Request-Uuid: 13e8dccb-2c8c-47ef-8f8f-43ec6f9d86bf
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 26ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjE4NTI0NTAzLCJjcmVhdGl2ZV9pZCI6MTM4NDI2MDYwNzUxLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjYifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkyMDg3NjI4NDIxNDYyMTYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjIxODUyNDUwMywiY3JlYXRpdmVfaWQiOjEzODQyNjA2MDc1MSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImFkMDA2MWEzOGRkN2M2ZjdiY2I2OTJhZWU4OGRmZGE0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MjA4NzYyODQyMTQ2MjE2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAxNCwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDE0LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAzNiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjE4NTI0NTAzLCJjcmVhdGl2ZV9pZCI6MTM4NDI2MDYwNzUxLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjE4NTI0NTAzLCJjcmVhdGl2ZV9pZCI6MTM4NDI2MDYwNzUxLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzg0MjYwNjA3NTEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkyMDg3NjI4NDIxNDYyMTYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjIxODUyNDUwMywiY3JlYXRpdmVfaWQiOjEzODQyNjA2MDc1MSwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNjIxODUyNDUwMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

GET
H3 200 6218524503 Show response
go.ezodn.com/dac/ 39 B
641 B 47ms
44ms XHR
text/plain 2606:4700:e4::ac40:a702
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/6218524503
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/porpoiseant/banger.js?cb=195-0&bv=226&v=74&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a702 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b76f9b3d2d2776e2e4068aebcdc4546365460f9739d7ce3b1215786593e79194

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 39
last-modified: Mon, 15 May 2023 02:33:52 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hw9D2SmI1Dyp9l4qalGRQGX0IssJvopb04o4QZYK5JiV7ft5oNJ4YgVhiA5adQhO3TYK7aUNQGYc9U4HEFHn08NYdf9%2Bm8LLesIXA%2F08hsZ3enrK6%2FOtcW9HuTR9b6KMK5Jn5uWAEfwCPHU%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 7c7956648b63196c-EWR
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
22ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjE4NTI0NTAzLCJjcmVhdGl2ZV9pZCI6MTM4NDI2MDYwNzUxLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNS0xNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjYifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYXVjdGlvbl9lcG9jaCI6MTY4NDEzMjI4MSwiYWRfcG9zaXRpb24iOjExMjcsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MzAwLCJiaWRfZmxvb3JfcHJldiI6MzYsImJpZF9mbG9vcl9maWxsZWQiOjE0LCJhdWN0aW9uX2NvdW50Ijo2LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MDUsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NjIxODUyNDUwM31d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 42ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 40ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame AD9F 0
0 41ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssXUMZIWyXbkScc8TZ-VOK9ZjkyYjNp7uREAcKpcN3vQK2konMeSc1jUq6oNSd_eCeYHDcM_dAvbPVNuBB11DG1doBex56EGHakF-Gob6USlHQFxHL8ZO5eUJ2nBh7m8tJkO0F3MMzeGmG7uNiXBCkHUI7IMZL1Q1tZzyZWfAV11DakRbUfPi-o5Kth15Ae4zwuo5edRqCYshKY83vKK9HMEh9TPIA7jRWhNWT4xRwO_VR5zWSb43AMm-cPg9d36ajB9p5Ow81dQdE64tEfTg0ZaExCg6UGrc0jN147H6dSnQeum86eV-gLUUZqcLMMw-TJaU0TKFiIuF-hpNbPvfksrtDPCvmLcRLajjdEdFFrOthIxQ&sai=AMfl-YTO7KtBvf-awOLoEH7L7t9I7Bj1ji9XGUlQfqUEydV-IfxsevFc-0UWF7DEFK114z2-AfYoeWRNMuSTO6nGv_e7ivn5dSCXTqiErmGVJWlGfIHb3oQwaJQH6ZdDi9Y&sig=Cg0ArKJSzIYyUuI71jPrEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 smb-dispAd_300x250_single.js Show response
saambaa.com/widget/gpt/300x250/assets/ Frame AD9F 44 KB
15 KB 137ms
28ms Script
application/javascript 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: cbb895c1ccd2586317a06e57f212c4a1d239da751732876b466e698328c35470

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
last-modified: Tue, 25 Apr 2023 23:55:29 GMT
server: Microsoft-IIS/8.5
etag: "80eebc69d177d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
accept-ranges: bytes
access-control-allow-headers: content-type
content-length: 14831

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AD9F 169 KB
52 KB 38ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
479 B 288ms
287ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=4237945932532382&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=37&adks=2128035842&sfv=1-0-40&ris=1&rcs=5&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D6%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3D291d27313eb66c50243129b23df8a579%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D10%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%26hb_bidder%3Dappnexus%26hb_adid%3D86ca6052547a1bb%26hb_opt%3D0.04%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D348ebee37f9fa5e%26lb%3D24%26reqt%3D1684132281040&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132281064&lmt=1684132281&dlt=1684132272249&idt=516&adxs=495&adys=215&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvgBbmfOSO_cuNXDYs0AT4Y5d9TvROFOCRJ4J3MPhQJGEzFO3fzNfTmCApvxebKWWD9T8XwxX9tU_Yd_%2CABHeCvhqxxNnUPIrZxjWRSq1tyOGXAvhHNSrzjic_GBSGQRLfL1qrV03Dgt_lYDX2Zjh0i1gBkIM7Fz9Yb68&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bc706515287beadc0c8031969bec4c2e795855f1d33c36043330100be269b51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 442
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 0DCB
Redirect Chain

https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3D9f8a1b797ed0ff89
https://u-iad04.e-planning.net/um?uid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&dc=0abbcb4eba840e59&fi=9f8a1b797ed0ff89

42 B
103 B

26ms
25ms

Image
image/gif

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?uid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&dc=0abbcb4eba840e59&fi=9f8a1b797ed0ff89
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://u-iad04.e-planning.net/um?uid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&dc=0abbcb4eba840e59&fi=9f8a1b797ed0ff89
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 0DCB
Redirect Chain

https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeebd%26fi%3D9f8a1b797ed0ff89%26uid%3D%24%7BUID%7D
https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=9f8a1b797ed0ff89&uid=81afd20c-3804-0880-26ce-2dd22feddbd2

42 B
104 B

79ms
21ms

Image
image/gif

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=9f8a1b797ed0ff89&uid=81afd20c-3804-0880-26ce-2dd22feddbd2
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://u-iad04.e-planning.net/um?dc=ff96d1aa62deeebd&fi=9f8a1b797ed0ff89&uid=81afd20c-3804-0880-26ce-2dd22feddbd2
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 145

GET
H2 200 lotame20230117.js Show response
s.e-planning.net/esb/4/0/1992d/876bf12ed75fef1e/ Frame 0DCB 676 B
575 B 85ms
23ms Script
application/x-javascript 172.98.26.241
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/876bf12ed75fef1e/lotame20230117.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.241 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 631e4c0cb82e03a77dbf7111e8303534d183747050352701d0483b4bdbd3ec81

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
last-modified: Tue, 17 Jan 2023 20:00:05 GMT
server: openresty
etag: W/"63c6fe45-2a4"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Sat, 13 May 2028 06:31:20 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 0DCB
Redirect Chain

https://prebid-match.dotomi.com/match/bounce/current?networkId=72582&version=1&rurl=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dfbb23d0ef33aad5d%26fi%3D9f8a1b797ed0ff89%26uid%3D
https://prebid-match.dotomi.com/match/bounce/current?DotomiTest=4281d1cb08de232a&is_secure=true&networkId=72582&version=1&rurl=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Dfbb23d0ef33aad5d%26fi...
https://u-iad04.e-planning.net/um?dc=fbb23d0ef33aad5d&fi=9f8a1b797ed0ff89&uid=AAAF0Jyv4amSfwMUoYlFAAAAAAA&expiration=1684218681&is_secure=true

42 B
103 B

22ms
22ms

Image
image/gif

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=fbb23d0ef33aad5d&fi=9f8a1b797ed0ff89&uid=AAAF0Jyv4amSfwMUoYlFAAAAAAA&expiration=1684218681&is_secure=true
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://u-iad04.e-planning.net/um?dc=fbb23d0ef33aad5d&fi=9f8a1b797ed0ff89&uid=AAAF0Jyv4amSfwMUoYlFAAAAAAA&expiration=1684218681&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

um
u-iad04.e-planning.net/ Frame 0DCB
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3D9f8a1b797ed0ff89%26uid%3D%24UID
https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=9f8a1b797ed0ff89&uid=2829111677345209672

42 B
103 B

22ms
22ms

Image
image/gif

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=9f8a1b797ed0ff89&uid=2829111677345209672
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fc59c480-7f6a-44c3-ab94-cb5d7c75ea04
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://u-iad04.e-planning.net/um?dc=8103fa85295fbe60&fi=9f8a1b797ed0ff89&uid=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 0DCB
Redirect Chain

https://sync.go.sonobi.com/us?loc=%0A%0Ahttps%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3De52415579699e09f%26fi%3D9f8a1b797ed0ff89%26uid%3D%5BUID%5D
https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=9f8a1b797ed0ff89&uid=277a2357-1e32-4313-9dd0-85518179de6d

42 B
103 B

23ms
23ms

Image
image/gif

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=9f8a1b797ed0ff89&uid=277a2357-1e32-4313-9dd0-85518179de6d
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://u-iad04.e-planning.net/um?dc=e52415579699e09f&fi=9f8a1b797ed0ff89&uid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
u-iad04.e-planning.net/ Frame 0DCB
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3De64f73568d2b3c34%26fi%3D9f8a1b797ed0ff89%26uid%3D%24UID&partner=eplanning
https://ce.lijit.com/merge?pid=279534&3pid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNI...
https://ssp.disqus.com/match?bidder=12&buyeruid=GpfHAPZHSyvkYo7GRcqvmKxM&r=Cid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg4MmQQ____________ASp1aHR0cHM6Ly91LWlhZDA0LmUtcGxhbm5pbmcubmV0L3VtP2RjPW...
https://bh.contextweb.com/bh/rtset?pid=562894&ev=1&us_privacy=&rurl=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D29%26buyeruid%3D%25%25VGUID%25%25%26r%3DCid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kN...
https://ssp.disqus.com/match?bidder=29&buyeruid=UMxte5rHSSDS&r=Cid1YS1lNGE0NDU3ZS0xYzU2LTM1MmItOGZjNy1kNDQ2NzBjNjg4MmQQ____________ASp1aHR0cHM6Ly91LWlhZDA0LmUtcGxhbm5pbmcubmV0L3VtP2RjPWU2NGY3MzU2OG...
https://u-iad04.e-planning.net/um?dc=e64f73568d2b3c34&fi=9f8a1b797ed0ff89&uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d

42 B
103 B

25ms
22ms

Image
image/gif

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=e64f73568d2b3c34&fi=9f8a1b797ed0ff89&uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

location: https://u-iad04.e-planning.net/um?dc=e64f73568d2b3c34&fi=9f8a1b797ed0ff89&uid=ua-e4a4457e-1c56-352b-8fc7-d44670c6882d
pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

um
sync.e-planning.net/ Frame 0DCB
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=H7IJBRjH
https://sync.e-planning.net/um?uid=79897214-8af9-48b5-85a2-26f1235a2a79&dc=769fefa8321c94fb&iss=1

42 B
104 B

76ms
22ms

Image
image/gif

172.98.26.245
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=79897214-8af9-48b5-85a2-26f1235a2a79&dc=769fefa8321c94fb&iss=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 172.98.26.245 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

location: https://sync.e-planning.net/um?uid=79897214-8af9-48b5-85a2-26f1235a2a79&dc=769fefa8321c94fb&iss=1
date: Mon, 15 May 2023 06:31:21 GMT
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F763 34 KB
10 KB 274ms
188ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66784
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H3 200 audio_022.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 53ms
53ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_022.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b446f6d49e8511ce9a9f15e486dfe0a5e99d532f1f0877ac65233818f2512f4f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YoEtoVZ9JbLiraTVMI4lEjOGkGj8AYctSItPR0kDPZdTRjQTQDl7OnIhRgA%2BI83jYpskcYIxiRoKg24bLctS9dINIQ3QEvR2g6SMMM%2BM462a3nYZOP6VenQUUqIyWKctiVe5y9L8Uc2OsB46G4oqsSVX"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795664cc745437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40638

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_022.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 140 KB
141 KB 35ms
35ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_022.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ffc58439ddf5ab7957caba2744ec1c2dc6fb52dc86c914558a54b1be005c6fd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VR49aebvlYaGGwK1rMD%2FhiOsbEEdehdsFRIIQlVdcSZ%2BVA5WZsvvxl7Kj2h7efaCrcOVkTj4sUkekm9%2BpTACEW6LuB3EKH3ra7SHWmD311pSr7TtJ6MCsTqBskMGoUAxM0QXIQbMnnicl2z2og%2BiXqfc"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795664cc775437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 143383

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 761D
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1684132280935.1&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26pre...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=1---&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D25%26external_user_...

16 KB
6 KB

30ms
21ms

Document
text/html

23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=1---&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33841
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Mon, 15 May 2023 06:31:20 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=1---&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP008
x-33x-status: 40000000008200000A

GET
H3

200

cm Show response
us-u.openx.net/w/1.0/ Frame ED65
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1684132280935.5&ri=70&ru=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fcm%3Fid%3Dc6a5ba0d-ce02-41bd-a1ea-842c68bd5108%26ph%3D8f5ed5d4-642c-4222-968a-d...
https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privac...

1 KB
699 B

18ms
14ms

Document
text/html

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: c3413aadbe427a7665d61ca9c9ed12f6275445c174b6a2f53b901496ce1c683e

Request headers

Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 680
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Mon, 15 May 2023 06:31:21 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP011
x-33x-status: 40000000008200000A

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame D914
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=1---
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1686724281%26external_user_id%3Dcb640652-5013-46a4-8cfe-1b84d3b7b490
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1686724281&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490

68 B
225 B

67ms
27ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1686724281&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
referrer-policy: unsafe-url
server: 33XP011
x-33x-status: 40000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1686724281&external_user_id=cb640652-5013-46a4-8cfe-1b84d3b7b490
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame D914
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1684132280935.3&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A...
https://ssum-sec.casalemedia.com/usermatchredir?s=191740&us_privacy=1---&cb=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D2%26external_user_id%3D
https://events-ssc.33across.com/match?liv=g&us_privacy=1---&bidder_id=2&external_user_id=ZGHRseRl8.SUQDBYssPdFQAA%261358

68 B
82 B

28ms
28ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=g&us_privacy=1---&bidder_id=2&external_user_id=ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://events-ssc.33across.com/match?liv=g&us_privacy=1---&bidder_id=2&external_user_id=ZGHRseRl8.SUQDBYssPdFQAA%261358
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

match
events-ssc.33across.com/ Frame D914
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=104&us_privacy=1---&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D1---%26xi%3D45%26xu%3D%7BuserId%7D
https://ssc-cms.33across.com/ps/?us_privacy=1---&xi=45&xu=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341
https://events-ssc.33across.com/match?bidder_id=45&external_user_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&ts=1684132281&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---

68 B
82 B

35ms
26ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=45&external_user_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&ts=1684132281&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
referrer-policy: unsafe-url
server: 33XP012
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=45&external_user_id=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&ts=1684132281&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame D914
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=33across&us_privacy=1---
https://ssc-cms.33across.com/ps/?xi=120&xu=fxwlYUubUiBvJ8uiP7oHl5U4mbc&us_privacy=1---
https://events-ssc.33across.com/match?bidder_id=120&external_user_id=fxwlYUubUiBvJ8uiP7oHl5U4mbc&ts=1684132281&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---

68 B
82 B

29ms
27ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=120&external_user_id=fxwlYUubUiBvJ8uiP7oHl5U4mbc&ts=1684132281&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://de.tynt.com/deb/?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
referrer-policy: unsafe-url
server: 33XP016
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=120&external_user_id=fxwlYUubUiBvJ8uiP7oHl5U4mbc&ts=1684132281&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
22ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMzQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjA5NzY1OTIyLCJjcmVhdGl2ZV9pZCI6MTM4NDIxMDAzNzMwLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjcyNjg2NTU3NDIxNjQzMzUiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctbGFyZ2UtYmlsbGJvYXJkLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTM0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjIwOTc2NTkyMiwiY3JlYXRpdmVfaWQiOjEzODQyMTAwMzczMCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjhjNWZmZWZiMTIyZjU5YTY2YThiNzY3MmQ0NDUyYWYyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MjY4NjU1NzQyMTY0MzM1IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAzNiwiYWRfcG9zaXRpb24iOjExMzQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDM2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDA3LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjYyMDk3NjU5MjIsImNyZWF0aXZlX2lkIjoxMzg0MjEwMDM3MzAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MjY4NjU1NzQyMTY0MzM1IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEzNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjYyMDk3NjU5MjIsImNyZWF0aXZlX2lkIjoxMzg0MjEwMDM3MzAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODQyMTAwMzczMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMzQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjA5NzY1OTIyLCJjcmVhdGl2ZV9pZCI6MTM4NDIxMDAzNzMwLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI2MjA5NzY1OTIyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

GET
H3 200 6209765922 Show response
go.ezodn.com/dac/ 0
596 B 56ms
53ms XHR
text/plain 2606:4700:e4::ac40:a702
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/6209765922
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/porpoiseant/banger.js?cb=195-0&bv=226&v=74&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a702 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Sun, 14 May 2023 15:58:49 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZdYkbqvXhxQHWLTbyLTzXxQMnHq3IWfu7tr1ix64SF8bfgbBH38oWZfbWTe3FOFu6mbcZDfxdXVEimaQQbRmrbAqTyWV67XBR8wMuSBhXVf6CXBc1YQAYw0mZmEWSy4DctrvVwW8yXc2%2FJs%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 7c7956650b8f196c-EWR
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMzQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjA5NzY1OTIyLCJjcmVhdGl2ZV9pZCI6MTM4NDIxMDAzNzMwLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNS0xNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjYifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:20 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:20 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYXVjdGlvbl9lcG9jaCI6MTY4NDEzMjI4MSwiYWRfcG9zaXRpb24iOjExMzQsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MzAwLCJiaWRfZmxvb3JfcHJldiI6NzAsImJpZF9mbG9vcl9maWxsZWQiOjM2LCJhdWN0aW9uX2NvdW50Ijo1LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0OTEsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NjIwOTc2NTkyMn1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame DDB7
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=eplanning_east&endpoint=us-east
https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east

281 B
554 B

309ms
118ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:21 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:21 GMT
location: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2960 16 KB
6 KB 30ms
23ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D9f8a1b797ed0ff89%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33841
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usermatch Show response
ssum.casalemedia.com/ Frame 9F88 1 KB
2 KB 59ms
20ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: a209c67065d1477f6b8d61bfee888c3f339c5aaff40abf77810402c907f8ccbf

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1534
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:21 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 navegg_2022_01_br.html Show response
i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/ Frame B0EA 1 KB
1011 B 401ms
115ms Document
text/html 205.234.175.175
CACHENETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 Cantonment, United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=157680000
cf4age: 0
cf4ttl: 157680000.000
content-encoding: gzip
content-length: 624
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
etag: W/"61ddbb71-5f5"
expires: Tue, 09 Nov 2027 12:27:06 GMT
last-modified: Tue, 11 Jan 2022 17:16:33 GMT
server: CFS 0215
x-cf-rand: 21.090
x-cf-reqid: b381d4ade00717f1b3f12110507b415e
x-cf-tsc: 1668083227
x-cf1: 29080:fA.waw1:co:1585621119:cacheN.waw1-01:H
x-cf2: H
x-cf3: M
x-cff: B

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 4E9B 2 KB
814 B 13ms
10ms Document
text/html 51.222.39.184
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5927d926323dc2c

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.184 , Canada, ASN16276 (OVH, FR),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 / Show response
spl.zeotap.com/ Frame 7410 6 KB
2 KB 122ms
121ms Document
text/html 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f328d432129fd307effced0690a9232a87c552bb5a59257ccad84b92f6127415

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://ads.us.e-planning.net
cf-cache-status: DYNAMIC
cf-ray: 7c795665186ea22f-YYZ
content-encoding: br
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
server: cloudflare
vary: Origin
via: 1.1 google

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjoxMDA1MSwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjIxODUyNDUwMywiY3JlYXRpdmVfaWQiOjEzODQyNjA2MDc1MSwiZGF0YSI6W3sibmFtZSI6InN0YXRfc291cmNlX2lkIiwidmFsIjoiMTAwNTEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame 8E87 72 KB
29 KB 214ms
214ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?cb=window._mNDetails.$5l&&vi=1684132281392029508&gdpr=0&tsce=L134&cid=8CUB63XV6&cpcd=KE0AsG8DGEMdDVtigXq1ZA%3D%3D&crid=714553356&size=250x250&cc=CA&sc=QC&chnm=HARMONY&pid=8POL131U0&tpid=TR615X7&https=1&rrr=tzR-hLcl-L8bcTWiOzF6p_TZc8O9nl3lT0gvXuQrOXo%3D&ekwrf=w77EQ%3ASSQB8k7YmeJQ.Gjmy&nse=5&lw=1&ugd=4&adt1=8CUPV1T76&adt2=559647184&bae=B4qNB/gqx/&ebdata=~G-MjJzviXX~G8Ov9.ui9~G-M1QzvuFfhF~G-My8zQxv9~G-M81GvVKRuioi~G-M8z7YOv9~G-MLwvHhr4gEdWqR~G-MLENv999999u~G-MQ8lJvfX9-fX9~G-M7Y1-vuX9~G-M7YjMQxkk8-vS~N875vcaI_D4KT~ONvyNEoxQoJ1Q7uoO~OYYMOufvu~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvX9~OYYMOuiv9u99~OYYMOfv_~OYYMOfuvou~OYYMOffv9.9A~OYYMOfHvX~OYYMOfXvOJkMOJk~OYYMOfiv9.99~OYYMOAFvIK~OYYMOAhv_~OYYMOHvu9~OYYMOH9v9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~OYYMOXfv9.99~OYYMjv9.9A9~OYYMYuv9.uXi~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FWF~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Xfh~OYYMYfv9.9HH~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfivu.999~OYYMYAvu.999~OYYMYA9vu.999~OYYMYAHvu.999~OYYMYAivX.999~OYYMYH9vX.999~OYYMYHAvA.uuu~OYYMYXvu.9HW~OYYMYXfv9.Fi9~OYYMYFvu.999~OYYMYhv9.FXH~OYYMYivu.999~OYYMLv9.Xfh~JMLEYv9.uXi~JLEYv9.uXi~wNv9n%2Bn9~875EJv0D4RVr~LMNNv%3DK~LM8EvuHi.XF.uXA.uWA~LMQNvg%3D~LGmvXMA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~Q7OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~x1wv78ku_lHtCZoUluN~QxEEj5M71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~1YEvu~NGOEv9.uHH~OYYvw1LYmz5~Qx8Ov~O7NvJ1Q7MQN~EmQv9~O1jyvOJk1xj7~w7Yjvu~QmGEv9.9u~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.ui9~1NM75EJvu~875EJM8OvA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~N1LL8JLVOv9~ONx7vfX~OmyGv9ou~8GNvu~&bdrId=262&ntv=0&sff=0&mcf=29069&katpre=1&katbid=-102&ydspr=1&pgid=p11333325165t202305150631&essld=uHi.XF.uXA.uWA~%3DK~g%3D~Ymz7LJ1j&htmlsrc=1&cadomain=lgMuBvgWMtEPFFUHYKLFMsI9piUHGFf_A7lgt1vs6uQ%3D&isid=1&allsc=QC

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CUB63XV6&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

080176367a2168df6675d71f0c22ef6892508cb7d9559f00c607efbf03f6cda4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 28952
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
expires: Mon, 15 May 2023 06:31:21 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 21-v295

GET
H2 200 bping.php
lg3.media.net/ Frame 8D0D 35 B
185 B 45ms
27ms Image
image/gif 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=2059&&vgd_cdv=951&vgd_tsce=L134&vgd_cage=2&vgd_chkp=9028221|14014||&vgd_mcf=29069&gdpr=0&prid=8PRVCXX19&cid=8CUB63XV6&crid=714553356&vi=1684132281392029508&ugd=4&lf=6&kwrf=https%3A%2F%2Fswiftmoves.blog&cc=CA&sc=QC&vsid=3271338731455172&lper=100&wsip=170785070&r=1684132281161&requrl=https%3A%2F%2Fswiftmoves.blog&vgde_bdata=~G-MjJzviXX~G8Ov9.ui9~G-M1QzvuFfhF~G-My8zQxv9~G-M81GvVKRuioi~G-M8z7YOv9~G-MLwvHhr4gEdWqR~G-MLENv999999u~G-MQ8lJvfX9-fX9~G-M7Y1-vuX9~G-M7YjMQxkk8-vS~N875vcaI_D4KT~ONvyNEoxQoJ1Q7uoO~OYYMOufvu~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvX9~OYYMOuiv9u99~OYYMOfv_~OYYMOfuvou~OYYMOffv9.9A~OYYMOfHvX~OYYMOfXvOJkMOJk~OYYMOfiv9.99~OYYMOAFvIK~OYYMOAhv_~OYYMOHvu9~OYYMOH9v9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~OYYMOXfv9.99~OYYMjv9.9A9~OYYMYuv9.uXi~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FWF~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Xfh~OYYMYfv9.9HH~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfivu.999~OYYMYAvu.999~OYYMYA9vu.999~OYYMYAHvu.999~OYYMYAivX.999~OYYMYH9vX.999~OYYMYHAvA.uuu~OYYMYXvu.9HW~OYYMYXfv9.Fi9~OYYMYFvu.999~OYYMYhv9.FXH~OYYMYivu.999~OYYMLv9.Xfh~JMLEYv9.uXi~JLEYv9.uXi~wNv9n%2Bn9~875EJv0D4RVr~LMNNv%3DK~LM8EvuHi.XF.uXA.uWA~LMQNvg%3D~LGmvXMA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~Q7OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~x1wv78ku_lHtCZoUluN~QxEEj5M71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~1YEvu~NGOEv9.uHH~OYYvw1LYmz5~Qx8Ov~O7NvJ1Q7MQN~EmQv9~O1jyvOJk1xj7~w7Yjvu~QmGEv9.9u~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.ui9~1NM75EJvu~875EJM8OvA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~N1LL8JLVOv9~ONx7vfX~OmyGv9ou~8GNvu~&ssld=%7B%22QQ8E%22%3A%22uHi.XF.uXA.uWA%22%2C%22QQNN%22%3A%22%3DK%22%2C%22QQQN%22%3A%22g%3D%22%2C%22QQN75%22%3A%22Ymz7LJ1j%22%7D&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=16276&vgd_rakh=1684132280153540831&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUPV1T76&vgd_hb_audit_2=559647184&vgd_pgid=p11333325165t202305150631&vgd_pgids=1&vgd_uspa=0&hvsid=00001684132281155025035145512883&gdpr=0&vgd_l2type=scs_newfl&vgd_end=1

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 2D97 33 KB
11 KB 59ms
59ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUPV1T76&prvid=2034%2C2055%2C2030%2C294%2C251%2C175%2C450%2C233%2C157%2C2028%2C2027%2C159%2C214%2C236%2C2069%2C237%2C338%2C459%2C97%2C55%2C99%2C77%2C56%2C2022%2C262%2C461%2C222%2C201%2C2039%2C4%2C203%2C446%2C10000%2C80%2C229%2C9%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9ed0b842052a1e4d0904c66e09f1aec74a6a26fd9059409461a1394f82490332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11386
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:21 GMT
expires: Wed, 17 May 2023 06:31:21 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
DATA 200
OK truncated
/ Frame 11CD 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b65129dc2a8ddc7732208fb17330d2f29fa15d28bc773bb8fc6101df2c5bb36e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 match
events-ssc.33across.com/ Frame ED65 68 B
82 B 29ms
28ms Image
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?liv=g&us_privacy=1---&bidder_id=70&external_user_id=ce1a51ad-5f10-0b86-2175-e217a4e28b00
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED65
Redirect Chain

https://px.owneriq.net/eox
https://us-u.openx.net/w/1.0/sd?id=537073059&val=Q7374186771452294615P

43 B
61 B

13ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073059&val=Q7374186771452294615P
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://us-u.openx.net/w/1.0/sd?id=537073059&val=Q7374186771452294615P
Content-Type: text/html
Cache-Control: max-age=12969
Connection: keep-alive
Content-Length: 154

GET
H2 204 CookieSyncOpenX
rtb.adentifi.com/ Frame ED65 0
34 B 32ms
23ms Image
text/plain 3.212.118.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncOpenX
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.118.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-118-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT

GET
H2 204 /
csync.loopme.me/ Frame ED65 0
156 B 297ms
96ms Image
text/plain 35.214.153.92
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://csync.loopme.me/?partner_id=1285&vt=5dd07193-274b-0fec-1049-e6b71e11816d&gdpr=0
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.214.153.92 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS: 92.153.214.35.bc.googleusercontent.com
Software: _ /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
server: _

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED65
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=b9f5c7de-85f6-48cc-ba86-351b90373b6b&r=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db12%26redirect%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%2...
https://a.tribalfusion.com/i.match?p=b12&redirect=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537141727%26val%3D%24TF_USER_ID_ENC%24&u=b14a2c7e-14e4-02f7-3a19-53205c68e163
https://us-u.openx.net/w/1.0/sd?id=537141727&val=18072662102567755307

43 B
61 B

39ms
39ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537141727&val=18072662102567755307
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 4288
content-type: text/html
location: https://us-u.openx.net/w/1.0/sd?id=537141727&val=18072662102567755307
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7c795666dd14715a-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
sync.targeting.unrulymedia.com/csync/ Frame ED65
Redirect Chain

https://sync.1rx.io/usersync/openx/2b474da1-fa2e-0902-1daf-b42f080e5523
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

43 B
452 B

30ms
29ms

Image
image/gif

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED65
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ox
https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAC5aU7Iw6MAACKiklmZXA

43 B
61 B

19ms
14ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAC5aU7Iw6MAACKiklmZXA
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537125688&val=AAC5aU7Iw6MAACKiklmZXA
Date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2 200 cksync.php
contextual.media.net/ Frame ED65 61 B
480 B 73ms
64ms Image
image/gif 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=opx&ovsid=705d345c-2a9b-0189-2e0d-93a91c598b83

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED65
Redirect Chain

https://oxp.mxptint.net/OpenX.ashx
https://us-u.openx.net/w/1.0/sd?id=537116306&val=R35CA5_102B27654_9C620B87

43 B
61 B

15ms
14ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537116306&val=R35CA5_102B27654_9C620B87
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537116306&val=R35CA5_102B27654_9C620B87
Date: Mon, 15 May 2023 06:31:20 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-367137032; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 195
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK sync
s.cpx.to/ Frame ED65 95 B
586 B 412ms
99ms Image
image/png 54.171.41.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.cpx.to/sync?dsp_uid=f84c71d0-bd33-0766-2fd4-156baf2106dd&dsp=OPENX
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.41.112 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-41-112.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

p3p: CP="NOI DEV ADM"
Date: Mon, 15 May 2023 06:31:21 GMT
Content-Type: image/png
Connection: keep-alive
Content-Length: 95
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED65
Redirect Chain

https://i.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
https://us-u.openx.net/w/1.0/sd?id=537072979&val=WDaPIhCo1PYrJO5

43 B
61 B

12ms
12ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072979&val=WDaPIhCo1PYrJO5
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-036ce2552879161b4@us-east-1b@dxedge-app-us-east-1-prod-asg
Location: https://us-u.openx.net/w/1.0/sd?id=537072979&val=WDaPIhCo1PYrJO5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6E06 143 B
166 B 40ms
38ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=2751417950&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132279942&bpp=11&bdt=131&idt=646&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=316049107.1684132281&ga_sid=1684132281&ga_hid=486890624&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=31071756%2C44719339%2C44788442%2C44790154&oid=2&pvsid=3738170952900814&tmod=1216205239&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&cms=2&fu=4&bc=31&ifi=1&uci=1.iqw71zd6mwhg&fsb=1&dtd=661
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 496
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:23:05 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B252 1 KB
643 B 36ms
35ms Document
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 45959
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 14 May 2023 17:45:22 GMT
etag: 48472445140208031
expires: Mon, 15 May 2023 17:45:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9F88
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=oya52_Ej7du4JruO8HGi2K0n64y4Ib6P9nAcGr9f

43 B
632 B

55ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=oya52_Ej7du4JruO8HGi2K0n64y4Ib6P9nAcGr9f
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=oya52_Ej7du4JruO8HGi2K0n64y4Ib6P9nAcGr9f
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 9F88
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=189a1818-f2ea-11ed-9e3b-e9c9016fe91b

43 B
632 B

54ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=189a1818-f2ea-11ed-9e3b-e9c9016fe91b
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: Cowboy
content-type: image/gif
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=189a1818-f2ea-11ed-9e3b-e9c9016fe91b
access-control-allow-origin: *
p3p: CP="NOI OTC OTP OUR NOR"
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx: lga-delivery-8
content-length: 0
expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 9F88
Redirect Chain

https://match.deepintent.com/usersync/113
https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_c03d2db792a3476da7342

43 B
632 B

68ms
22ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_c03d2db792a3476da7342
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_c03d2db792a3476da7342
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif
server: c
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 9F88
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=WDaPIhCo1PYrJO5

43 B
632 B

66ms
20ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=WDaPIhCo1PYrJO5
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:20 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-09713965a967c7b7b@us-east-1e@dxedge-app-us-east-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=WDaPIhCo1PYrJO5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 9F88
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

18ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame 9F88 0
34 B 24ms
22ms Image
text/plain 3.212.118.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.118.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-118-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9F88
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=0093361a-c7f5-c829-d6d7dd82

43 B
632 B

59ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=0093361a-c7f5-c829-d6d7dd82
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: nginx/1.24.0
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=0093361a-c7f5-c829-d6d7dd82
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 9F88
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=d4913566-b629-4f71-b374-716a359efae6

43 B
632 B

64ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=d4913566-b629-4f71-b374-716a359efae6
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

x-servername: Track004-iad
pragma: no-cache
date: Mon, 15 May 2023 06:30:51 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=d4913566-b629-4f71-b374-716a359efae6
cache-control: private,no-cache
content-length: 222
expires: -1

GET
H2 200 um
u-iad04.e-planning.net/ Frame 9F88 42 B
103 B 23ms
22ms Image
image/gif 172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-iad04.e-planning.net/um?dc=99e41df815fd80b4&fi=9f8a1b797ed0ff89&uid=ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

GET
H3 200 match Show response
events-ssc.33across.com/ Frame 2DC7 68 B
82 B 27ms
27ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=g&us_privacy=1---&bidder_id=25&external_user_id=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=1---&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D1---%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google

GET
H2 200 um Show response
u-iad04.e-planning.net/ Frame 8613 42 B
103 B 23ms
22ms Document
image/gif 172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://u-iad04.e-planning.net/um?dc=a208d9366469aa64&fi=9f8a1b797ed0ff89&uid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-iad04.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D9f8a1b797ed0ff89%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
server: openresty

GET
DATA 200
OK truncated
/ Frame 8208 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 092988217c622d21d86a730db7b7d8210614701f353bb2dd6755258ebf0f20b2

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame 7410 0
0 57ms
22ms Image
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://pixel.tapad.com/idsync/ex/push?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26...
https://sync.mathtag.com/sync/img?mt_exid=10072&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3D2989%26partner_device_id%3D%5BMM_UUID%5D%26pt%3Dc141b74b-22ea-414f-bc66-57...
https://pixel.tapad.com/idsync/ex/receive?partner_id=2989&partner_device_id=102b6461-d1b1-4f00-b06c-5186e28fb05c&pt=c141b74b-22ea-414f-bc66-57ef6830a0e2%2Chttps%253A%252F%252Fmwzeom.zeotap.com%252F...
https://mwzeom.zeotap.com/mw?cid=c141b74b-22ea-414f-bc66-57ef6830a0e2&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9...

95 B
152 B

149ms
143ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=c141b74b-22ea-414f-bc66-57ef6830a0e2&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c7956687c3fa22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://mwzeom.zeotap.com/mw?cid=c141b74b-22ea-414f-bc66-57ef6830a0e2&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 403 /
dmp.adform.net/serving/cookie/match/ Frame 7410 0
453 B 23ms
10ms Image
text/plain 185.167.164.43
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1105&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.43 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dffc2d86c-12a5-4e03-47c8-0df47aa91f4c%26reqId%3Dc...
https://mwzeom.zeotap.com/mw?cid=cb640652-5013-46a4-8cfe-1b84d3b7b490&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9...

95 B
152 B

120ms
120ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=cb640652-5013-46a4-8cfe-1b84d3b7b490&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795667cb53a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://mwzeom.zeotap.com/mw?cid=cb640652-5013-46a4-8cfe-1b84d3b7b490&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 481

GET
H2 200 cm
trc.taboola.com/sg/zeotap/1/ Frame 7410 0
77 B 37ms
14ms Image
text/plain 2a04:4e42:200::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/zeotap/1/cm?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 varnish
x-cache-hits: 0
server: nginx
x-timer: S1684132281.453743,VS0,VE9
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-served-by: cache-yul12834-YUL

GET
H/1.1 200
OK u
dmp.v.fwmrm.net/ad/ Frame 7410 0
411 B 366ms
25ms Image
text/html 2600:1f18:6593:f601:8729:44f1:1075:68b9
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.v.fwmrm.net/ad/u?mode=echo&cr=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1368%26env%3DmWeb%26cid%3D%23%7Buser.id%7D%26gdpr%3D%24%7BGDPR_ENFORCED%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:6593:f601:8729:44f1:1075:68b9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Content-Type: text/html
P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"
Cache-Control: no-store
Connection: keep-alive
Keep-Alive: timeout=300
Content-Length: 0
Expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=0&gdpr_consent=&rd=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1384%26env%3DmWeb%26cid%3D%23PM_USER_ID%26env%3DmWeb%26eventType%3Dmap...
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&cid=41DA1833-16BC-41FB-8168-95B4325D28EC&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec...

95 B
152 B

116ms
116ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&cid=41DA1833-16BC-41FB-8168-95B4325D28EC&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795667cb4fa22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&cid=41DA1833-16BC-41FB-8168-95B4325D28EC&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
date: Mon, 15 May 2023 06:31:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=136...
https://mwzeom.zeotap.com/mw?cid=393fb6b7-750b-45e7-80b8-29ec4f5df270&zpartnerid=317&gdpr=1&gdpr_consent=

95 B
152 B

118ms
117ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=393fb6b7-750b-45e7-80b8-29ec4f5df270&zpartnerid=317&gdpr=1&gdpr_consent=
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795669cdc3a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=393fb6b7-750b-45e7-80b8-29ec4f5df270&zpartnerid=317&gdpr=1&gdpr_consent=
pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3D...
https://mwzeom.zeotap.com/mw?cid=24598744723586606653258633915388414695&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-...

95 B
152 B

118ms
118ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=24598744723586606653258633915388414695&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795668fccba22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

DCS: dcs-prod-usw2-2-v044-07cd81ee9.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: LWqpEAVAQk0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://mwzeom.zeotap.com/mw?cid=24598744723586606653258633915388414695&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%25%25COOKIE%25%25%26env%3DmWeb%26zpartnerid%3D563%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_con...
https://mwzeom.zeotap.com/mw?cid=7233293034697980059&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-...

95 B
152 B

116ms
116ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=7233293034697980059&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c7956696d57a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?cid=7233293034697980059&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Date: Mon, 15 May 2023 06:31:21 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://idsync.frontend.weborama.fr/ids?key=zeotap&value=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://idsync.frontend.weborama.fr/ids?key=zeotap&value=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://mwzeom.zeotap.com/mw?webouuid=X8y7Dk6tVTBmI2s4ZMKHR.&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48...

95 B
152 B

125ms
120ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?webouuid=X8y7Dk6tVTBmI2s4ZMKHR.&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c7956692d0ba22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
last-modified: Mon, 15 May 2023 06:31:21 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
location: https://mwzeom.zeotap.com/mw?webouuid=X8y7Dk6tVTBmI2s4ZMKHR.&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://sync.smartadserver.com/getuid?gdpr=0&gdpr_consent=&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D[sas_uid]%26zpartnerid%3D592%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%...
https://sync.smartadserver.com/getuid?gdpr=0&gdpr_consent=&url=https://mwzeom.zeotap.com/mw?cid=[sas_uid]&zpartnerid=592&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8...
https://mwzeom.zeotap.com/mw?cid=4857008915831342889

95 B
152 B

121ms
120ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=4857008915831342889
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795669bdb6a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=4857008915831342889
date: Mon, 15 May 2023 06:31:21 GMT
content-length: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://bcp.crwdcntrl.net/map/c=13620/tp=ZEOT/tpid=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_con...
https://mwzeom.zeotap.com/mw?pid=2b4a87d68532b3eaa7060bc993b85a18&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57...

95 B
152 B

120ms
120ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?pid=2b4a87d68532b3eaa7060bc993b85a18&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795667cb54a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://mwzeom.zeotap.com/mw?pid=2b4a87d68532b3eaa7060bc993b85a18&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
cache-control: no-cache
x-server: 10.40.33.218
content-length: 0
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ZTAP
https://ups.analytics.yahoo.com/ups/58697/cms?partner_id=ZTAP
https://mwzeom.zeotap.com/mw?cid=y-Pj.oZANE2ooJm1JyyyBNNpCRvLAtNEJfvg--~A&zpartnerid=570&env=mWeb

95 B
152 B

135ms
134ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=y-Pj.oZANE2ooJm1JyyyBNNpCRvLAtNEJfvg--~A&zpartnerid=570&env=mWeb
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c7956685c05a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=y-Pj.oZANE2ooJm1JyyyBNNpCRvLAtNEJfvg--~A&zpartnerid=570&env=mWeb
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=CAN&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zd...
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=CAN&zdid=1361&cid=Tvxa%2Beapk5r7oO1IIkfouIl30kyLBALw%2BS41iYitP1U%3D

95 B
152 B

124ms
123ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=CAN&zdid=1361&cid=Tvxa%2Beapk5r7oO1IIkfouIl30kyLBALw%2BS41iYitP1U%3D
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795667eb89a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 3b3cb210495e4d1678591271d0921206.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: ORD52-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=CAN&zdid=1361&cid=Tvxa%2Beapk5r7oO1IIkfouIl30kyLBALw%2BS41iYitP1U%3D
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: 0OGIacZLAkiFwlrCEHtP-MQLei3h5v3plOYnUFAIxeD-A_owYrvsiQ==
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://odr.mookie1.com/t/v2?tagid=V2_746632&src.visitorId=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&gdpr=0&gdpr_consent=&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df...
https://mwzeom.zeotap.com/mw?zpartnerid=993&env=mWeb&cid=10599080989829358732&zdid=1361&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&w_k=${w_k}&user_zi=${user_zi}&optin=${optin}&uc=${uc}&z_p=${z_p}&g...

95 B
151 B

123ms
123ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=993&env=mWeb&cid=10599080989829358732&zdid=1361&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&w_k=${w_k}&user_zi=${user_zi}&optin=${optin}&uc=${uc}&z_p=${z_p}&gdpr=0&gdpr_consent=
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795667db68a22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://mwzeom.zeotap.com/mw?zpartnerid=993&env=mWeb&cid=10599080989829358732&zdid=1361&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&w_k=${w_k}&user_zi=${user_zi}&optin=${optin}&uc=${uc}&z_p=${z_p}&gdpr=0&gdpr_consent=
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 7410 0
336 B 39ms
18ms Image
text/plain 35.168.219.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=141838&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.219.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-219-4.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-served-by: beacon-n015-ash-prod.krxd.net
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, no-cache, no-store
x-request-time: D=29 t=1684132281
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 7410
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_co...
https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=ZGHRsQAKKKWZKgAp&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72e...

95 B
152 B

118ms
118ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=ZGHRsQAKKKWZKgAp&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c795667cb5aa22f-YYZ
access-control-allow-headers: *
content-length: 95

Redirect headers

x-served-by: cache-yul12825-YUL
pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1684132281.459796,VS0,VE15
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=ZGHRsQAKKKWZKgAp&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 7410
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
https://mwzeom.zeotap.com/mw?zpartnerid=768&cid=PjiyHUxC&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c

0
336 B

24ms
24ms

Image
text/plain

35.168.219.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 35.168.219.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-219-4.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-served-by: beacon-n024-ash-prod.krxd.net
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, no-cache, no-store
x-request-time: D=81 t=1684132281
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html; charset=utf-8
location: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c7956682bd5a22f-YYZ
access-control-allow-headers: *

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame 7410
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c...
https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c...

43 B
568 B

117ms
111ms

Image
image/gif

67.220.228.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361&dcc=t

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

HTTP/1.1

Server

67.220.228.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: N2WSYKWFJSZC9XC13VHH
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: J1ACBNSYBJJQ6Y3Q18KX
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 400 87734
tags.bluekai.com/site/ Frame 7410 0
145 B 140ms
117ms Image
text/plain 23.192.32.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/87734?id=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1202%26env%3DmWeb%26cid%3D%24_BK_UUID%26BK_SWAP_DEST%3D87734&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.32.8 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-32-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-length: 0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2 200 mw
mwzeom.zeotap.com/ Frame 7410 95 B
169 B 122ms
121ms Image
image/png 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1353&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=ffc2d86c-12a5-4e03-47c8-0df47aa91f4c&reqId=c6b8ec48-57e9-48b9-50cc-72ec5c042bde&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 7c7956672aaca22f-YYZ
access-control-allow-headers: *
content-length: 95

GET
DATA 200
OK truncated
/ Frame AD9F 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97e1483fdb7e2f05f7cb8dc808e250386b72ceb3b71cff1a0c4b4a40e21597ae

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sync Show response
gum.criteo.com/ Frame 2D97 88 B
328 B 28ms
28ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUPV1T76&prvid=2034%2C2055%2C2030%2C294%2C251%2C175%2C450%2C233%2C157%2C2028%2C2027%2C159%2C214%2C236%2C2069%2C237%2C338%2C459%2C97%2C55%2C99%2C77%2C56%2C2022%2C262%2C461%2C222%2C201%2C2039%2C4%2C203%2C446%2C10000%2C80%2C229%2C9%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5e5e72969c44bc77098b64ca28cb8dcad80d2d75ae4f04ebf0ab124a9dd48e12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 2070178
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame EE75
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

131ms
83ms

Document
text/html

23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUPV1T76&prvid=2034%2C2055%2C2030%2C294%2C251%2C175%2C450%2C233%2C157%2C2028%2C2027%2C159%2C214%2C236%2C2069%2C237%2C338%2C459%2C97%2C55%2C99%2C77%2C56%2C2022%2C262%2C461%2C222%2C201%2C2039%2C4%2C203%2C446%2C10000%2C80%2C229%2C9%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:21 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 15 May 2023 06:31:21 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C46E 16 KB
6 KB 35ms
30ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3271338731455172000V10%26type%3Dpba%26refUrl%3D%26vid%3D41322814003271338731455172000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUPV1T76&prvid=2034%2C2055%2C2030%2C294%2C251%2C175%2C450%2C233%2C157%2C2028%2C2027%2C159%2C214%2C236%2C2069%2C237%2C338%2C459%2C97%2C55%2C99%2C77%2C56%2C2022%2C262%2C461%2C222%2C201%2C2039%2C4%2C203%2C446%2C10000%2C80%2C229%2C9%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33841
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:21 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 2D97
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3271338731455172000V10%26type%3Dmma%26refUrl%3D%26vid%3D413228140032713387314551...
https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=mma&refUrl=&vid=41322814003271338731455172000V10&ovsid=102b6461-d1b1-4f00-b06c-5186e28fb05c

61 B
481 B

133ms
131ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=mma&refUrl=&vid=41322814003271338731455172000V10&ovsid=102b6461-d1b1-4f00-b06c-5186e28fb05c

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: MT3 851 9bd98ae master ord-pixel-x35 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=mma&refUrl=&vid=41322814003271338731455172000V10&ovsid=102b6461-d1b1-4f00-b06c-5186e28fb05c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:20 GMT

GET
H2

200

cksync
cs.media.net/ Frame 2D97
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=9&google_nid=media&google_cm=1&google_hm=MzI3MTMzODczMTQ1NTE3MjAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=9&google_gid=CAESEPWyEBEBu5roUTGZeL25urw&google_cver=1

61 B
462 B

65ms
65ms

Image
image/gif

23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=9&google_gid=CAESEPWyEBEBu5roUTGZeL25urw&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUPV1T76&prvid=2034%2C2055%2C2030%2C294%2C251%2C175%2C450%2C233%2C157%2C2028%2C2027%2C159%2C214%2C236%2C2069%2C237%2C338%2C459%2C97%2C55%2C99%2C77%2C56%2C2022%2C262%2C461%2C222%2C201%2C2039%2C4%2C203%2C446%2C10000%2C80%2C229%2C9%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: H2
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=9&google_gid=CAESEPWyEBEBu5roUTGZeL25urw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 2D97
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3271338731455172000V10%26type%3Ddxu%26refUrl%3D%26vid%3D41322814003271338731455...
https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=dxu&refUrl=&vid=41322814003271338731455172000V10&ovsid=WDaPIhCo1PYrJO5

61 B
468 B

130ms
127ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=dxu&refUrl=&vid=41322814003271338731455172000V10&ovsid=WDaPIhCo1PYrJO5

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:20 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-016e5baf0f24031cb@us-east-1e@dxedge-app-us-east-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=dxu&refUrl=&vid=41322814003271338731455172000V10&ovsid=WDaPIhCo1PYrJO5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 2D97
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=27cd68b1-129c-4085-9a2d-9eea4f28994c

61 B
632 B

83ms
80ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=27cd68b1-129c-4085-9a2d-9eea4f28994c

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:20 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=27cd68b1-129c-4085-9a2d-9eea4f28994c
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1078938
content-length: 0
expires: Mon, 15 May 2023 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 2D97
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=medianet&ssp_user_id=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-80B7Sp9E2pmyo61swvy8kPkQx5MatsV5cWFcjg--~A&expires=5&ssp=medianet
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=

61 B
481 B

57ms
57ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=&gdpr_pd=
Date: Mon, 15 May 2023 06:31:21 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 2D97
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__https%3A%2F%2Fcontextual.media.net%2Fcksync.php...
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2MJGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJXM5YXKSZRGRHEQQZXI4ZGUZKJNJTGY...
https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=413228140032713387314551...

60 B
307 B

41ms
41ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322814003271338731455172000V10&vsid=3271338731455172000V10

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 60
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:21 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322814003271338731455172000V10&vsid=3271338731455172000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 284
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 2D97
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3271338731455172000V10
https://contextual.media.net/cksync.php?type=mf&ovsid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&cs=1

61 B
481 B

126ms
125ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=mf&ovsid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&cs=1

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

location: //contextual.media.net/cksync.php?type=mf&ovsid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe&cs=1
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 css
fonts.googleapis.com/ Frame AD9F 6 KB
706 B 61ms
50ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,700

Requested by

Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 04:36:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 select.css
saambaa.com/widget/gpt/300x250/assets/ Frame AD9F 1006 B
806 B 44ms
27ms Stylesheet
text/css 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://saambaa.com/widget/gpt/300x250/assets/select.css
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: f9d9c7a87c8d45bf544e7e77ebd3e5ca06c28c690e4c36bf6def49fa95326941

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
last-modified: Mon, 26 Jun 2017 22:37:38 GMT
server: Microsoft-IIS/8.5
etag: "02525d0cceed21:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: no-cache
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
accept-ranges: bytes
access-control-allow-headers: content-type
content-length: 645

GET
H2 200 smb-dispVidAd_300x250s.css
saambaa.com/widget/gpt/300x250/assets/ Frame AD9F 11 KB
3 KB 45ms
27ms Stylesheet
text/css 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispVidAd_300x250s.css
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d684a474ab9335f706f8a5962de2f314f82a29403609b8c3d3bfff696f85b39f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
last-modified: Thu, 27 Apr 2023 16:27:35 GMT
server: Microsoft-IIS/8.5
etag: "8075692c2579d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: no-cache
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
accept-ranges: bytes
access-control-allow-headers: content-type
content-length: 3062

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/161763/8209/ Frame AD9F 233 KB
78 KB 42ms
25ms Script
application/javascript 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/161763/8209/pwt.js
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 00df4c71abce5525e275be8f94ee32a07ffbeea94226e8096bbb432e3928e8b1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 01:09:13 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=167010
accept-ranges: bytes
content-length: 78875
expires: Wed, 17 May 2023 04:54:51 GMT

GET
H2 200 0 Show response
api.saambaa.com/properties/widgetconfig/300x250/partner/swiftmoves.blog/platform/ Frame AD9F 4 KB
2 KB 98ms
81ms Script
application/javascript 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.saambaa.com/properties/widgetconfig/300x250/partner/swiftmoves.blog/platform/0?callback=__smbcfgldr300x250373521
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 7ac55ef44ef3195ef21b00b98554ce26daad8ff3d10992817fa6cfd3633bdd59

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
server: Microsoft-IIS/8.5
x-powered-by: ASP.NET
content-length: 1557
vary: Accept-Encoding
content-type: application/javascript

GET
H3 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame AD9F 74 KB
25 KB 58ms
47ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

958c5c608f86222b0961cff34c0904354e3548fc7dec894cfd654348764d8cb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25235
x-xss-protection: 0
server: cafe
etag: 643 / 19492 / m202305090101 / config-hash: 12209807291441061903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 saambaa_prebid.js Show response
saambaa.com/assets/js/ Frame AD9F 373 KB
116 KB 69ms
54ms Script
application/javascript 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://saambaa.com/assets/js/saambaa_prebid.js
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: f67aeaa72f3d47e55fb2b4d3ae23a5635be6c480cea318e99ae1c820a1ff1819

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:19 GMT
content-encoding: gzip
last-modified: Fri, 13 Jan 2023 22:44:40 GMT
server: Microsoft-IIS/8.5
etag: "07c09fa027d91:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
accept-ranges: bytes
access-control-allow-headers: content-type
content-length: 118327

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame AD9F 51 KB
20 KB 49ms
39ms Script
text/javascript 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 15 May 2023 04:59:57 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 5484
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 15 May 2023 06:59:57 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame AD9F 100 KB
39 KB 56ms
41ms Script
application/javascript 2607:f8b0:400c:c38::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js

Requested by

Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c38::61 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ccd2f5d0a7605365bff5f81535edae34a80da808619486ddcc56c40ec1920765

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39924
x-xss-protection: 0
last-modified: Mon, 15 May 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame AD9F 360 KB
120 KB 55ms
42ms Script
text/javascript 2607:f8b0:400c:c14::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c14::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fca970e379ea0c0d2aca05506e906a4dd475a4acf7f8767187c84d71c2014322

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122883
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H/1.1 200
OK sovrn_standalone_beacon.js Show response
ap.lijit.com/www/sovrn_beacon_standalone/ Frame AD9F 6 KB
3 KB 83ms
23ms Script
text/javascript 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/www/sovrn_beacon_standalone/sovrn_standalone_beacon.js?iid=13401719
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: 61daa507d9f04c912f80dbd2d3c6277a6d24a2f56799db29ddde6729c19dd332

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 May 2023 18:01:56 GMT
Server: nginx
ETag: W/"64593914-17e9"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Access-Control-Allow-Methods: GET
Cache-Control: max-age=604800, must-revalidate
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires: Mon, 22 May 2023 06:31:21 GMT

GET
H2 200 sync Show response
eb2.3lift.com/ Frame B697 1 KB
2 KB 29ms
24ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 52934520bc3393c615034367eaf9bbee3e37c29a58de84be63894014a3f38576

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1216
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:21 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame 787B 43 B
453 B 21ms
17ms Document
image/gif 23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=307971&extuid=ACNSlLs8lNhsJw%2fM
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:21 GMT
Etag: 89635513e8a94d67
Server: Adtelligent

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame B8EB
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=VpfbHUC29S3305XiHykA&pi=admatic

43 B
473 B

100ms
100ms

Document
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=VpfbHUC29S3305XiHykA&pi=admatic
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:21 GMT
Etag: df0275a16e30f174
Server: Adtelligent

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Mon, 15 May 2023 06:31:21 GMT Mon, 15 May 2023 06:31:21 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=VpfbHUC29S3305XiHykA&pi=admatic
pragma: no-cache

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame 6F49
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7246762434369164995

43 B
472 B

89ms
33ms

Document
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7246762434369164995
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:21 GMT
Etag: df0275a16e30f174
Server: Adtelligent

Redirect headers

content-length: 0
content-type: text/plain
date: Mon, 15 May 2023 06:31:21 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307457&extuid=7246762434369164995
server: nginx

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame 1545
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D743845%26extuid%3D%24UID
https://sync.console.adtarget.com.tr/csync?t=a&ep=743845&extuid=7246762434369164995

43 B
472 B

91ms
36ms

Document
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=743845&extuid=7246762434369164995
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Content-Length: 43
Content-Type: image/gif
Date: Mon, 15 May 2023 06:31:21 GMT
Etag: df0275a16e30f174
Server: Adtelligent

Redirect headers

content-length: 0
content-type: text/plain
date: Mon, 15 May 2023 06:31:21 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=743845&extuid=7246762434369164995
server: nginx

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 47ED
Redirect Chain

https://sync.console.adtarget.com.tr/csync?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D318342%26extuid%3D%7Buid%7D
https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=df0275a16e30f174

43 B
453 B

18ms
17ms

Image
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=df0275a16e30f174
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: Adtelligent
Etag: 89635513e8a94d67
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=df0275a16e30f174
Date: Mon, 15 May 2023 06:31:21 GMT
Server: Adtelligent
Etag: df0275a16e30f174
Content-Length: 0

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v46/ Frame 8208 29 KB
29 KB 45ms
37ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v46/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45a61a04904fc2115c440a349a65dc93d2965b0b24dc5a8172bd8b792bdbf103

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 23:26:01 GMT
x-content-type-options: nosniff
age: 25520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29728
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 16:59:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 May 2024 23:26:01 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEO1d49wvkM82EdlF4-6m6R0&google_cver=1&google_push=ATf1kGNVdbryhZP908Enpw9-JsiNJgjcraogdNVWuM187ctSUIZfi6Ko_IL0Ow8ENcwYL3d0OcasIDv1XoleoM6A...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=ECtkYdGxTwCwbFGG4o-wXA&google_push=ATf1kGNVdbryhZP908Enpw9-JsiNJgjcraogdNVWuM187ctSUIZfi6Ko_IL0Ow8ENcwYL3d0OcasIDv1XoleoM6AWy2ZR_2qTBY

170 B
188 B

41ms
41ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=ECtkYdGxTwCwbFGG4o-wXA&google_push=ATf1kGNVdbryhZP908Enpw9-JsiNJgjcraogdNVWuM187ctSUIZfi6Ko_IL0Ow8ENcwYL3d0OcasIDv1XoleoM6AWy2ZR_2qTBY

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
Server: MT3 851 9bd98ae master ord-pixel-x1 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=ECtkYdGxTwCwbFGG4o-wXA&google_push=ATf1kGNVdbryhZP908Enpw9-JsiNJgjcraogdNVWuM187ctSUIZfi6Ko_IL0Ow8ENcwYL3d0OcasIDv1XoleoM6AWy2ZR_2qTBY
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:20 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENsRfUJ2Ytw3_cYu0eO0rfo&google_cver=1&google_push=ATf1kGMlrW7besX6FGlEOWEzlsRsNQRD6-PADCeFffARaX4GsuNHEfEKt3MyYPCA9C_Uudqh7A3yJWTa...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzI0Njc2MjQzNDM2OTE2NDk5NQ&google_push=ATf1kGMlrW7besX6FGlEOWEzlsRsNQRD6-PADCeFffARaX4GsuNHEfEKt3MyYPCA9C_Uudqh7A3yJW...

170 B
188 B

39ms
38ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzI0Njc2MjQzNDM2OTE2NDk5NQ&google_push=ATf1kGMlrW7besX6FGlEOWEzlsRsNQRD6-PADCeFffARaX4GsuNHEfEKt3MyYPCA9C_Uudqh7A3yJWTaqTMuSU-g1je5gDs4_1w

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzI0Njc2MjQzNDM2OTE2NDk5NQ&google_push=ATf1kGMlrW7besX6FGlEOWEzlsRsNQRD6-PADCeFffARaX4GsuNHEfEKt3MyYPCA9C_Uudqh7A3yJWTaqTMuSU-g1je5gDs4_1w
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHR-Yapps6-Yd6fNakSUlNQ&google_cver=1&google_push=ATf1kGNFOkZoYMTv5kfoeXyG7q2WqcVQ5-jAmi0L-l9v7gDw00JAy99DxIK4sa1g0M534GxDMGJ_j5QyXnNSmNU...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=fxwlYUubUiBvJ8uiP7oHl5U4mbc&google_push=ATf1kGNFOkZoYMTv5kfoeXyG7q2WqcVQ5-jAmi0L-l9v7gDw00JAy99DxIK4sa1g0M534GxDMGJ_j5QyXnNSmN...

170 B
188 B

39ms
38ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=fxwlYUubUiBvJ8uiP7oHl5U4mbc&google_push=ATf1kGNFOkZoYMTv5kfoeXyG7q2WqcVQ5-jAmi0L-l9v7gDw00JAy99DxIK4sa1g0M534GxDMGJ_j5QyXnNSmNUm-HL1T9bbQZg

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=fxwlYUubUiBvJ8uiP7oHl5U4mbc&google_push=ATf1kGNFOkZoYMTv5kfoeXyG7q2WqcVQ5-jAmi0L-l9v7gDw00JAy99DxIK4sa1g0M534GxDMGJ_j5QyXnNSmNUm-HL1T9bbQZg
Date: Mon, 15 May 2023 06:31:21 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEFTA_4aklhvfhGKHpv13Cxk&google_cver=1&google_push=ATf1kGOKXjmzCOVz-H4uuWckBpDNIF5vPv-Q510TGa9MzWXsmnazL910FBgEIHmRvVZXo1-1iemiVBvUjefbKmqe...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=be13326f&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ATf1kGOKXjmzCOVz-H4uuWckBpDNIF5vPv-Q510TGa9MzWXs...

170 B
188 B

42ms
41ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=be13326f&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ATf1kGOKXjmzCOVz-H4uuWckBpDNIF5vPv-Q510TGa9MzWXsmnazL910FBgEIHmRvVZXo1-1iemiVBvUjefbKmqeYfIHOGr7Zc19

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
via: 1.1 e82b003e5929abce569292fc53dbf254.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: CMH68-P2
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_hm=be13326f&google_redir=https%3A%2F%2Fs.ad.smaato.net%2Fc%2F%3FadExInit%3Dg&google_push=ATf1kGOKXjmzCOVz-H4uuWckBpDNIF5vPv-Q510TGa9MzWXsmnazL910FBgEIHmRvVZXo1-1iemiVBvUjefbKmqeYfIHOGr7Zc19
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: tLvszTpTyNDGPUAlywhJgghZuJlFxCwD2NPmXSm6D4aLak8RJV5JWg==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEM6yJmz8HNiGBuy-wZlGfos&google_cver=1&google_push=ATf1kGOz4O8u7bVEqL34iqp7ZbJgWlBxZSGeubsJ_Nn3YuczxHtZB5OdvCGgNylOsSvDk3JHJBL5itzLkBq6r5lyIplfPBdEbDbW
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGOz4O8u7bVEqL34iqp7ZbJgWlBxZSGeubsJ_Nn3YuczxHtZB5OdvCGgNylOsSvDk3JHJBL5itzLkBq6r5lyIplfPBdEbDbW&google_hm=Z2IwZjhhMzgwOGEwZDE5...

170 B
188 B

40ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGOz4O8u7bVEqL34iqp7ZbJgWlBxZSGeubsJ_Nn3YuczxHtZB5OdvCGgNylOsSvDk3JHJBL5itzLkBq6r5lyIplfPBdEbDbW&google_hm=Z2IwZjhhMzgwOGEwZDE5ZGI2YTA=

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGOz4O8u7bVEqL34iqp7ZbJgWlBxZSGeubsJ_Nn3YuczxHtZB5OdvCGgNylOsSvDk3JHJBL5itzLkBq6r5lyIplfPBdEbDbW&google_hm=Z2IwZjhhMzgwOGEwZDE5ZGI2YTA=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFaa3Rm6f5u2tdjpBVH8VN8&google_cver=1&google_push=ATf1kGOKNiNvmWKBQekAbam6dj2pgbVhwNuPuaiRfA0KUC14Kcnxkh5CVX3ZicWYIbTe1voAilpKiZEaaCSo0WGT92lQLr6Durz8
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D&google_push=ATf1kGOKNiNvmWKBQekAbam6dj2pgbVhwNuPuaiRfA0KUC14Kcnxkh5C...

170 B
188 B

41ms
41ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D&google_push=ATf1kGOKNiNvmWKBQekAbam6dj2pgbVhwNuPuaiRfA0KUC14Kcnxkh5CVX3ZicWYIbTe1voAilpKiZEaaCSo0WGT92lQLr6Durz8

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D&google_push=ATf1kGOKNiNvmWKBQekAbam6dj2pgbVhwNuPuaiRfA0KUC14Kcnxkh5CVX3ZicWYIbTe1voAilpKiZEaaCSo0WGT92lQLr6Durz8
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B252
Redirect Chain

https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEM96UpDct_uMMA1SRS2DgE&google_cver=1&google_push=ATf1kGOnoNpkKtkP_Dy-c4UrDzlEzf43u3av34COJysPlf3hwR14OR7djQf3i2C6Rd_oc-XVE4A6kigRAKdcm8TqF...
https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEM96UpDct_uMMA1SRS2DgE&google_cver=1&google_push=ATf1kGOnoNpkKtkP_Dy-c4UrDzlEzf43u3av34COJysPlf3hwR14OR7djQf3i2C6Rd_oc-XVE4A6kigRAKdcm8TqF...
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MTc5NzZlMjk3MDI1YjAwYg&google_push=ATf1kGOnoNpkKtkP_Dy-c4UrDzlEzf43u3av34COJysPlf3hwR14OR7djQf3i2C6Rd_oc-XVE4A6kigRAKdcm8TqFOwHgl69...

170 B
188 B

40ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MTc5NzZlMjk3MDI1YjAwYg&google_push=ATf1kGOnoNpkKtkP_Dy-c4UrDzlEzf43u3av34COJysPlf3hwR14OR7djQf3i2C6Rd_oc-XVE4A6kigRAKdcm8TqFOwHgl69Z2N0JQ

Requested by

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
location: https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MTc5NzZlMjk3MDI1YjAwYg&google_push=ATf1kGOnoNpkKtkP_Dy-c4UrDzlEzf43u3av34COJysPlf3hwR14OR7djQf3i2C6Rd_oc-XVE4A6kigRAKdcm8TqFOwHgl69Z2N0JQ
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B252 0
12 B 43ms
37ms Image
text/html 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KykExIjFTFHI31cc6W8LzgGNT5xgREEq6TsSs21elndycQU4qzSYHhgqCe8WNuOi_yyZsb5Q

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 8E87 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8E87 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8E87 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Raleway-bold.woff
contextual.media.net/__media__/fonts/Raleway-bold/ Frame 8E87 31 KB
31 KB 27ms
26ms Font
font/woff 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/Raleway-bold/Raleway-bold.woff

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?cb=window._mNDetails.$5l&&vi=1684132281392029508&gdpr=0&tsce=L134&cid=8CUB63XV6&cpcd=KE0AsG8DGEMdDVtigXq1ZA%3D%3D&crid=714553356&size=250x250&cc=CA&sc=QC&chnm=HARMONY&pid=8POL131U0&tpid=TR615X7&https=1&rrr=tzR-hLcl-L8bcTWiOzF6p_TZc8O9nl3lT0gvXuQrOXo%3D&ekwrf=w77EQ%3ASSQB8k7YmeJQ.Gjmy&nse=5&lw=1&ugd=4&adt1=8CUPV1T76&adt2=559647184&bae=B4qNB/gqx/&ebdata=~G-MjJzviXX~G8Ov9.ui9~G-M1QzvuFfhF~G-My8zQxv9~G-M81GvVKRuioi~G-M8z7YOv9~G-MLwvHhr4gEdWqR~G-MLENv999999u~G-MQ8lJvfX9-fX9~G-M7Y1-vuX9~G-M7YjMQxkk8-vS~N875vcaI_D4KT~ONvyNEoxQoJ1Q7uoO~OYYMOufvu~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvX9~OYYMOuiv9u99~OYYMOfv_~OYYMOfuvou~OYYMOffv9.9A~OYYMOfHvX~OYYMOfXvOJkMOJk~OYYMOfiv9.99~OYYMOAFvIK~OYYMOAhv_~OYYMOHvu9~OYYMOH9v9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~OYYMOXfv9.99~OYYMjv9.9A9~OYYMYuv9.uXi~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FWF~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Xfh~OYYMYfv9.9HH~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfivu.999~OYYMYAvu.999~OYYMYA9vu.999~OYYMYAHvu.999~OYYMYAivX.999~OYYMYH9vX.999~OYYMYHAvA.uuu~OYYMYXvu.9HW~OYYMYXfv9.Fi9~OYYMYFvu.999~OYYMYhv9.FXH~OYYMYivu.999~OYYMLv9.Xfh~JMLEYv9.uXi~JLEYv9.uXi~wNv9n%2Bn9~875EJv0D4RVr~LMNNv%3DK~LM8EvuHi.XF.uXA.uWA~LMQNvg%3D~LGmvXMA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~Q7OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~x1wv78ku_lHtCZoUluN~QxEEj5M71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~1YEvu~NGOEv9.uHH~OYYvw1LYmz5~Qx8Ov~O7NvJ1Q7MQN~EmQv9~O1jyvOJk1xj7~w7Yjvu~QmGEv9.9u~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.ui9~1NM75EJvu~875EJM8OvA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~N1LL8JLVOv9~ONx7vfX~OmyGv9ou~8GNvu~&bdrId=262&ntv=0&sff=0&mcf=29069&katpre=1&katbid=-102&ydspr=1&pgid=p11333325165t202305150631&essld=uHi.XF.uXA.uWA~%3DK~g%3D~Ymz7LJ1j&htmlsrc=1&cadomain=lgMuBvgWMtEPFFUHYKLFMsI9piUHGFf_A7lgt1vs6uQ%3D&isid=1&allsc=QC

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e789f7935d6d7776a0c2341570220c445bc1c493381518c085e641f9128b8938

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?cb=window._mNDetails.$5l&&vi=1684132281392029508&gdpr=0&tsce=L134&cid=8CUB63XV6&cpcd=KE0AsG8DGEMdDVtigXq1ZA%3D%3D&crid=714553356&size=250x250&cc=CA&sc=QC&chnm=HARMONY&pid=8POL131U0&tpid=TR615X7&https=1&rrr=tzR-hLcl-L8bcTWiOzF6p_TZc8O9nl3lT0gvXuQrOXo%3D&ekwrf=w77EQ%3ASSQB8k7YmeJQ.Gjmy&nse=5&lw=1&ugd=4&adt1=8CUPV1T76&adt2=559647184&bae=B4qNB/gqx/&ebdata=~G-MjJzviXX~G8Ov9.ui9~G-M1QzvuFfhF~G-My8zQxv9~G-M81GvVKRuioi~G-M8z7YOv9~G-MLwvHhr4gEdWqR~G-MLENv999999u~G-MQ8lJvfX9-fX9~G-M7Y1-vuX9~G-M7YjMQxkk8-vS~N875vcaI_D4KT~ONvyNEoxQoJ1Q7uoO~OYYMOufvu~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvX9~OYYMOuiv9u99~OYYMOfv_~OYYMOfuvou~OYYMOffv9.9A~OYYMOfHvX~OYYMOfXvOJkMOJk~OYYMOfiv9.99~OYYMOAFvIK~OYYMOAhv_~OYYMOHvu9~OYYMOH9v9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~OYYMOXfv9.99~OYYMjv9.9A9~OYYMYuv9.uXi~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FWF~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Xfh~OYYMYfv9.9HH~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfivu.999~OYYMYAvu.999~OYYMYA9vu.999~OYYMYAHvu.999~OYYMYAivX.999~OYYMYH9vX.999~OYYMYHAvA.uuu~OYYMYXvu.9HW~OYYMYXfv9.Fi9~OYYMYFvu.999~OYYMYhv9.FXH~OYYMYivu.999~OYYMLv9.Xfh~JMLEYv9.uXi~JLEYv9.uXi~wNv9n%2Bn9~875EJv0D4RVr~LMNNv%3DK~LM8EvuHi.XF.uXA.uWA~LMQNvg%3D~LGmvXMA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~Q7OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~x1wv78ku_lHtCZoUluN~QxEEj5M71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~1YEvu~NGOEv9.uHH~OYYvw1LYmz5~Qx8Ov~O7NvJ1Q7MQN~EmQv9~O1jyvOJk1xj7~w7Yjvu~QmGEv9.9u~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.ui9~1NM75EJvu~875EJM8OvA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~N1LL8JLVOv9~ONx7vfX~OmyGv9ou~8GNvu~&bdrId=262&ntv=0&sff=0&mcf=29069&katpre=1&katbid=-102&ydspr=1&pgid=p11333325165t202305150631&essld=uHi.XF.uXA.uWA~%3DK~g%3D~Ymz7LJ1j&htmlsrc=1&cadomain=lgMuBvgWMtEPFFUHYKLFMsI9piUHGFf_A7lgt1vs6uQ%3D&isid=1&allsc=QC
Origin: https://contextual.media.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-cache-hits: 0
unused62: 8096267
date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 31940
expires: Tue, 16 May 2023 06:31:21 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame DDB7 34 KB
10 KB 72ms
71ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66784
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
354 B

26ms
26ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&dongle=0cfd&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 251

GET
H2

200

ebda
eb2.3lift.com/ Frame B697
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

25ms
24ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP3e_ZKJRSwoKLyfwOQMink&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

26ms
26ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP3e_ZKJRSwoKLyfwOQMink&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEP3e_ZKJRSwoKLyfwOQMink&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B697
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D

170 B
188 B

39ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjM5NDY0NjkxMzgxNTk3MjAzNjQwOQ%3D%3D
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2394646913815972036409&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2394646913815972036409&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://eb2.3lift.com/xuid?mid=6250&xuid=isLIMember&dongle=2b63

37 B
354 B

29ms
27ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6250&xuid=isLIMember&dongle=2b63
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 20495DAB564E44E7844D8010FA6FDAD8 Ref B: YMQ01EDGE0308 Ref C: 2023-05-15T06:31:21Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://eb2.3lift.com/xuid?mid=6250&xuid=isLIMember&dongle=2b63
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX7tZpppQQj1PdBg9m1/Q==

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=2394646913815972036409&gdpr=0&gdpr_consent=
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=de3be254-7610-493f-9fd8-417164484e5f&ssp=triplelift
https://eb2.3lift.com/xuid?mid=2409&xuid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
354 B

28ms
28ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date: Mon, 15 May 2023 06:31:22 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 c.gif
c.bing.com/ Frame B697 42 B
176 B 38ms
33ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2394646913815972036409&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
last-modified: Thu, 04 May 2023 15:33:20 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1D8CF5FF99F242C5AD433B1B21C24C3B Ref B: YMQ01EDGE0620 Ref C: 2023-05-15T06:31:21Z
etag: "231a8c19d7ed91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2394646913815972036409?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-r9QznuJE2oSPuy8tEfk.QuKw9Gzyn.bSToTj_TGybg--~A&dongle=0883

37 B
354 B

26ms
25ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-r9QznuJE2oSPuy8tEfk.QuKw9Gzyn.bSToTj_TGybg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-r9QznuJE2oSPuy8tEfk.QuKw9Gzyn.bSToTj_TGybg--~A&dongle=0883
content-length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5G5TXC5KLGE2E4...
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=7gquK14NHC7G2jeIjfln

37 B
354 B

27ms
27ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=7gquK14NHC7G2jeIjfln
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Type: text/html; charset=utf-8
Location: https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=7gquK14NHC7G2jeIjfln
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 115
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame B697
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=2829111677345209672&dongle=4d58&gdpr=0&gdpr_consent=

37 B
354 B

26ms
26ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=2829111677345209672&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Mon, 15 May 2023 06:31:21 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 83b562bf-95d9-4bfd-9b24-1c7e31f02f13
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=2829111677345209672&dongle=4d58&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 um
sync.e-planning.net/ Frame B697 42 B
103 B 25ms
22ms Image
image/gif 172.98.26.245
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=2394646913815972036409&dc=4d76b6ce34af74c9&iss=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.245 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

GET
H2 200 cksync.php Show response
contextual.media.net/ Frame FFDC 61 B
483 B 64ms
64ms Document
image/gif 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.php?cs=9&vsid=3271338731455172000V10&type=pba&refUrl=&vid=41322814003271338731455172000V10&ovsid=41DA1833-16BC-41FB-8168-95B4325D28EC

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D9%26vsid%3D3271338731455172000V10%26type%3Dpba%26refUrl%3D%26vid%3D41322814003271338731455172000V10%26ovsid%3DPM_UID

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 61
content-type: image/gif
date: Mon, 15 May 2023 06:31:21 GMT
expires: Mon, 15 May 2023 06:31:21 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
x-mnet-hl2: E

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6E06
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

37ms
36ms

Document
text/html

2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:21 GMT
expires: Mon, 15 May 2023 06:31:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:21 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
574 B 178ms
178ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=3&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A950%2C%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

37d25731e89dcec2c5e4b9726e9476e52386ccf160769b6b498bb69d94e17955

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: QT5NXKY4CTACY3WEJ2XX
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: JZV_eTy2ABmMkFJuqhYk317ts-oJURKweOvwKaxEbRqfq1frb3Um9A==

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame EE75 34 KB
10 KB 51ms
50ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:21 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66784
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H2 200 log
c21lg-d.media.net/ Frame 2D97 35 B
173 B 183ms
93ms Image
image/gif 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-c&ovsid=97KCGPWyW1RMagEm6wzampA2s2NilsQ5&cs=15&vsid=3271338731455172000V10
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=9&cv=31&https=1&cid=8CUPV1T76&prvid=2034%2C2055%2C2030%2C294%2C251%2C175%2C450%2C233%2C157%2C2028%2C2027%2C159%2C214%2C236%2C2069%2C237%2C338%2C459%2C97%2C55%2C99%2C77%2C56%2C2022%2C262%2C461%2C222%2C201%2C2039%2C4%2C203%2C446%2C10000%2C80%2C229%2C9%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 15 May 2023 06:31:21 GMT
content-length: 35
content-type: image/gif

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 8E87 15 B
169 B 25ms
25ms Script
text/javascript 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=6226&&vgd_canary=0&vgd_l2type=scs_newfl&fp=IF_djNIN3LUZWUC7rFjRXceWoKhL9IR9nt0zApMx4rORXELFkHEf9jVcwfe-Hr1KjSJmr-o7uj4_7EmfnZWcyg4wVIPL0luew5HS1Q230YaZ90MGMs7J_LpLafiRtRmNjgoBYEFgbBQ%3D&cme=3kiHF7szZnmIuYinoF0ApBUBgC9cXyrmBypYu85gI-ElB6mHA9-rZS5ASeGMIph8Pa8GgzbOesJ06CP5eiXyUF46p6SV9TByE9SXe6BX3WFY_OcaChdFEMn4F_H-IN-0e5WlSA3LLTRlR3QnzAcgNUUVJnzSmMq4oLT0tieHVx1mXEB3FXfWTy2devWSFB4mzzH9y7Lk8eyPDN8JCaPdoycNh8zvFDr6OxkQcMsjXTI%3D%7C%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD5LG6jnmUPSIlSOiDFYWuQlnZju29L30hQ%3D%7Cxrl5Md8q4-82o9yDSEd74YZHZRz_Ypqu4VPEaTlw94c%3D%7CLD7AA8QLd1YUbpDh2aF2E-jLi-uh958Gf2WmyfI1nhsEQqOYgQDwMI0wh0kZey47PcyW5i3i5tPAeRrmX6LvcgEmxuaCp2xtHIY9O78jTntXO04EDcxkuUbTAgpGDR88NlZ37u8b4U0ADqAQopfegudFeEa2i9t4Wy0WGeEF5-vJjEhIe650hB6SM-t9CzfnVy-ub-FoEATIWOIms3hiQesAdC9sJqyLnbG6SvEOn6pu4y9laI1xoNWaf1bkofgLvElBOdtS3eM%3D%7Cu8A6SM53vAfed_ZP9Ud9V9iNx7BYHn-X%7ChrJ-R_DgthXURygtgD1T8jZXBMXt-kQS%7C&subBdr=99&bdrid=262&ksu=224&fdkt=265&vgde_kbbh=fuoyxQBuG&kwd[]=5G+Towers+Near+Me&kwt[]=265&kbc[]=6071&kwp[]=1&kid[]=330222580&kbc2[]=5%3D-1%7C6%3D-1%7C16%3D-1%7C23%3D0.0564%7C24%3D498%7C25%3D0%7C22%3D0.0008%7C7%3D0.0004%7C8%3D051420%7C9%3D0%7C11%3D0%7C26%3D90459%7C27%3D3822%7C13%3D0.0826%7C14%3D051502%7C15%3D0%7C1%3D0.24%7Cr%3D1%7C60%3D0.26%7C12%3D0.24%7C2%3D0.38%7Cps%3D1.446%7C3%3D0.03%7C4%3D2.85&ktd[]=274894815488&ktrkt[]=5G+Towers+Near+Me&kwd[]=Fastest+Internet+Available+Near+Me&kwt[]=265&kbc[]=4969&kwp[]=2&kid[]=351512016&kbc2[]=5%3D-1%7C6%3D-1%7C16%3D-1%7C23%3D0.0290%7C24%3D266%7C25%3D0%7C22%3D0.0014%7C7%3D0.0002%7C8%3D051420%7C9%3D0%7C11%3D0%7C26%3D227659%7C27%3D1866%7C13%3D0.1129%7C14%3D051502%7C15%3D0%7C1%3D1.55%7Cr%3D2%7C60%3D0.60%7C12%3D1.57%7C2%3D1.89%7Cps%3D1.446%7C3%3D0.70%7C4%3D4.00&ktd[]=274894815488&ktrkt[]=Fastest+Internet+Available+Near+Me&kwd[]=Internet+Service+Providers+by+Zip+Code&kwt[]=265&kbc[]=4969&kwp[]=3&kid[]=102755934&kbc2[]=5%3D-1%7C6%3D-1%7C16%3D-1%7C23%3D0.0390%7C24%3D373%7C25%3D0%7C22%3D0.0011%7C7%3D0.0002%7C8%3D051420%7C9%3D0%7C11%3D0%7C26%3D17619%7C27%3D525%7C13%3D0.1263%7C14%3D051502%7C15%3D0%7C1%3D0.82%7Cr%3D3%7C60%3D0.34%7C12%3D0.85%7C2%3D1.43%7Cps%3D1.446%7C3%3D0.48%7C4%3D1.17&ktd[]=274894815488&ktrkt[]=Internet+Service+Providers+by+Zip+Code&kwd[]=Wireless+Internet+Connection&kwt[]=265&kbc[]=9136&kwp[]=4&kid[]=30956821&kbc2[]=5%3D-1%7C6%3D-1%7C16%3D-1%7C23%3D0.0567%7C24%3D374%7C25%3D0%7C22%3D0.0011%7C7%3D0.0003%7C8%3D051420%7C9%3D0%7C11%3D0%7C26%3D47909%7C27%3D393%7C13%3D0.0742%7C14%3D051502%7C15%3D0%7C1%3D0.82%7Cr%3D4%7C60%3D0.27%7C12%3D0.85%7C2%3D1.32%7Cps%3D1.446%7C3%3D0.12%7C4%3D1.87&ktd[]=274911592704&ktrkt[]=Wireless+Internet+Connection&kwd[]=Residential+Internet+Services&kwt[]=265&kbc[]=4969&kwp[]=5&kid[]=24310322&kbc2[]=5%3D-1%7C6%3D-1%7C16%3D-1%7C23%3D0.0656%7C24%3D148%7C25%3D0%7C22%3D0.0023%7C7%3D0.0003%7C8%3D051420%7C9%3D0%7C11%3D0%7C26%3D6567%7C27%3D144%7C13%3D0.0645%7C14%3D051502%7C15%3D0%7C1%3D0.65%7Cr%3D5%7C60%3D0.70%7C12%3D0.40%7C2%3D2.42%7Cps%3D1.446%7C3%3D0.17%7C4%3D2.58&ktd[]=274911592704&ktrkt[]=Residential+Internet+Services&v=1&geo=45.49%7C-73.58&dlper=20&lper=100&lpid=&tsid=5&hint=&cc=CA&wsip=170762978&bca=0&ugd=4&vgde_setid=Nfu&ssld=%7B%22QQNN%22%3A%22%3DK%22%2C%22QQN75%22%3A%22Ymz7LJ1j%22%2C%22QQ8E%22%3A%22uHi.XF.uXA.uWA%22%2C%22QQQN%22%3A%22g%3D%22%7D&cid=8CUB63XV6&vi=1684132281392029508&vsid=3271338731455172&tdAdd[]=asnum%3D16276&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_fm_lang=EN&vgd_implt=3&vgd_cage=3&vgd_tsce=L134-S134&vgd_l3_sc=QC&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CUPV1T76&vgd_hb_audit_2=559647184&vgd_refdomain=swiftmoves.blog&vgd_katbid=-102&vgd_pdtid=1&vgd_nrrv=1367&vgd_nrrmf=1000c80a&vgd_nrrsf=scrr&vgd_cty=montreal&vgd_ifrmode=13&vgd_l1rakh=1684132280153540831&tsrc=entity&sttm=1684132281154&upk=1684132281.11310&hvsid=00001684132281155025035145512883&verid=3111299&sbdrId=99&vgd_vsidtv=000V10&vgd_ecrid=S0300080711068100250025099999900&vgd_isiolc=1&vgd_fcm_enc_mis=1&kbbq=%26asn%3D16276&vgd_mcf=29069&vgd_vstrid=3271338731455172&vgde_bdata=~G-MjJzviXX~G8Ov9.ui9~G-M1QzvuFfhF~G-My8zQxv9~G-M81GvVKRuioi~G-M8z7YOv9~G-MLwvHhr4gEdWqR~G-MLENv999999u~G-MQ8lJvfX9-fX9~G-M7Y1-vuX9~G-M7YjMQxkk8-vS~N875vcaI_D4KT~ONvyNEoxQoJ1Q7uoO~OYYMOufvu~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvX9~OYYMOuiv9u99~OYYMOfv_~OYYMOfuvou~OYYMOffv9.9A~OYYMOfHvX~OYYMOfXvOJkMOJk~OYYMOfiv9.99~OYYMOAFvIK~OYYMOAhv_~OYYMOHvu9~OYYMOH9v9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~OYYMOXfv9.99~OYYMjv9.9A9~OYYMYuv9.uXi~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FWF~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Xfh~OYYMYfv9.9HH~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfivu.999~OYYMYAvu.999~OYYMYA9vu.999~OYYMYAHvu.999~OYYMYAivX.999~OYYMYH9vX.999~OYYMYHAvA.uuu~OYYMYXvu.9HW~OYYMYXfv9.Fi9~OYYMYFvu.999~OYYMYhv9.FXH~OYYMYivu.999~OYYMLv9.Xfh~JMLEYv9.uXi~JLEYv9.uXi~wNv9n%2Bn9~875EJv0D4RVr~LMNNv%3DK~LM8EvuHi.XF.uXA.uWA~LMQNvg%3D~LGmvXMA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~Q7OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~x1wv78ku_lHtCZoUluN~QxEEj5M71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~1YEvu~NGOEv9.uHH~OYYvw1LYmz5~Qx8Ov~O7NvJ1Q7MQN~EmQv9~O1jyvOJk1xj7~w7Yjvu~QmGEv9.9u~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.ui9~1NM75EJvu~875EJM8OvA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~N1LL8JLVOv9~ONx7vfX~OmyGv9ou~8GNvu~&vgd_bhv_kbb=-1&vgd_cfud=220406&vgd_scsver=455&vgd_optout=0&vgd_ydspr=1&vgd_rensize=250_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_l1rpth=%2Fnmedianet.js&vgd_mbr=1&vgd_pgids=1&tdAdd[]=uiparams%3D%3Brend_w%3A250%3Brend_h%3A250&vgd_uspa=0&vgd_sc=QC&vgd_l1rhst=contextual.media.net&hvsid=00001684132281155025035145512883&rc=0&rand=1684132281536&acid=4f51319245484e32b8d4ff9b61ca15a8&matm=1684132281536&vgd_ltimesrc=1&vgd_ltime=656&vgd_rtime=573&vgd_etm=13&vgd_l1hcsd=Sjxfb%7C3093&vgd_l1ch=1&vgd_lhl=1318&vgd_pgid=p11333325165t202305150631&vgd_kclkp_d=%26sgmt%3D60097%252C62146%252C100066%252C60332%252C100109%252C100111%252C100110%252C100049%252C100051%252C100087%252C100057%252C100059%252C61083&vgd_csip=rtb-common-845cdff797-pq2f2.SC&vgd_sbSup=1&vgd_vsidv=10&vgd_nrrs=1367&vgd_cdv=951&vgd_cntrdt=SL%7CDIV-rc_div-gpt-ad-swiftmoves_blog-box-1-0%7CDIV&vgd_crefurl=https%3A%2F%2Fswiftmoves.blog%2F&vgd_eadm=1&vgd_end=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Mon, 15 May 2023 06:31:21 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2

200

um
sync.e-planning.net/ Frame DDB7
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=eplanning_east&khaos=LHOGVEZ1-17-H6WS
https://sync.e-planning.net/um?uid=LHOGVEZ1-17-H6WS&dc=9bcc91305985f0db&iss=1

42 B
103 B

23ms
22ms

Image
image/gif

172.98.26.245
E-PLANNING-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=LHOGVEZ1-17-H6WS&dc=9bcc91305985f0db&iss=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_east&endpoint=us-east
Protocol: H2
Server: 172.98.26.245 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

server: openresty
date: Mon, 15 May 2023 06:31:21 GMT
content-type: image/gif

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.e-planning.net/um?uid=LHOGVEZ1-17-H6WS&dc=9bcc91305985f0db&iss=1
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c57992b917a1c5de787b922c662fdf18
Expires: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_023.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 98 KB
99 KB 38ms
38ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_023.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6efecc8da801b784af532b782d2474f8f2023a4d09ae72b0e45e70f070a522e5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ow%2Fhbqgy3Z9hXD9znjgPLhAqniySjRzvjfifjYKYkqQNzKtkDPwc16i7PFIoYG07PaFQvRGuhn6hF9hPI21j0oKHyJ1bSBaPjWmIzHFWs5FFnzaph5s3zw2TYB%2Fd2%2FbQkRLZAzrVD3%2BfTeOA%2FLpEfCqU"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795668e92c5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 100460

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/ Frame AD9F 402 KB
124 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4dc80fcaf6db01fa29ced797dbb0947bb3bb95b1a88f893f389cf17144166075

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 00:07:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23005
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127184
x-xss-protection: 0
server: cafe
etag: 3263738860219486170
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 14 May 2024 00:07:56 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ Frame AD9F 908 B
423 B 37ms
37ms XHR
application/json 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=swiftmoves.blog

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55e2c6b764474607a58c7b6925cda3f653f717e00e2977b628f73f81ffafe952

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 398
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame AD9F 202 KB
72 KB 63ms
63ms Script
application/javascript 2607:f8b0:400c:c38::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q29WX7Q7F8&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c38::61 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f2e834a5dbb62e065b9cbf6dee9c171e8b562dbc8fd45c31232ace8846118924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 74051
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ Frame AD9F 22 KB
9 KB 25ms
24ms Script
application/javascript 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
etag: "sLp6xTjO7svFVaOemhLWUQ=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Mon, 22 May 2023 06:31:21 GMT

GET
H2 200 config.js Show response
cdn.confiant-integrations.net/9tgoNyGTAZjiv_HkXoBbJClUKFo/gpt_and_prebid/ Frame AD9F 125 KB
27 KB 71ms
28ms Script
text/javascript 2606:4700:4400::6812:220a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/9tgoNyGTAZjiv_HkXoBbJClUKFo/gpt_and_prebid/config.js
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e8b8d1cebc16212f405a595582e7324226006fe9bb14cc2e50965ee0da56146

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 04:07:10 GMT
server: cloudflare
x-amz-request-id: QFGTD93ZMJ6J8YP3
age: 302
etag: W/"049486881b6bde3985fa8966d8f4db58"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=900, stale-while-revalidate=3600
cf-ray: 7c7956698a567136-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: EsjHsdnbh1tdC1aEt58f/oVp4oY0D3pwxYAYFxhNU3mcTUBEAHDCzJqUgZmNFxOGwujaecuMld8=

GET
H2 200 0 Show response
api.saambaa.com/post/storyboard/12093/market/ Frame AD9F 1 KB
813 B 130ms
30ms XHR
application/javascript 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.saambaa.com/post/storyboard/12093/market/0
Requested by: Host: saambaa.com
URL: https://saambaa.com/widget/gpt/300x250/assets/smb-dispAd_300x250_single.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 139b5bbf6aaa835413c9de4f77fac25469a9ea4976e4dbda20b29bd0e63eef81

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
content-encoding: gzip
server: Microsoft-IIS/8.5
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
content-length: 593

GET
H3 200 collect
www.google-analytics.com/ Frame AD9F 35 B
55 B 37ms
36ms Image
image/gif 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j100&a=948170489&t=pageview&_s=1&dl=https%3A%2F%2Fswiftmoves.blog%2F&dp=widget%2Fgpt%2F300x250%2Fswiftmoves.blog&ul=en-us&de=UTF-8&dt=&sd=24-bit&sr=1600x1200&vp=300x250&je=0&_u=aEAAAAABEAAAAAACIE~&cid=849453411.1684132282&tid=UA-238859058-12&_gid=1985486723.1684132282&z=948809412

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 May 2023 14:20:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 58267
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 logo-saambaa.png
saambaa.com/assets/image/ Frame AD9F 2 KB
2 KB 32ms
30ms Image
image/png 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saambaa.com/assets/image/logo-saambaa.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d33f7513fa0e7c91f0612b7ef6e44aadedc1ea2165b737d22c425835ea130b96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
last-modified: Mon, 02 Oct 2017 18:02:46 GMT
server: Microsoft-IIS/8.5
etag: "39e0e3a6a83bd31:0"
x-powered-by: ASP.NET
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
accept-ranges: bytes
access-control-allow-headers: content-type
content-length: 2412

GET
H2 200 loader-dots.gif
saambaa.com/widget/gpt/300x250/assets/ Frame AD9F 33 KB
33 KB 31ms
29ms Image
image/gif 161.47.17.28
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saambaa.com/widget/gpt/300x250/assets/loader-dots.gif
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.47.17.28 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 03aad58f643224f6ce0d2172cb2ed55ca8129bdab96873e2d4ed033972f0c800

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:20 GMT
last-modified: Mon, 26 Jun 2017 22:37:38 GMT
server: Microsoft-IIS/8.5
etag: "02525d0cceed21:0"
x-powered-by: ASP.NET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
accept-ranges: bytes
access-control-allow-headers: content-type
content-length: 33406

GET
DATA 200
OK truncated
/ Frame AD9F 690 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d6a5e09e10f94077749be842a39eccdb423df69e86b81b279683fcfc33ad443c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame AD9F 15 KB
15 KB 35ms
35ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://swiftmoves.blog
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 08:04:40 GMT
x-content-type-options: nosniff
age: 599201
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 May 2024 08:04:40 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame EE75
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&khaos=LHOGVEZ1-17-H6WS
https://contextual.media.net/cksync.php?type=rbcn&ovsid=LHOGVEZ1-17-H6WS

61 B
468 B

57ms
57ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=rbcn&ovsid=LHOGVEZ1-17-H6WS

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:21 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:21 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://contextual.media.net/cksync.php?type=rbcn&ovsid=LHOGVEZ1-17-H6WS
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Expires: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4542 15 KB
11 KB 49ms
48ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0a09687b9a868848c133fad1680ff9552b183f3ec439b4044f83d28213f9a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11322
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 40ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 35ms
32ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4542 17 KB
6 KB 38ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:21 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame AD9F 61 KB
23 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1666
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
142 B 297ms
296ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=2320137887434351&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3Dc410f2a2b0c2123f4b6651cda6c5cf53%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132281936&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=ve4_td10_tt9_pd10_la10000_er0.0.0.0_vi0.0.1200.1600_vp0_ts2_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-TWKb6gH_3MnFX.js Show response
rules.quantcount.com/ Frame AD9F 160 B
633 B 27ms
27ms Script
application/javascript 2600:9000:21b8:c200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-TWKb6gH_3MnFX.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21b8:c200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b6276bdfd4e4844bffab5fc63afcbf296b5ab01ffab5ec61c7c513ba41089d09

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 05:37:08 GMT
via: 1.1 be9e8198c11c3aefc38245bb41391566.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C1
age: 3255
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Fri, 14 Oct 2022 00:10:08 GMT
server: AmazonS3
etag: "60b74b47b16486dd7914c1bc3fe2b29f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: YIXpTkwMWQ2N4fE0tbaUss-pn2y2C-rCdrzOkhf-Fo_P8jz2ykUvLA==

GET
H2 200 300x250_oahu_v3.png
saambaa-static.azureedge.net/sidestage/ Frame AD9F 24 KB
24 KB 109ms
25ms Image
image/png 2606:2800:11f:17a5:191a:18d5:537:22f9
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saambaa-static.azureedge.net/sidestage/300x250_oahu_v3.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nya/7966) /
Resource Hash: 6d5bea8e0cdd9848eedee10232ad1498f8027e66a5d9ccee1d052622247ada7f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:22 GMT
last-modified: Thu, 27 Jan 2022 00:46:57 GMT
server: ECAcc (nya/7966)
content-md5: 6Urn8SrRgO3o0cSRdd+hrw==
age: 72601
etag: 0x8D9E12E85A19017
x-cache: HIT
content-type: image/png
x-ms-request-id: 30b9a0cc-301e-0029-624d-869b40000000
x-ms-version: 2009-09-19
accept-ranges: bytes
content-length: 24705

GET
H2 200 300x250_ak_v3.png
saambaa-static.azureedge.net/sidestage/ Frame AD9F 38 KB
39 KB 127ms
44ms Image
image/png 2606:2800:11f:17a5:191a:18d5:537:22f9
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saambaa-static.azureedge.net/sidestage/300x250_ak_v3.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nya/799F) /
Resource Hash: b7f5d70a1071fe2f8b9e45d9befbb788d9912d50f7dbc60e5728bdf837a21d08

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:22 GMT
last-modified: Thu, 27 Jan 2022 00:46:57 GMT
server: ECAcc (nya/799F)
content-md5: Brxf/5pfZY4zgW2j5iapHg==
age: 72601
etag: 0x8D9E12E859EF83D
x-cache: HIT
content-type: image/png
x-ms-request-id: f35beda5-001e-0080-6c4d-864ea8000000
x-ms-version: 2009-09-19
accept-ranges: bytes
content-length: 39311

GET
H2 200 300x250_yosemite_v3.png
saambaa-static.azureedge.net/sidestage/ Frame AD9F 34 KB
34 KB 108ms
25ms Image
image/png 2606:2800:11f:17a5:191a:18d5:537:22f9
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saambaa-static.azureedge.net/sidestage/300x250_yosemite_v3.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nya/7933) /
Resource Hash: 86741fbbd4e540c5e2a541773927159732b41034318e0e0a4a78ee2253da2eab

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:22 GMT
last-modified: Thu, 27 Jan 2022 00:46:57 GMT
server: ECAcc (nya/7933)
content-md5: 7FSdSDImvRJoVseoH9fwoQ==
age: 72601
etag: 0x8D9E12E85A47615
x-cache: HIT
content-type: image/png
x-ms-request-id: a72a21f9-301e-0044-194d-86316e000000
x-ms-version: 2009-09-19
accept-ranges: bytes
content-length: 34431

GET
H2 200 300x250_japan_v3.png
saambaa-static.azureedge.net/sidestage/ Frame AD9F 26 KB
26 KB 126ms
43ms Image
image/png 2606:2800:11f:17a5:191a:18d5:537:22f9
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://saambaa-static.azureedge.net/sidestage/300x250_japan_v3.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nya/796D) /
Resource Hash: d50cb6bda0a5fd7016cdfe46cadb1f5a517fd0135726d581dfe9826bebcd0cd0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:22 GMT
last-modified: Thu, 27 Jan 2022 00:46:57 GMT
server: ECAcc (nya/796D)
content-md5: g0ekiMWPyvO4+/SlJYqCdw==
age: 72601
etag: 0x8D9E12E859ED131
x-cache: HIT
content-type: image/png
x-ms-request-id: 3d8bc3cf-501e-0093-434d-867b49000000
x-ms-version: 2009-09-19
accept-ranges: bytes
content-length: 26484

GET
H2 200 wrap.js Show response
cdn.confiant-integrations.net/gptprebidnative/202305101013/ Frame AD9F 243 KB
75 KB 23ms
22ms Script
application/javascript 2606:4700:4400::6812:220a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/gptprebidnative/202305101013/wrap.js
Requested by: Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/9tgoNyGTAZjiv_HkXoBbJClUKFo/gpt_and_prebid/config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea6ea3a65726c9736c6f9715f39fc113bef17e87589ee3b2c220fc21f13083af

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 10 May 2023 14:31:54 GMT
server: cloudflare
x-amz-request-id: XD9AS35E2JCRA15N
age: 393845
etag: W/"a28928bd6d7de93a2507dee29a5cd32c"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7c79566a3ac57136-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: jImwZcYQNdBCm9SPFi/JTFFXdzJghzoa4xtgxcwMU6G/aVaIwNvpztqPRf+s2HOphueu3sDdpRUzkdGUtSeT+Q==

POST
H3 204 collect
www.google-analytics.com/g/ Frame AD9F 0
17 B 35ms
35ms Ping
text/plain 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Q29WX7Q7F8&gtm=45je35a0&_p=948170489&cid=1420665221.1684132273&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1684132281&sct=1&seg=0&dl=https%3A%2F%2Fswiftmoves.blog%2F&dr=https%3A%2F%2Fswiftmoves.blog%2F&dt=&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Q29WX7Q7F8&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0045 13 KB
5 KB 35ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118232
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D485 783 B
535 B 40ms
39ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

eda5dd5f83b0014160508bfd596afe1fbefd0712af652e023545f0f8da5e411a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wX2H3STJBzkgg2E8Chlltg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-wX2H3STJBzkgg2E8Chlltg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:22 GMT
expires: Mon, 15 May 2023 06:31:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 pixel;r=24179850;rf=0;a=p-TWKb6gH_3MnFX;url=https%3A%2F%2Fswiftmoves.blog%2F;ref=https%3A%2F%2Fswiftmoves.blog%2F;uht=2;fpan=0;fpa=P0-637578525-1684132272823;pbc=;ns=1;ce=1;qjs=1;qv=c818c8ec-202305...
pixel.quantserve.com/ Frame AD9F 35 B
210 B 24ms
23ms Image
image/gif 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=24179850;rf=0;a=p-TWKb6gH_3MnFX;url=https%3A%2F%2Fswiftmoves.blog%2F;ref=https%3A%2F%2Fswiftmoves.blog%2F;uht=2;fpan=0;fpa=P0-637578525-1684132272823;pbc=;ns=1;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;d=swiftmoves.blog;dst=0;et=1684132282014;tzo=0;ogl=;ses=2f4cb2db-8d5e-4cd5-b9ae-9a0900685ac9;mdl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 11CD 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvmeJ9jeNVi6CC5xOcLTzBiH_K-0-U5jjts_II6iA4PK4xlZA1CYFQxoAK0Yn4-yfxZvgIUWwGoPplNG_nymqBefwg9wQc_806tJH7rYdbe_eZePrYO6TCeTmEeaViVrpWiUAEfgeRha3wsZQf41GCDz4gDb7_aMblPtZNy3NLRURFIMGvyhqibAQQjKrY6_rUXXMxxHhRjhrAmiP6iOVi0uRkivhNLkcFFcsBqAGHwXAhxLsgkx_tyP18NW8XsLpK7sWHxdFFH3oGNFRLABqrW9jqIkh-tdE4hG4nU66XT3nd1kRBNzf7V-vqwk0ekXMzMzFsgUIKlSg&sai=AMfl-YSOlxioEQEjLjLIay3fnBpUYI9sYd0Cx-a9DDRpg7mwqN0PEqUu2YPKVPG3t3t0yzV46XdWKmD3PQljhXavSomAjEs1m3FpVMWyLq7itt83mNy2i1Xg-V88bZk1U08&sig=Cg0ArKJSzJN4MMWspRSvEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame EE34 0
861 B 20ms
19ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: 31a7b5aa-5013-41bd-b263-ca676e2be156
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjE4NTI0NTAzLCJjcmVhdGl2ZV9pZCI6MTM4NDI2MDYwNzUxLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D485 0
0 36ms
36ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=3738170952900814&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame AD9F 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstBxgLctGk3pVTeTno41C0WPtTY3A0xzRgi68MykN6p3YRIQ-Bjs2yowEEFXcSkRLx6xltnjs6DcM2sPl2DfmKcycG3IIlshvMAc0U3yuQgYB5zsWudlRtBCFDIM_GbJjGQ1t3nD-V4EyzXeWbzd5BKwaTwPlrW6mPwBV3yzPSWV_WhY-Kxc1p1Dr-NyO32wA_oC43M-C_-Z_SO2xXpPVMTpJ5fiqXasDmi7GsTnJkOPclL0c2z-bpcQJW-I1r7cCwMdCBpUHrqMwgHV9cnfpP3zF8rFTPzhORfdDgR0VA4kBjW4jRd9Sq-wMmHcz_1U4SHK3LWdPB5A6DxxVbwDglpG7vNnu86cA&sai=AMfl-YSkOzzbX1PDWRsRdyqUHCP_M_BIcd8ws-ZLlAGpA_tgaLpHtrHwQB1pKIdxAThloudqeedfnXgCyiUxdsk8AZrBBYRyenHGgYICQHCi5MVDEjBi6AZmqyvXccdAejA&sig=Cg0ArKJSzCktjYC1m2rWEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 0045 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540913
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD9F 0
20 B 36ms
35ms Image
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=swiftmoves.blog&doc=complete&pg_h=260&pg_w=300&pg_hs=260&c=0&aa_c=0&d=0&all_d=0&ard=0&all_ard=0&dt=d

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK beacon Show response
ce.lijit.com/ Frame 5799 4 KB
2 KB 77ms
30ms Document
text/html 3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/www/sovrn_beacon_standalone/sovrn_standalone_beacon.js?iid=13401719
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 6dafb80e3e9cbd6c4f6565cf2bc6c84378ac12b7c9c8f1b83f94b3d294783eb8

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 997
content-type: text/html
date: Mon, 15 May 2023 06:31:22 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 4

GET
H3 200 audio_023.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 43ms
42ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_023.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c8b42a714f0b82c211d91ab345246f391dbcc65cd3f67adf4c75b31e282024b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1120
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=glxPjoGJVa0l5OQK8LrPbrbWa1nZ2gz1x4e20xwHD5RmiosgSMbQEt6HWkeC8x13vv1WPTqHi707w7myIdV8tXxTBnIFNSDYUpSMOMzIlz0J%2Bv5enKDwH%2BH8vvy0gm1Rb0PHNDrfwk0uZ1sAFSZ6RiGp"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79566b5cc95437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40290

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTM0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjA5NzY1OTIyLCJjcmVhdGl2ZV9pZCI6MTM4NDIxMDAzNzMwLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 97ms
28ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:22 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 36 B
560 B 104ms
50ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b62c82f4d3d497826d615ce8b6e28511ca776d03700aaf0c0a63b4caa791a67f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rk0tls%2BUBuXkq4Q38QRlIDxngDNuNG0hVvWtvjuCW5otZ4NTJZfB92Iu1vaabIhGlz0errbm7ymjfs2ibWs6L82sKBWlIt1GqAxB4Ou4mhD8bptuSsfsWHGLjoJaQkQ9ZUlSFRWL"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c79566c0fc7a1e6-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 144 B
1 KB 103ms
103ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

75830e5125e509aef8359d78f3f4ae2d88b8a5d11cd4a55835955eff35181a33

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: 7f6aaab7-2cc3-43ab-9aed-925df982e3e7
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
715 B 125ms
92ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: ad34071a1150f19c1abe85dcf0a91b9a10554555e119f589b6a47f08e9e122cf

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 353 B
411 B 116ms
115ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=dc4635d4-94cf-48ae-8c90-d3073a4d8a19&l_pb_bid_id=80f99c0c4e5eb3&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250_desktop&slots=1&rand=0.21541452571659114
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 746bacaaec01ca12099fa5e8c9c6e0716f5164dfd994b1b8bd861c4aa1e2d802

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 353
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
163 B 85ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 353 B
388 B 127ms
127ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=dc4635d4-94cf-48ae-8c90-d3073a4d8a19&l_pb_bid_id=1231a0deb8caf2a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250_desktop&slots=1&rand=0.40493168789051404
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f02d1469137a0daf94064cdfa395183dee0fbef0832c8bf556005e59af984bc9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 353
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 872 B
2 KB 179ms
82ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2214956464e0d83c2%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=abeaa104-0a7d-4d73-b25b-2b69884367d3&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

ae31e645d8474d5bfa0f33e389cc83312a401e2b6809183d8bd24dd727436af4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 494
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 6 KB
4 KB 201ms
201ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e11ab0d5e840fb2edff86d30bc504b9cd89411d3550455ae9283f7ab3ae34b1e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 178
content-length: 3503

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 93 B
2 KB 243ms
193ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 1527c10af92929d4e3731258601f037e348128fb2fae8c6b27849fc6de3f9f6b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 97

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 41ms
40ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=80&3pid=LHOGVEZ1-17-H6WS&gdpr=0

43 B
2 KB

97ms
26ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LHOGVEZ1-17-H6WS&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LHOGVEZ1-17-H6WS&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c57992b917a1c5de787b922c662fdf18
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
https://ap.lijit.com/merge?pid=94&3pid=6461D1B1EC9AD0AEDDB89C05BLIS&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=94&3pid=6461D1B1EC9AD0AEDDB89C05BLIS&gdpr=0&gdpr_consent=

43 B
3 KB

28ms
27ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=94&3pid=6461D1B1EC9AD0AEDDB89C05BLIS&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: https://ce.lijit.com/merge?pid=94&3pid=6461D1B1EC9AD0AEDDB89C05BLIS&gdpr=0&gdpr_consent=
Content-length: 0

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame 5799 0
0 39ms
38ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?st=bidswitch&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D79%26user_id%3D_wfivefivec_%26expires%3D30%26ssp%3Dfmx%26bsw_param%3D0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://x.bidswitch.net/sync?dsp_id=79&user_id=WDaPIhCo1PYrJO5&expires=30&ssp=fmx&bsw_param=0c031c75-0dc5-47ab-a78c-92793a44c6bb
https://ce.lijit.com/merge?pid=26&3pid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=

43 B
3 KB

28ms
27ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=&gdpr_consent=
Date: Mon, 15 May 2023 06:31:22 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://um.simpli.fi/lj_match?r=1684132282194&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=36881F8882764BFBBAB2F6595BB0DFFB

43 B
2 KB

36ms
25ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=36881F8882764BFBBAB2F6595BB0DFFB
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:22 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=36881F8882764BFBBAB2F6595BB0DFFB
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 14 May 2023 06:31:22 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D92%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=92&3pid=2829111677345209672&gdpr=0&gdpr_consent=

43 B
2 KB

41ms
25ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=92&3pid=2829111677345209672&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fdd6ea4d-e590-4be1-9c66-a27d3c85ec16
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ce.lijit.com/merge?pid=92&3pid=2829111677345209672&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=UMxte5rHSSDS&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
2 KB

61ms
25ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=UMxte5rHSSDS&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://ce.lijit.com/merge?pid=49&3pid=UMxte5rHSSDS&ev=1&pid=558511&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=GpfHAPZHSyvkYo7GRcqvmKxM&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:9cfc3af708bb49c808e6d8d75839a9eb

43 B
2 KB

71ms
26ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:9cfc3af708bb49c808e6d8d75839a9eb
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:22 GMT
server: Aorta/20230424.0cea469ad
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
location: https://ce.lijit.com/merge?pid=84&3pid=c:9cfc3af708bb49c808e6d8d75839a9eb
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 2f1bbd527b8c
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=110&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fcentro%2F2069.80%2F%7BuserId%7D%3Fzcc%3D0%26sspret%3D1&rndcb=7746356741
https://sync.1rx.io/usersync3/centro/2069.80/d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341?zcc=0&sspret=1&rndcb=7746356741
https://sync.targeting.unrulymedia.com/csync/RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
https://ce.lijit.com/merge?pid=97&3pid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005

43 B
2 KB

25ms
25ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=97&3pid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
Server: Tengine
ETag: RX48fe24f188bf46cd87343bca0e84d201005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ce.lijit.com/merge?pid=97&3pid=RX-48fe24f1-88bf-46cd-8734-3bca0e84d201-005
Content-Type: text/html
Connection: keep-alive

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=85&3pid=AAC5aU7Iw6MAACKiklmZXA&gdpr=0

43 B
3 KB

28ms
26ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=85&3pid=AAC5aU7Iw6MAACKiklmZXA&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 2
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=85&3pid=AAC5aU7Iw6MAACKiklmZXA&gdpr=0
Date: Mon, 15 May 2023 06:31:22 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame 5799
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

0
0

46ms
44ms

Image
text/html

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: H3
Server: 74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),
Reverse DNS: vj-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe

43 B
2 KB

37ms
25ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=87&3pid=b3b8c020-97aa-44d6-b11b-6efe82d6d8fe
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5799
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

45ms
44ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=83&3pid=LHOGVEZ1-17-H6WS&gdpr=0

43 B
2 KB

26ms
26ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=83&3pid=LHOGVEZ1-17-H6WS&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 2
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=83&3pid=LHOGVEZ1-17-H6WS&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 19600bc21eacf9565125744d917cac10
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=12&3pid=2829111677345209672&gdpr=0&gdpr_consent=

43 B
2 KB

73ms
27ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=12&3pid=2829111677345209672&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 75d19d4a-25bd-4a90-b620-2d80a292741c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ce.lijit.com/merge?pid=12&3pid=2829111677345209672&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5799
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=16&3pid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=

43 B
2 KB

58ms
27ms

Image
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=16&3pid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:21 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://ce.lijit.com/merge?pid=16&3pid=d431ebc1-81c1-4f49-abb9-ea38ed717633-6461d1b2-4341&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

merge Show response
ce.lijit.com/ Frame 927A
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=1&3pid=8575394200595948846&gdpr=0&gdpr_consent=

43 B
2 KB

49ms
27ms

Document
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=1&3pid=8575394200595948846&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-length: 43
content-type: image/gif
date: Mon, 15 May 2023 06:31:22 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
x-envoy-upstream-service-time: 2

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
date: Mon, 15 May 2023 06:31:22 GMT
location: https://ce.lijit.com/merge?pid=1&3pid=8575394200595948846&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
pragma: no-cache

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AE3A 16 KB
6 KB 32ms
30ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33840
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:22 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 cm Show response
us-u.openx.net/w/1.0/ Frame DAE1 801 B
458 B 43ms
43ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 85d68ba7f937c76417c3f38cd1f5039f676acbdad82cb50f639ff05d389dd943

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 439
content-type: text/html
date: Mon, 15 May 2023 06:31:22 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 6E48 16 KB
6 KB 29ms
28ms Document
text/html 23.33.180.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fap.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?informer=13401719&gdpr_consent=&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.33.180.215 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-215.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ce.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=33840
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 15 May 2023 06:31:22 GMT
expires: Mon, 15 May 2023 15:55:22 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 309ms
308ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=3426050592317352&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=38&adks=798944132&sfv=1-0-40&ris=2&rcs=6&prev_scp=a%3D%257C0%257C%26iid1%3D2168644650152297%26eid%3D2168644650152297%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1193%26sap%3D1193%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D7%26at%3Dmbf%26adr%3D398%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Dswiftmoves_blog-edge-2-2168644650152297%26eb_br%3D33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D6%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJK4zlLT5pSJZwr0ZflCbYmQAAAGIHhsbAgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICDjdWM0%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D10%26reqt%3D1684132281183%26hb_bidder%3Dappnexus%26hb_adid%3D8421a8a0bb4268c%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient%26nam%3D1&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132282264&lmt=1684132282&dlt=1684132272249&idt=516&adxs=1440&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvgBbmfOSO_cuNXDYs0AT4Y5d9TvROFOCRJ4J3MPhQJGEzFO3fzNfTmCApvxebKWWD9T8XwxX9tU_Yd_%2CABHeCvhqxxNnUPIrZxjWRSq1tyOGXAvhHNSrzjic_GBSGQRLfL1qrV03Dgt_lYDX2Zjh0i1gBkIM7Fz9Yb68&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e8dde85e81880b48cb40ee0281d9af1823fadb463d0fb746e00eb6556784b0b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10451
x-xss-protection: 0
google-lineitem-id: 5728075597
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138354425803
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
hblg.media.net/ Frame 11CD 35 B
200 B 24ms
24ms Image
image/gif 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=Ae4FMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAIAAAAAAAAAxQ_ARANGY1MTMxOTI0NTQ4NGUzMmI4ZDRmZjliNjFjYTE1YTigp9yVBIwEBENBHnN3aWZ0bW92ZXMuYmxvZxI4Q1VQVjFUNzZEZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTEtMA4yNTB4MjUwDmVhc3Rfc2MEMjMMUFJFQklEEjhQUkw0RTdOMwYyNjIARGRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0xLTACMDxydGItY29tbW9uLTg0NWNkZmY3OTctcHEyZjIuU0NAUzAzMDAwODA3MTEwNjgxMDAyNTAwMjUwOTk5OTk5MDACMAAGADBnZW4tdmJsdF9wcmViaWRfdGVzdF8yXzFGMjAyMzA1MTQxNDIyX2dlbi12Ymx0X3ByZWJpZF90ZXN0XzImZ2VuLXZibHRfcHJlYmlkX2FsbIoBJE1FRElBLk5FVCBFWENIQU5HRQICZA&evttyp=1

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Mon, 15 May 2023 06:31:22 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 161ms
126ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

d16d9ea48ab5ad6428dcb0feb94334364a2783fe2a6f4951f36f5302bd7c3789

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: af491e41-0f70-4b5b-a611-7bf06ef7b1aa
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 664 B
873 B 126ms
79ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: 2ca5df9a912400b1bfd07159b7d49b0d1e48601fd38ccb52d295fe1fcae81c28

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 357

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
410 B 27ms
27ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: b94e143f737e0b339c5a4457663b63587926648833692618efaf436aa2f0ad03

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 82ms
82ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 202ms
202ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=15002ea739e72ec7&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22amxdt.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22amx*3*8220b2d1-4aec-4d94-9d18-b2fae200417f*df8d05a053203544d26b49db3b030b93%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22xuRgVV9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmMXo1dmw2SXFWRnBKTVoza0VQMkRJZnIzaVJjbllMYVpEeFpYZTdFU0hhODh0SHdGZVc4NEJiSTlkNUMlMkZjbTdS%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=7&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:22 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 87ms
86ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: e145acd07b226ae3293f67f749f94f2dae563ddda03ad0ec07109e2153734a30

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 128ms
128ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 81ms
81ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 368ms
367ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=568146782971551&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=39&adks=2650088509&sfv=1-0-40&ris=2&rcs=6&prev_scp=a%3D%257C0%257C%26iid1%3D4095903284162936%26eid%3D4095903284162936%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1192%26sap%3D1192%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D7%26at%3Dmbf%26adr%3D398%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dswiftmoves_blog-edge-1-4095903284162936%26eb_br%3D33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D6%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C2763%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C2763%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%26amznbid%3Ddxpips%26amzniid%3DJCehygsYoEzMwpI8sbWhhxwAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICBri1Pp%26amznsz%3D160x600%26amznp%3D1k1hwjk%26lb%3D12%26reqt%3D1684132281243%26hb_bidder%3Dappnexus%26hb_adid%3D85c1f58f2d2254e%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_opt%3D0.07%26hb_rt%3Dclient%26nam%3D1&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132282339&lmt=1684132282&dlt=1684132272249&idt=516&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvgBbmfOSO_cuNXDYs0AT4Y5d9TvROFOCRJ4J3MPhQJGEzFO3fzNfTmCApvxebKWWD9T8XwxX9tU_Yd_%2CABHeCvhqxxNnUPIrZxjWRSq1tyOGXAvhHNSrzjic_GBSGQRLfL1qrV03Dgt_lYDX2Zjh0i1gBkIM7Fz9Yb68&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0c2ab8a40d49023883ca1a64800a8d798ebac68e9fd7023646839d0d5a6302a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10447
x-xss-protection: 0
google-lineitem-id: 5728075597
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138354426952
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK merge
ce.lijit.com/ Frame DAE1 43 B
2 KB 33ms
27ms Image
image/gif 3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=76&3pid=d49f8303-6b2f-0164-0afe-5b61d607260d
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: envoy
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
x-envoy-upstream-service-time: 1
content-length: 43
expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DAE1
Redirect Chain

https://ad.mrtnsvr.com/sync/openx
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D540245193%26val%3D%23PM_USER_ID
https://us-u.openx.net/w/1.0/sd?id=540245193&val=41DA1833-16BC-41FB-8168-95B4325D28EC

43 B
61 B

14ms
14ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=540245193&val=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=540245193&val=41DA1833-16BC-41FB-8168-95B4325D28EC
date: Mon, 15 May 2023 06:31:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DAE1
Redirect Chain

https://openx-ums.acuityplatform.com/tum?tpid=22&uid=c691107e-2d1c-0d73-178c-075a1e122158&rurl=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537123500%26val%3D___AUID___
https://us-u.openx.net/w/1.0/sd?id=537123500&val=779825864531

43 B
61 B

14ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537123500&val=779825864531
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Access-Control-Allow-Origin: *
Location: https://us-u.openx.net/w/1.0/sd?id=537123500&val=779825864531
Content-Length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DAE1
Redirect Chain

https://openx.adhaven.com/bid-engine/cs/377c7998bb9f42e5aea0416c9dac091f/v1?rd=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537146931%26val%3D%24UID
https://us-u.openx.net/w/1.0/sd?id=537146931&val=4c_8befb0e4-709d-45ef-966a-2626f4189bb5

43 B
61 B

14ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537146931&val=4c_8befb0e4-709d-45ef-966a-2626f4189bb5
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537146931&val=4c_8befb0e4-709d-45ef-966a-2626f4189bb5
date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

204

openx
tr.blismedia.com/v1/redirect/ Frame DAE1
Redirect Chain

https://tr.blismedia.com/v1/api/sync/openx
https://eu-u.openx.net/w/1.0/sd?id=539732443&gdpr=&gdpr_consent=&val=6461D1B1EC9AD0AEDDB89C05BLIS&r=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2Fopenx%3Fpartner_device_id%3D6461D1B1EC9AD0AEDDB8...
https://tr.blismedia.com/v1/redirect/openx?partner_device_id=6461D1B1EC9AD0AEDDB89C05BLIS

0
9 B

28ms
27ms

Image
text/plain

34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/redirect/openx?partner_device_id=6461D1B1EC9AD0AEDDB89C05BLIS
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Redirect headers

date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
location: https://tr.blismedia.com/v1/redirect/openx?partner_device_id=6461D1B1EC9AD0AEDDB89C05BLIS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DAE1
Redirect Chain

https://openx2-match.dotomi.com/match/bounce/current?networkId=15900&version=1&nuid={OX_USER_ID}
https://openx2-match.dotomi.com/match/bounce/current?DotomiTest=7dcdfdf452e8183d&is_secure=true&networkId=15900&version=1&nuid=%7BOX_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537072954&val=AAAMfi2JneWFgAMK7lpVAAAAAAA&expiration=1684218682&nuid={OX_USER_ID}&is_secure=true

43 B
61 B

14ms
13ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072954&val=AAAMfi2JneWFgAMK7lpVAAAAAAA&expiration=1684218682&nuid={OX_USER_ID}&is_secure=true
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://us-u.openx.net/w/1.0/sd?id=537072954&val=AAAMfi2JneWFgAMK7lpVAAAAAAA&expiration=1684218682&nuid={OX_USER_ID}&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 200
OK merge Show response
ce.lijit.com/ Frame CA4D 43 B
3 KB 27ms
25ms Document
image/gif 3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=58&3pid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-length: 43
content-type: image/gif
date: Mon, 15 May 2023 06:31:22 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
x-envoy-upstream-service-time: 1

GET
H/1.1

200
OK

merge Show response
ce.lijit.com/ Frame 37AD
Redirect Chain

https://ap.lijit.com/merge?pid=71&3pid=41DA1833-16BC-41FB-8168-95B4325D28EC
https://ce.lijit.com/merge?pid=71&3pid=41DA1833-16BC-41FB-8168-95B4325D28EC

43 B
3 KB

27ms
25ms

Document
image/gif

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=71&3pid=41DA1833-16BC-41FB-8168-95B4325D28EC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fap.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-length: 43
content-type: image/gif
date: Mon, 15 May 2023 06:31:22 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
x-envoy-upstream-service-time: 1

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/merge?pid=71&3pid=41DA1833-16BC-41FB-8168-95B4325D28EC

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 36ms
26ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:22 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 126ms
126ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250b_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=bb2009b2-9ff6-436e-9e0c-731a72a576ff&l_pb_bid_id=21e9bc61949ec77&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250b_desktop&slots=1&rand=0.46890987280123886
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9f1764c062ff4e62bccac3b82f8bb89855b68702cf119ad997430696cd3b0a5e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 37 B
313 B 52ms
46ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92e90a75b4b328d277f3443550842bd5785e71942caf82f69acc053d6a262c05

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cgwnjtZrq98ygSWdTEe1rVJ4w9huBSi5BdoCwI4iEfHOQHeTKbPfZ%2BmvO3Fc0dK14njkui%2BHviXtPC51v%2FBAdCHQ%2FPmPyRd25NxxJcUdeM1WyafLXBE5gXR4qA0BD8jwcvlMHL7i"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c79566d3922a1e6-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 6 KB
4 KB 168ms
158ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 5edce4e1ae05528c0e7cf3256802370c650e70e592c9f02db60ea00fd73366a0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 136
content-length: 3446

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
432 B 107ms
99ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8d2b31f481d0efce7ff27e685f3123825093ebf5b71f2b9c0e7d2804f907b55e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 148ms
140ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250b_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=bb2009b2-9ff6-436e-9e0c-731a72a576ff&l_pb_bid_id=310bfe42af7e831&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250b_desktop&slots=1&rand=0.5253105069272668
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: ec67425b5803acbe91623a3a19a19f6a575be5f9d37b30785a4406b2b0faadef

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 94 B
4 KB 123ms
99ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 6593c7e09108aa3ee15db82c51c3dc22f1b4b385525df9bf26fe67574d2ce5e5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 145 B
1 KB 151ms
149ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

769e634a92c6abdb452bd228bf6a99961866f02a2d265d993c469db8bde4ec6f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: 7cf8e113-f9d1-4d64-b689-13ce0a4c6f65
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 855 B
2 KB 130ms
81ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%223715cf44bad123a%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250b_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=10961660-9a1d-4023-ab01-d4bc47b4a57a&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

4470567cf9819d57078058f961971df4ecd3ada566a71623517594375a67f4f2

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 473
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 events
bidder.criteo.com/csm/ 0
216 B 25ms
24ms Ping
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 13 B
294 B 24ms
23ms XHR
application/json 2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?ccpa=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

243fb9953e49b6005f6ae1772f507bb789a8893960a495850afe43fe34030311

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H2 204 g_pbst
1x1.a-mo.net/hbx/ Frame AD9F 0
89 B 75ms
24ms Image
text/plain 18.210.45.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbst?A=amx&w=300&h=250&bid=39eaefb084ef156&c1=banner&np=0.03577061922508443&aud=163d561a9f2be0d&a=div-gpt-ad-saambaa300x250x1-0&c2=hb_bidder%3Damx%26hb_adid%3D39eaefb084ef156%26hb_pb%3D0.03%26hb_size%3D300x250%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_adomain%3Droobet.com%26hb_acat%3D&ts=1684132282492&eid=40233445c984c17
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.45.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-45-24.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AD9F 107 B
122 B 39ms
39ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AD9F 107 B
122 B 35ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 26 KB
11 KB 238ms
236ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=1083075723176700&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=1517229526&sfv=1-0-40&prev_scp=hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.03%26hb_adid_amx%3D39eaefb084ef156%26hb_bidder_amx%3Damx%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.03%26hb_adid%3D39eaefb084ef156%26hb_bidder%3Damx&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132282506&lmt=1684132282&dlt=1684132281049&idt=862&adxs=1070&adys=1324&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=1&ucis=7fu6yum5029c&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x250&fws=384&ohw=0&ea=0&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43aa7b596e793ff27025d0584d500821c36764a7389333bae1896d2f6b4440b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11332
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760725
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AD9F 15 KB
11 KB 44ms
41ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202305090101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb84107ae9bb6444f33bd5d2ad1f2ff8e449dc14e011754837be0958779a0d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11243
x-xss-protection: 0

GET
H2 200 container.html Show response
5a02b7fa4725d282c66b696ff6c80184.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DBD6 6 KB
3 KB 47ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5a02b7fa4725d282c66b696ff6c80184.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:22 GMT
expires: Tue, 14 May 2024 06:31:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTIwODc2Mjg0MjE0NjIxNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMjcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjE4NTI0NTAzLCJjcmVhdGl2ZV9pZCI6MTM4NDI2MDYwNzUxLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMjUwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkyMDg3NjI4NDIxNDYyMTYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTI3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjIxODUyNDUwMywiY3JlYXRpdmVfaWQiOjEzODQyNjA2MDc1MSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MjA4NzYyODQyMTQ2MjE2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEyNywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjYyMTg1MjQ1MDMsImNyZWF0aXZlX2lkIjoxMzg0MjYwNjA3NTEsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 28ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:22 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 96ms
94ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250c_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=7cddf910-a3d2-4de3-b3b8-7824bdcec69f&l_pb_bid_id=426792182cc600a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250c_desktop&slots=1&rand=0.4015911354656321
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f46656f7e45ed6ea613b63d3807f28d5a03806bb42927566bc2405bd16e225cb

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 480 B
417 B 173ms
172ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 4c8aa95c5eb0a14554e4005f7fd415168330915205db15fc46c733b674eb785c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 150
content-length: 267

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 37 B
543 B 47ms
46ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 926fe2a8a75c3905f30e8250e53e5664d1460e11a06c454b7518dadabf16998c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWlDw%2Bg2yeBFBhR3EbX77q8dDA0RwPJdHMQ5kTICHOHIoRPmohO0jfa0iic9GJd%2FS8l6R0kw%2Ff3%2FOgwOj5alBpxVm41fXY0Q9lH2uL%2FLAENFbd1e7NmllukDqVOAPnBhK009B%2Bw9"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c79566e2e6ea210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 178ms
176ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250c_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=7cddf910-a3d2-4de3-b3b8-7824bdcec69f&l_pb_bid_id=4810ae9725c63c5&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250c_desktop&slots=1&rand=0.3416633833299554
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9f3f9fcc59897a53c77f6b8a1b0c9f503c6114cf4841afaa5c984c48cbbef448

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 94 B
2 KB 84ms
83ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 11ce2bba23e9fd8aaff56c09ce3a00aa2b432ee8ddc5ebc92977bab43f7ec01d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
432 B 103ms
102ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: ba42f7d34917c06570cb92c8c87a8eeb54eae71eb591eaca197fc51ba79b63a5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:22 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 811 B
2 KB 81ms
81ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2256795df02a7f8d%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250c_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=c3cfa9ca-2598-45e4-94f5-d013e7f008ba&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

7c3844301fb8db274fd34484ccba14c4d0b505eabce3ac4df75a3643f8b0f1f4

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 483
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 14 KB
7 KB 111ms
111ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

547dc9b37508015be9f544059862abdee2560fb334f4fe30e8ae31abd836086e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: caf91d60-d149-42ac-b903-e37a5c88c5b4
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMzQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjA5NzY1OTIyLCJjcmVhdGl2ZV9pZCI6MTM4NDIxMDAzNzMwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjcyNjg2NTU3NDIxNjQzMzUiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctbGFyZ2UtYmlsbGJvYXJkLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTM0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjIwOTc2NTkyMiwiY3JlYXRpdmVfaWQiOjEzODQyMTAwMzczMCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3MjY4NjU1NzQyMTY0MzM1IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEzNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjYyMDk3NjU5MjIsImNyZWF0aXZlX2lkIjoxMzg0MjEwMDM3MzAsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:24 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AD9F 17 KB
6 KB 37ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0045 0
10 B 34ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?AdF0KA
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 g_pbst
1x1.a-mo.net/hbx/ Frame AD9F 0
88 B 23ms
23ms Image
text/plain 18.210.45.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbst?A=amx&w=300&h=250&bid=601e0531ca14c27&c1=banner&np=0.03577061922508443&aud=255a86cac041cc3&a=div-gpt-ad-saambaa300x250x1-1&c2=hb_bidder%3Damx%26hb_adid%3D601e0531ca14c27%26hb_pb%3D0.03%26hb_size%3D300x250%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_adomain%3Droobet.com%26hb_acat%3D&ts=1684132282621&eid=61c5e168648a21f
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.45.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-45-24.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AD9F 107 B
122 B 39ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AD9F 107 B
122 B 35ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 26 KB
11 KB 440ms
439ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=1691425803817944&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250b_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=2&adks=1526563377&sfv=1-0-40&prev_scp=hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.03%26hb_adid_amx%3D601e0531ca14c27%26hb_bidder_amx%3Damx%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.03%26hb_adid%3D601e0531ca14c27%26hb_bidder%3Damx&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132282627&lmt=1684132282&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=5vvc2hw0hpfp&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae2ed8018fb5a68edc753d4a88b0a000ce3ef6cea27786694b336ba7ef5ba43a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11220
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760716
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EF30 0
0 42ms
41ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuNBZ1SICEvFPqhWxK8bxaUCI_v2v2oiUzUdE-9EEdvYsKy4sWhBbJUAjXzOrV6c0B6t1Sdl3UvgeShYxGz6a77CRPceusRLYk8Ra_wKnXk-pqX1y0ABGGO122BCwjv3FhcAYlnqV_o-cAUaBAgwmAQ--vRDAHggSaMSTOjG-Y_0U6q5bqM0KRmnmRv2yf1DBV4rMn5VrCtVIHWk6lh8aDTIGTWxjejXenAw1bCzx3hB3fNQUy58SryrrT-sl3yAmGL7OJbLpbTIPuy9CFRu0jenkk948aU9McdWNKz-QjJUkPUEQaUdSQ-__qMPMImDxfZ9Cs_3jhQ&sai=AMfl-YRIAfFg67CSKh-ka96-WN8ml4tQ6y0WUxZ-kSMfcBOp6AXbEkGfB754xvbkm0t-qo-5h2aqL0nPQ2aBVqhGtcRj5pEJdCkVH4Qlo_3EOiP56fwpknl1pSAELbsMhyY&sig=Cg0ArKJSzOTT2WFyoyIREAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/1/193398;6834967;201;js;GeniusSports;CAProspectingSportsGeniusMediaAppnexusSPOPRONHLOMP160x600/ Frame EF30 1 KB
1 KB 138ms
68ms Script
text/javascript 23.192.1.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://servedby.flashtalking.com/imp/1/193398;6834967;201;js;GeniusSports;CAProspectingSportsGeniusMediaAppnexusSPOPRONHLOMP160x600/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fswiftmoves.blog%2F&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}&cachebuster=717040.920199119

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.1.177 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

prod-xre-app10.ash11 /

Resource Hash

05082c2a1c1621aec15d2e0a6b958c103aa7a407bddf08b092c1041ef9e0fb64

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=86400
Server: prod-xre-app10.ash11
Vary: Accept-Encoding
Content-Type: text/javascript;charset=ISO-8859-1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 658
Expires: Mon, 15 May 2023 06:31:22 GMT

GET
H2

200

controller
ssl.connextra.com/servlet/ Frame EF30
Redirect Chain

https://ssl.connextra.com/Betway/selector/image?client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_Pixel_1x1&_cb=677038075&apnauc=4874731260098387858&bidid=4874731260098387858&dspid=3bc1d7...
https://ssl.connextra.com/servlet/controller?service=DDM_Betway_CA_Sports_Impression_Pixel_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_...

68 B
196 B

130ms
130ms

Image
image/gif

72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_Betway_CA_Sports_Impression_Pixel_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_Pixel_1x1&_cb=677038075&apnauc=4874731260098387858&bidid=4874731260098387858&dspid=3bc1d7fd2e
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4443eccbe460b086b56483fdbfdaafca2c11c369a796a56c097997b15c160660

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-served-by: vlp-cxtadsrv08.connextra.net
date: Mon, 15 May 2023 06:31:23 GMT
content-type: image/gif
content-length: 68
expires: Mon, 15 May 2023 06:32:08 GMT

Redirect headers

x-served-by: vlp-cxtadsrv02.connextra.net
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
vary: *
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
location: https://ssl.connextra.com:443/servlet/controller?service=DDM_Betway_CA_Sports_Impression_Pixel_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_Pixel_1x1&_cb=677038075&apnauc=4874731260098387858&bidid=4874731260098387858&dspid=3bc1d7fd2e
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/232/ Frame EF30 80 KB
28 KB 69ms
17ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/232/trk.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c93c88a9b0ecf4b158610988b79ffdc52501b1e995f14eb4dfc09c7eb9c3f6de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Thu, 25 Apr 2024 08:42:19 GMT
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 1633743
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27631
X-Served-By: cache-lga21975-LGA, cache-yyz4535-YYZ
Last-Modified: Wed, 26 Apr 2023 08:42:13 GMT
Server: AkamaiNetStorage
X-Timer: S1684132283.735487,VS0,VE0
ETag: "c342094e8bdad308ac07817d751fb315:1682498533.672161"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 13, 782787

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame EF30 0
933 B 64ms
18ms Image
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fswiftmoves.blog%252F&e=wqT_3QLeDfBM3gYAAAMA1gAFAQi1o4ejBhCSv6Dtjsih00MYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVEREPQqAUR3UHcuLtgCAOAC4ZE86gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBf-OA_oFBAgAEACQBgCYBgCiBg43NjIwI05ZTTI6NjQ3NLgGAMEGAAAAAAAA8D_QBqkl2gYWChAAAAAAAAAAAAAACQpgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsbyF_2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW4xjQRBQSGdAGc1nQxBQUFJjVIsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0JCbUENEABtwzaBwYICcDw1AcA6gcCCADwB5GACIoIvAEKtwEAAAGIHhsrCEOmhkDtqB-Suw2C-Kwsl39ECyJ5JwKh9GydjUAJUqSxBjxlBMNVUO0p82WM3C9Vkyv_b4YURn-Tr8wGDrhf3T8CnS7yBAoomp62IayL5WcVeacc4uT6D2onJWsHhrlscKOtl06vrCt1Ox9Zo3Mzm2nhTYSdvokDeBwOy1wvHjOo_SeM3ARDIl6eRp8qaJBjRsKj45iLn1PMw3NgR7XqcXRjjyE_k3HjDlY9EqNumxoQAZUIAACAP5gIAQ..&s=70dd5d417e7ddee2fa9d4377d495b6bf5bfc2313

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: 653381b3-5a24-499b-b8c8-6177e58f2659
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame EF30
Redirect Chain

https://secure.adnxs.com/seg?add=31440544&t=2
https://pixel.mathtag.com/event/img?mt_id=1610862&mt_adid=115425&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=102b6461-d1b1-4f00-b06c-5186e28fb05c&expires=28

42 B
787 B

98ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=102b6461-d1b1-4f00-b06c-5186e28fb05c&expires=28
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 19ea072139d67f7022c6e463249c998e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
Server: MT3 851 9bd98ae master iad-pixel-x20 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=102b6461-d1b1-4f00-b06c-5186e28fb05c&expires=28
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:21 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
34 B 26ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiIzM2RkNTIzZjhlNGRkYTE1OGYwYWE5OTY4NmRkYTdmMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAuMDAwMDc2MTgyLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExOTMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA3NjE4MiwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMSwic3RhdF9zb3VyY2VfaWQiOjEwMDg3LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InN0YXRfc291cmNlX2lkIiwidmFsIjoiMTAwODcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjIxNjg2NDQ2NTAxNTIyOTciLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTE5MywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibWVkaWFfdHlwZSIsInZhbCI6ImJhbm5lciJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwcmViaWRfc291cmNlIiwidmFsIjoiY2xpZW50In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
57 B 25ms
22ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAuMDAwMDc2MTgyLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExOTMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA3NjE4MiwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMSwic3RhdF9zb3VyY2VfaWQiOjEwMDg3LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EF30 169 KB
52 KB 40ms
39ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 39ms
39ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 37ms
36ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 bqi.php
lg3.media.net/ Frame 8D0D 15 B
15 B 26ms
26ms Image
text/javascript 23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=2170&lf=3&&vgd_hb_audit_1=8CUPV1T76&vgd_hb_audit_2=559647184&vgd_tsce=L134&vgd_l2type=scs_newfl&vgd_ydspr=1&vgd_cdv=951&vgd_cage=2&vgd_rensize=250_250&vgd_ren_page_h=10796&vgde_bdata=~G-MjJzviXX~G8Ov9.ui9~G-M1QzvuFfhF~G-My8zQxv9~G-M81GvVKRuioi~G-M8z7YOv9~G-MLwvHhr4gEdWqR~G-MLENv999999u~G-MQ8lJvfX9-fX9~G-M7Y1-vuX9~G-M7YjMQxkk8-vS~N875vcaI_D4KT~ONvyNEoxQoJ1Q7uoO~OYYMOufvu~OYYMOuXvu~OYYMOuFvA~OYYMOuhvu~OYYMOuWvX9~OYYMOuiv9u99~OYYMOfv_~OYYMOfuvou~OYYMOffv9.9A~OYYMOfHvX~OYYMOfXvOJkMOJk~OYYMOfiv9.99~OYYMOAFvIK~OYYMOAhv_~OYYMOHvu9~OYYMOH9v9~OYYMOHHvELmO~OYYMOHXv9~OYYMOHFvD~OYYMOXfv9.99~OYYMjv9.9A9~OYYMYuv9.uXi~OYYMYu9vu.999~OYYMYuuvu.999~OYYMYufv9.FWF~OYYMYuAvu.999~OYYMYuHvu.999~OYYMYuXvu.9fA~OYYMYuFv9.Xfh~OYYMYfv9.9HH~OYYMYfuvu.999~OYYMYfAvu.999~OYYMYfHvu.999~OYYMYfXvu.999~OYYMYfivu.999~OYYMYAvu.999~OYYMYA9vu.999~OYYMYAHvu.999~OYYMYAivX.999~OYYMYH9vX.999~OYYMYHAvA.uuu~OYYMYXvu.9HW~OYYMYXfv9.Fi9~OYYMYFvu.999~OYYMYhv9.FXH~OYYMYivu.999~OYYMLv9.Xfh~JMLEYv9.uXi~JLEYv9.uXi~wNv9n%2Bn9~875EJv0D4RVr~LMNNv%3DK~LM8EvuHi.XF.uXA.uWA~LMQNvg%3D~LGmvXMA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~Q7OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~x1wv78ku_lHtCZoUluN~QxEEj5M71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~1YEvu~NGOEv9.uHH~OYYvw1LYmz5~Qx8Ov~O7NvJ1Q7MQN~EmQv9~O1jyvOJk1xj7~w7Yjvu~QmGEv9.9u~GOEN1EOv9~OYYMJLEYvk1jQJ~GkjLv9.999~myG8Ov9.ui9~1NM75EJvu~875EJM8OvA~QJjjJLM71yM8OvO8eoyE7o1OoQB8k7YmeJQMGjmyoGm-ouo9~N1LL8JLVOv9~ONx7vfX~OmyGv9ou~8GNvu~&gdpr=0&prid=8PRVCXX19&cid=8CUB63XV6&crid=714553356&requrl=https%3A%2F%2Fswiftmoves.blog&vi=1684132281392029508&ugd=4&cc=CA&sc=QC&bdrid=262&subBdr=99&vgd_kwrf=https%3A%2F%2Fswiftmoves.blog&startTime=1684132281146&vgd_l1rhst=contextual.media.net&vgd_l1rakh=1684132280153540831&l1ch=1&l1hcsd=l1!Sjxfb|3093&cref=https%3A%2F%2Fswiftmoves.blog%2F&tsrc=entity&sttm=1684132281154&upk=1684132281.11310&hvsid=00001684132281155025035145512883&acid=4f51319245484e32b8d4ff9b61ca15a8&verid=3111299&vgd_sc=QC&vstrid=3271338731455172&vgd_vsidv=10&vsidtv=000V10&infr=1&stime=1684132280977&vgd_ecrid=S0300080711068100250025099999900&vgd_uspa=0&vgd_isiolc=1&vgd_fcm_enc_mis=1&vgd_pgid=p11333325165t202305150631&vgd_pgids=1

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Mon, 15 May 2023 06:31:22 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Mon, 15 May 2023 06:31:22 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 24ms
18ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzU0NDI1ODAzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyMTY4NjQ0NjUwMTUyMjk3IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExOTMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI1NzI4MDc1NTk3In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:25 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:25 GMT

GET
H3 200 5728075597 Show response
go.ezodn.com/dac/ 0
592 B 41ms
35ms XHR
text/plain 2606:4700:e4::ac40:a702
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/5728075597
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/porpoiseant/banger.js?cb=195-0&bv=226&v=74&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a702 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Mon, 15 May 2023 06:03:21 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rf29DpsRx2Z59OKV9JCuxFiYwqkFDC%2BxYGOh3hmhtkECTyXFrdhj15DN%2BzLylbmLrBCDmhXQefbYG1crfbPczGFTBIrLLoR8AVI7q8TvQckxdSnlVkcZZY18PwG2vzu29KLudE4WpxKlBCg%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 7c79566f0f6c196c-EWR
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 30ms
20ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDUtMTUifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 29ms
21ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImF1Y3Rpb25fZXBvY2giOjE2ODQxMzIyODMsImFkX3Bvc2l0aW9uIjoxMTkzLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiYmlkX2Zsb29yX2luaXRpYWwiOjI0MCwiYmlkX2Zsb29yX3ByZXYiOjEwLCJiaWRfZmxvb3JfZmlsbGVkIjoyLCJhdWN0aW9uX2NvdW50Ijo3LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MTAsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5N31d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:25 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:25 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 13FE 13 KB
5 KB 40ms
36ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118232
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E69B 783 B
534 B 47ms
43ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3258121fc8035f39bc094c648fbd108a3b0c9a9a2c2b90d3dad397d62459c68f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0MEFnv-2szcmXAiwdZZ6Uw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-0MEFnv-2szcmXAiwdZZ6Uw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:22 GMT
expires: Mon, 15 May 2023 06:31:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 327ms
327ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2650678337366972&correlator=4372049052244264&eid=31072879%2C31074172%2C31074302%2C31074524%2C31065518&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=1254144%3A22534415887%2Cswiftmoves_blog-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ifi=40&adks=2128035842&sfv=1-0-40&ris=2&rcs=6&prev_scp=a%3D%257C0%257C%26iid1%3D3560721336119830%26eid%3D3560721336119830%26t%3D134%26d%3D284837%26t1%3D134%26pvc%3D0%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod178%26ic%3D7%26at%3Dmbf%26adr%3D398%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dswiftmoves_blog-box-2-3560721336119830%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26bv%3D18%26bvm%3D0%26bvr%3D8%26avc%3D151%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D4%26br2%3D120%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C2030%2C4312%2C4312%2C5136%2C774%2C2030%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C2351%2C2610%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2761%2C3044%2C7%2C8%2C835%2C17%2C19%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3053%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%2C17%2C18%2C19%2C1428%2C2351%2C2610%2C2688%2C2693%2C2761%2C3044%2C3045%2C3052%2C3053%2C3856%2C4276%2C7%2C8%2C835%26amznbid%3D1mbwjy8%26amzniid%3DJAJVvPXZWQMz_quOSl8KrsUAAAGIHhsbAwEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCnIsgQ%26amznsz%3D250x250%26amznp%3D7oynls%26hb_bidder%3Dappnexus%26hb_adid%3D86ca6052547a1bb%26hb_opt%3D0.04%26hb_format%3Dbanner%26hb_ssid%3D10087%26hb_rt%3Dclient%26pwtsid%3D348ebee37f9fa5e%26lb%3D10%26reqt%3D1684132281638%26nam%3D1&eri=1&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132282729&lmt=1684132282&dlt=1684132272249&idt=516&adxs=495&adys=215&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fswiftmoves.blog%2F&frm=20&vis=1&psz=840x250&msz=250x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCviBB6l5Tb35AMDBzdou-9LxJTwoouzEC9D1XZt3mK8cqcefB1GPo_HErd63rW8kEeJn354hbsxAudAW%2CABHeCvhhFqDXilMmO5e0X7x1K018RcbKgpqp_vtkme8i_vL-D9z4LyXg5eMtdOjbsVqL84JHDHBwaY23z_cs%2CABHeCvgBbmfOSO_cuNXDYs0AT4Y5d9TvROFOCRJ4J3MPhQJGEzFO3fzNfTmCApvxebKWWD9T8XwxX9tU_Yd_%2CABHeCvhqxxNnUPIrZxjWRSq1tyOGXAvhHNSrzjic_GBSGQRLfL1qrV03Dgt_lYDX2Zjh0i1gBkIM7Fz9Yb68&ga_vid=1420665221.1684132273&ga_sid=1684132273&ga_hid=1561965060&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae70cf1d534ba4247203cb32cc51fab2b29c85bbed0ca07ddc9ea258210daa57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10543
x-xss-protection: 0
google-lineitem-id: 5728075597
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138354426988
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 896F 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuCB6AEfo-i1QPJMUzaRWEfMCVpstyO10sCVxTAmGDYrnnIdf0DZr7kOgEcWnTjdsjCT9woDwG347yfEeJ8bZbTe4JEW_wt2sr-JpSLvH4pv_mu7U55Ohtqz7ZXTj8rILA5lS-7EyPh2V_URUVRHkgvTxs-zvFaiged2D8v_1UWFntRrlB-ER9_T9WsnhEJZeSgiXFo-6TJA3StCq6_aVCpHeZIXxGrqRYahtibZ7Hx1P0G1VHjyKYCsue3j1o6O7B3er8sYAkd8IqFFwORVe851UUDk1WerlObNP_MG8vTbLJNefcDHLDjNsAw49zOVEMLfXh1Ze6B&sai=AMfl-YSA1rLvJ1GJF_4AL1XthZ9FfiIt6U2oJedBPxvbkrRaPNOXCJgdmZHp4Wnm1OGEarx-r3nRj_ZimKStn4wJ1hhPliFhw_iLHuyCNKkhteTYsGGYb_rhcdXrjpG5sUA&sig=Cg0ArKJSzGmQ26-WdHqcEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK script.js Show response
acdn.adnxs-simple.com/strikeforce/ Frame 896F 122 KB
43 KB 57ms
11ms Script
application/javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Fri, 12 May 2023 06:47:38 GMT
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 85420
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 43711
X-Served-By: cache-lga13622-LGA, cache-yul12824-YUL
Last-Modified: Wed, 10 May 2023 16:21:53 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Timer: S1684132283.806511,VS0,VE0
ETag: W/"645bc4a1-1e7fc"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Accept-Ranges: bytes
X-Cache-Hits: 97, 33261

GET
H2

200

controller
ssl.connextra.com/servlet/ Frame 896F
Redirect Chain

https://ssl.connextra.com/Betway/selector/image?client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_Pixel_1x1&_cb=677038075&apnauc=400591545173467976&bidid=400591545173467976&dspid=3bc1d7fd2e
https://ssl.connextra.com/servlet/controller?service=DDM_Betway_CA_Sports_Impression_Pixel_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_...

68 B
196 B

118ms
118ms

Image
image/gif

72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_Betway_CA_Sports_Impression_Pixel_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_Pixel_1x1&_cb=677038075&apnauc=400591545173467976&bidid=400591545173467976&dspid=3bc1d7fd2e
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4443eccbe460b086b56483fdbfdaafca2c11c369a796a56c097997b15c160660

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-served-by: vlp-cxtadsrv02.connextra.net
date: Mon, 15 May 2023 06:31:23 GMT
content-type: image/gif
content-length: 68
expires: Mon, 15 May 2023 06:32:07 GMT

Redirect headers

x-served-by: vlp-cxtadsrv08.connextra.net
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
vary: *
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
location: https://ssl.connextra.com:443/servlet/controller?service=DDM_Betway_CA_Sports_Impression_Pixel_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Betway&placement=DDM_APN_Betway_CA_Sports_Impression_Pixel_1x1&_cb=677038075&apnauc=400591545173467976&bidid=400591545173467976&dspid=3bc1d7fd2e
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/232/ Frame 896F 80 KB
28 KB 18ms
16ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/232/trk.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c93c88a9b0ecf4b158610988b79ffdc52501b1e995f14eb4dfc09c7eb9c3f6de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Thu, 25 Apr 2024 08:42:19 GMT
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 1633743
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27631
X-Served-By: cache-lga21975-LGA, cache-yyz4535-YYZ
Last-Modified: Wed, 26 Apr 2023 08:42:13 GMT
Server: AkamaiNetStorage
X-Timer: S1684132283.765561,VS0,VE0
ETag: "c342094e8bdad308ac07817d751fb315:1682498533.672161"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 13, 782788

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame 896F 0
933 B 20ms
17ms Image
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fswiftmoves.blog%252F&e=wqT_3QLeDfBM3gYAAAMA1gAFAQi1o4ejBhDIxtvwtPzLxwUYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVEREPQqAUR3UHcuLtgCAOAC4ZE86gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBf-OA_oFBAgAEACQBgCYBgCiBg43NjIwI05ZTTI6NjQ3NLgGAMEGAAAAAAAA8D_QBqkl2gYWChAAAAAAAAAAAAAACQpgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsbyF_2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW4xjQRBQSGdAGc1nQxBQUFJjVIsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0JCbUENEABtwzaBwYICcDw1AcA6gcCCADwB5GACIoIvAEKtwEAAAGIHhsrCAWPL-NOFuNIRSj7lA3s00YiDhYHrh9_WDUACdVBJpV8rMecT50k8tSE0tKgpF1Bk56jrKvuwOtXjxOJe7dop7EvlpfwLAWn0wt2ZMCC59vY_TUCY_LSJ_YgO7MDckamwByHWkOf-y_10SGPwDFC_1SXJpk_OplXVjgUTg-tExMy7WY2O0vLg0dFtHGI7C5bY8GHyL8SpoX9ZdbvVhANjlc9iYAFMsbbtisk7HAnCs4QAZUIAACAP5gIAQ..&s=9c592c4dbb99682798c65c8cb85d058073863e05

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: 4aa984e9-7cd8-4772-a35f-667d17c3198d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 896F
Redirect Chain

https://secure.adnxs.com/seg?add=31440544&t=2
https://pixel.mathtag.com/event/img?mt_id=1610862&mt_adid=115425&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA=&piggybackCookie=uid:102b6461-d1b1-4f00-b06c-5186e28fb05c

42 B
403 B

20ms
19ms

Image
image/gif

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA=&piggybackCookie=uid:102b6461-d1b1-4f00-b06c-5186e28fb05c
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 15 May 2023 06:31:22 GMT
Server: MT3 874 41fc63c master iad-pixel-x1 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA=&piggybackCookie=uid:102b6461-d1b1-4f00-b06c-5186e28fb05c
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:21 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 30ms
26ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiIzM2RkNTIzZjhlNGRkYTE1OGYwYWE5OTY4NmRkYTdmMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAuMDAwMDc2MTgyLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExOTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA3NjE4MiwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMTIsInN0YXRfc291cmNlX2lkIjoxMDA4NywiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJzdGF0X3NvdXJjZV9pZCIsInZhbCI6IjEwMDg3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0MDk1OTAzMjg0MTYyOTM2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExOTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6Im1lZGlhX3R5cGUiLCJ2YWwiOiJiYW5uZXIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQwOTU5MDMyODQxNjI5MzYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTE5MiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicHJlYmlkX3NvdXJjZSIsInZhbCI6ImNsaWVudCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:25 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:25 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 29ms
26ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAuMDAwMDc2MTgyLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExOTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA3NjE4MiwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMTIsInN0YXRfc291cmNlX2lkIjoxMDA4NywiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 896F 169 KB
52 KB 40ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A31A 0
0 42ms
41ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssmCLbSrF8I34PAi6z-7lgHdY5YLJ3s0l3_MjdQIIIyEH95qO331KLmrDHYzstp25kPE5LIxztnuyefMP8USJpOYYitAI9kyp5jWqTi7K4e-22RdwFdBc1zv4r9KrCh6f-Qj2Uua2TeXOx56PoFuYiRL2B3egb3kMmVdtRGUOZ-1i5_jkUwMRX03wD3Hvv27LqXynmVtnf5hsNuiLlXlWn8aZx5HoDhIquWs-dCP-cIJg0uFscOArpaNW75bMCuUKTZNjlP2J3wD-dTm_CLsO2UAZHSNxN6yO42i3fa5Pj1vlKrpL_9lvhAuyNkrIeuOGq4ISD0Xc1z&sai=AMfl-YRU9uvhlsyCpXjaZkIcala3IYFqNq2NHsGhlb6jkffuPSxFtvHitPXRjYLAXvViJ9jS1ykiTBzZIonynbJBSkMxoNVMtpj0NktPIaiXBRKb8jlGTXBaM-qn5iWICq8&sig=Cg0ArKJSzFXNagM5O9xuEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame A31A 91 KB
32 KB 49ms
45ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:22 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A31A 169 KB
52 KB 39ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:22 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk1MiwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzU0NDI2OTUyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0MDk1OTAzMjg0MTYyOTM2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExOTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTUyLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI1NzI4MDc1NTk3In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

GET
H3 200 5728075597 Show response
go.ezodn.com/dac/ 0
599 B 23ms
22ms XHR
text/plain 2606:4700:e4::ac40:a702
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/5728075597
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/porpoiseant/banger.js?cb=195-0&bv=226&v=74&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a702 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Mon, 15 May 2023 06:03:21 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9gr8deqL68sU%2FU46jVJ%2BRTiTe2mj2QufPdWKwmtYH5TY%2By7wZfsybm1TR4mEOZATCi4lJ%2FE1CStb9XWl0RZoyzGlbwh5Uk%2F3uEJMRAYYXHZuyqiTZGM8BxLqbv4Bh%2BXA1VTifJAIuqdqr3I%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 7c79566fbf97196c-EWR
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk1MiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDUtMTUifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI2In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImF1Y3Rpb25fZXBvY2giOjE2ODQxMzIyODMsImFkX3Bvc2l0aW9uIjoxMTkyLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiYmlkX2Zsb29yX2luaXRpYWwiOjI2MCwiYmlkX2Zsb29yX3ByZXYiOjEyLCJiaWRfZmxvb3JfZmlsbGVkIjo0LCJhdWN0aW9uX2NvdW50Ijo3LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MTIsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5N31d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk1MiwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMzAwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyMTY4NjQ0NjUwMTUyMjk3IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExOTMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIxNDQwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIzMDAifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6InRydWUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjU5MjM4MDE3NjQwODU2MjgiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NjAxODc5MDUzMSwiY3JlYXRpdmVfaWQiOjEzODQxNjI3NjA4NSwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTEwNCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiNDk1In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIyMTUifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MjA4NzYyODQyMTQ2MjE2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEyNywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjYyMTg1MjQ1MDMsImNyZWF0aXZlX2lkIjoxMzg0MjYwNjA3NTEsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjEwOTUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjI3NSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:21 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:21 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzI2ODY1NTc0MjE2NDMzNSIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMzQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo2MjA5NzY1OTIyLCJjcmVhdGl2ZV9pZCI6MTM4NDIxMDAzNzMwLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIxMDQwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMDc0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 27ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:22 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 480 B
419 B 170ms
170ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 4c8aa95c5eb0a14554e4005f7fd415168330915205db15fc46c733b674eb785c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 147
content-length: 267

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 913 B
2 KB 130ms
83ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%226758e349c4502cb%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250d_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=832fed68-2053-4611-b9d7-2180be87a210&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

f662b2d1b0cf182cd93cdded2680f1c97a8071a1558c991ebc69e1cf66807f5f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 527
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 112ms
111ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250d_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=f2edf989-63ed-4aab-b08d-9f141e292a3e&l_pb_bid_id=698b88847f0609f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250d_desktop&slots=1&rand=0.764356815377554
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 3ef4d22f34c0a03c5b94551885b77433b72b5c72e95aa556c90f73da67b232da

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 94 B
2 KB 127ms
80ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 9effacd44412ecf73965d401f965a3facce282da0a269207d7e0d001c2385abf

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:22 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 30ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 37 B
504 B 47ms
46ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f0cd254c82aed4affbfa577d5b240a0150e9e28917fecb8b7ba359a392b3b27

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hypt%2F7PRboI0Xp7UE5MtPXRy0AFJ61OT7jME9L3mrLFyLXdiuM393GGb2omZO9ohV%2FchLOBRNmnL3BDQt3S%2Fpq4eTbVLre3Zmebf3NjzgCJ945mg9poLW9maozaWSPwrq1bF%2FdKW"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c79566fc83da210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 96ms
96ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250d_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=f2edf989-63ed-4aab-b08d-9f141e292a3e&l_pb_bid_id=770542225fe7f56&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250d_desktop&slots=1&rand=0.6777202646338776
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a93b43b89be41afa43155ee68dc90cbeb2c16d80b1e5cd8ca2fe3358a9f879f8

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 15 KB
7 KB 101ms
100ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 736fdd610d0f914cd7be8acccb09dafe36b76d3074677df412ac6609efcb9137

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:22 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 139 B
1 KB 19ms
19ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

cb6905658ec4b8a1a584b1d31c863e9d4026414631e9254bcb3707480bee26eb

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:22 GMT
AN-X-Request-Uuid: 80dd463c-355c-40f7-a1fe-40bca68e068a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 139
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame AD9F 0
17 B 379ms
375ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvlid&c=2913416228924394&e=31072019%2C31074536%2C31074542%2C31061691%2C31061693&ctx=1&met.9=1.jx~13.nj~2.nz~9.0~3_101.14q~7_101.0~9.0~3_112.17z~7_112.0~4_101.1bw~5_101.1cj~6_101.1cm&met.3=947.o7~5.o7~74.o7_2~947.o9~43.o9_1~74.oa~947.oa~43.oa~74.oa~947.oa~43.oa~74.oa~947.ob~43.ob~74.ob~947.ob~43.ob~74.ob~947.ob~43.ob~74.ob~947.oc~43.oc~74.oc~947.oc~43.oc~74.oc~947.oc~43.oc~74.oc~947.oc~43.oc~947.oc~1.oc~947.od~6.od~947.od~86.od~947.od~86.od~947.od~86.od~91.od~95.od_1~95.oe~95.of~95.of~95.of~95.of~95.of~95.of~95.of~95.of~77.o7_9~724.oi_1~724.oj~724.oj~724.oj~724.oj~724.oj~724.oj~724.oj~724.oj~724.oj~894.ol~112.r1_1~947.rw~86.rw~76.rw~738.ta~749.tb_3~94.te~947.tl~573.tl~598.tl~598.tl~598.tl~598.tl~598.tl~598.tl~598.tl~598.tl~598.tl~598.tl~113.tk_2~736.tp_1~740.tv_1~735.u2_1~54.v3~54.v3~598.v4~598.v4~947.vc~947.vc~573.vc~54.vc~598.vc~54.vc~54.vc~598.vc~54.vc~598.vc~54.vc~598.vc~54.vc~598.vc~54.vc~598.vc~54.vc~598.vc~54.vd~598.vd~54.vd~598.vd~54.vd~598.vd~54.124~54.124~598.124~598.124~598.124~947.126~947.126~573.126~54.126~598.126~54.126~598.126~54.126~54.126~598.126~54.126~598.126~54.126~598.126~54.126~598.126~54.126~598.126~54.126~598.126~54.126~598.126~54.126~598.126~598.13z~947.13z~947.141~947.141~573.141~54.141~598.141~649.141~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~947.142~573.142~54.142~598.142~598.142~649.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.142~598.142~54.143~598.143~54.143~598.143~54.143~598.143~947.143~11.143_2~725.146~894.148~1132.14e_c~808.14r~808.14r~54.16g~54.16g~598.16g~598.16g~598.16g~598.16g~947.16i~947.16i~573.16i~54.16i~598.16i~54.16i~598.16i~54.16i~598.16i~54.16i~54.16i~598.16i~54.16i~598.16i~54.16i~598.16i~54.16i~598.16i~54.16i~598.16i~54.16i~598.16i~54.16i~598.16i~598.17n~947.17n~947.17o~947.17o~573.17o~54.17o~598.17o~54.17o~598.17o~649.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~947.17o~573.17o~54.17o~598.17o~54.17o~598.17o~598.17o~649.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~54.17o~598.17o~947.17p~11.17p~725.17p~894.17q~1132.17t_5~808.17z~808.17z~646.1bw_1~800.1bx~800.1by~800.1by~800.1by~800.1by~774.1cm~653.1cn_d~801.1d0~801.1d0~844.1d0~844.1d0~710.1d0~825.1d1~355.1d1~825.1d1~54.1d1~598.1d1~54.1d2~708.1d1_1~598.1d2~708.1d2~647.1d3~965.1d3_1~54.1dd~54.1dd~598.1dd~598.1dd~598.1dd~598.1dd~598.1dd~947.1df~947.1df~573.1df~54.1df~598.1df~54.1df~598.1df~54.1df~598.1df~54.1df~598.1df~54.1df~54.1dg~598.1dg~54.1dg~598.1dg~54.1dg~598.1dg~54.1dg~598.1dg~54.1dg~598.1dg~54.1dg~598.1dg~598.1ds~947.1ds~947.1dt~947.1dt~573.1dt~54.1dt~598.1dt~54.1dt~598.1dt~54.1dt~598.1dt~649.1dt~54.1dt~598.1dt~54.1dt~598.1dt~54.1dt~598.1dt~54.1dt~598.1du~54.1du~598.1du~54.1du~598.1du~54.1du~598.1du~947.1du~573.1du~54.1du~598.1du~54.1du~598.1du~54.1du~598.1du~598.1du~649.1du~54.1du~598.1du~54.1du~598.1du~54.1du~598.1du~54.1du~598.1du~54.1du~598.1du~54.1du~598.1du&met.10=1_10.IP8GEAAIABiAmHUoAQ~1_3.IP8GEKinAgj4yQQYgJh1KAE~1_4.IP8GEAAIABiAmHUoAQ~1_8.IP8GEAAIABiAmHUoAQ~1_1.IP8GEKinAgj4yQQYgJh1KAE~1_5.IP8GEAAIABiAmHUoAQ~1_9.IP8GEAAIABiAmHUoAQ~1_7.IP8GEAAIABiAmHUoAQ~1_2.IP8GEAAIABiAmHUoAQ~1_6.IP8GEAAIABiAmHUoAQ~1_10.ILgHEAAIABiAmHUoAA~1_3.ILgHEAAIABiAmHUoAA~1_4.ILgHEAAIABiAmHUoAA~1_8.ILgHEAAIABiAmHUoAA~1_1.ILgHEAAIABiAmHUoAA~1_5.ILgHEAAIABiAmHUoAA~1_9.ILgHEAAIABiAmHUoAA~1_7.ILgHEAAIABiAmHUoAA~1_2.ILgHEAAIABiAmHUoAA~1_6.ILgHEAAIABiAmHUoAA~1_1.IKYLEAAIABgAKAA~1_101.IMYLEAAIABiAmHUoAA~1_2.IKUMEAAIABgAKAA~1_112.ILIMEAAIABiAmHUoAA&met.7=CCIQBBgBIAkoCTAyOCloC3AyeKwCsAEBuAEDwAH2j4S6Bg~CBsQCiAKOKUBwAHylpCFBA~CE0QChgBIAooCjA7ODFoC3AweNWkA4ABqaIDiAHExgqwAQG4AQPAAejupb0D~CBIQBxgBIIYDKIYDMMYDOEBokQNwwwN40geAAaYFiAHaMaoBFAoSUm9ib3RvOjMwMCw0MDAsNzAwsAEBuAEDwAHWx7vICg~CBsQByCGAzguwAGmwY2DBg~CBsQByCGAzguwAHU9dLuAg~CBsQCiCGAzhCwAHxnNThCA~CBsQCiCHAzh_wAHjo4HbCA~CA0QChgBIIcDKIcDMMgDOEBokgNwwgN4v8cBgAGTxQGIAcnQBLABAbgBA8AB4dvm3Qs~CBsQCiCIAzh-wAG__uGdAw~CBsQCiCIAzg8wAHZ67DzCg~CBsQChgBIIgDKIgDMNIDOErAAYzV2OsE~CDYQChgBIIgDKIgDMN8DOFfAAcnjvbwF~CBsQCiCIAzhYwAGurcf1DQ~CEMQChgBIM4FKM4FMKkGOFtozgVw8gV4_OMHgAHQ4QeIAd-OGbABAbgBA8ABiOPQywE~CDwQDRgBIM8FKM8FMPUFOCdozwVw9AV4ugWAAY4DiAGMB7ABAbgBA8AB6NSvzQk~CBsQChgBIOUFKOUFMNQGOG7AAYzV2OsE~CBsQCiDsBTgdwAHA1M7vCg~CBsQCiDuBThJwAGrjprVDQ~CBsQDSDwBTiDAcAB5ZD87g8~CBsQBiDwBTgpwAGG7L72DA~CBsQBiDwBTgiwAGGzY_yBw~CBsQBiDwBTgiwAH84_2ZCw~CCgQChgBIPEGKPEGMJcHOCZo8gZwlQd4hbkBgAHZtgGIAcrqA7ABAbgBA8ABm-H6cA~CBsQCiD9BjgcwAHoypfvDg~CBsQCiCJBzgiwAHpnNP9AQ~CBsQBiCEBzhuwAH_3fa_CA~CBsQBiDHBzgZwAHbp7SGDA~CBsQBiCFBzh_wAGXl7vVDw~CBsQBiCEBziPAcAB07jNuAQ~CBsQBiCFBziQAcAB-cLixgg~CCIQBBgBIKIIKKIIMMoIOChooghwyQh4rAKwAQG4AQPAAfaPhLoG~CBwQBhgBIKoIKKoIMM8IOCVoqwhwzgh4rAKwAQG4AQPAAZSE4rUO~CBsQDSDzCDhpwAGs8MCpAQ~CBsQDSD2CDhpwAHp_P2pDA~CBsQDSD4CDh-wAG9m-mVBw~CBsQDSD8CDh1wAHbu8__Cw~CBsQDSD-CDiAAcAB27vP_ws~CBsQDSD9CDi5AcAB-6GJwg8~CBsQDSCACTi1AcAB2uGGnQE~CBsQDSCCCTjKAcAB5IOfqA0~CBsQDSCDCTj4AcABwpKj2gI~CBsQDSDiCjg1wAGs8MCpAQ~CBsQDSDjCjhDwAH7oYnCDw~CBsQDSDgCjh_wAHbu8__Cw~CBsQDSDkCjhtwAG9m-mVBw~CBsQDSDlCjh-wAHCkqPaAg~CC8QBxgBIKoLKKoLMM4LOCRoqwtwzQt4kAOAAWSIAWuwAQG4AQPAAZv_iccH~CCcQDRgBILsLKLsLMOsLODBovwtw6At4l1qAAetXiAGtdLABAbgBA8AB8_LLrgs~CBsQDSDkCjiWAcAB27vP_ws~CBsQDSDlCjiZAcAB6fz9qQw~CBsQDSDmCjiFAcAB2uGGnQE~CBsQBiCmCzhMwAHZgty5Cg~CC8QBxgBIKoLKKoLMNILOCloqwtw0gt4kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CBsQDSDiCjiqAcAB5IOfqA0~CBsQBRgBIL0LKL0LMPALODJoywtw7gt4iReAAd0UiAGSMLABAbgBA8AB_6n_oQ8~CBsQDSD_CzgwwAGs8MCpAQ~CBsQDSCBDDg6wAH7oYnCDw~CBsQBiClDDgYwAHZgty5Cg~CBsQDSD9CzhhwAHbu8__Cw~CBsQDSCADDhVwAHCkqPaAg~CBsQDSCBDDhTwAHa4YadAQ~CCcQChgBIIQMKIQMMKoMOCbAAeLBm9oF~CBsQDSCADDhowAG9m-mVBw~CBsQDSCCDDhxwAHp_P2pDA~CC8QBxgBIKcMKKcMMM8MOChoqAxwzgx4kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIKcMKKcMMMwMOCRoqgxwywx4kAOAAWSIAWuwAQG4AQPAAZv_iccH&met.1=1.lhogvkrd~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.az~23.az&qqid.1=CMWO09PZ9v4CFVLV4Qod9ZUKXg
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AD9F 107 B
122 B 40ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AD9F 107 B
122 B 39ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 25 KB
11 KB 264ms
262ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=945966139005486&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250c_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=3&adks=453499054&sfv=1-0-40&prev_scp=hb_format_oftmedia%3Dbanner%26hb_size_oftmedia%3D300x250%26hb_pb_oftmedia%3D0.05%26hb_adid_oftmedia%3D6244a90afa49ab2%26hb_bidder_oftmedia%3Doftmedia%26hb_deal_oftmedia%3D1073036%26hb_deal%3D1073036%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.05%26hb_adid%3D6244a90afa49ab2%26hb_bidder%3Doftmedia&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132282854&lmt=1684132282&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=qg48voado4ea&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

528a21a2851d1eae9ffe9bbc2893970225bc52a2c55579b4e6044b46bff785c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11179
x-xss-protection: 0
google-lineitem-id: 5111852800
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138274588173
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8208 42 B
64 B 44ms
44ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuHY2DHLYRk8UcJEfgYnOj_cFD5IxQcvbL-QLXlhCfuhuUqaO1eyiXyd17TD8C0M4PVSrxnnjpDkxpaPNa7hCnvcwUSrrqGLAgTOTDGYlwWs8hY2CYaOoFGoGF6L4TwEtL1NiM&sai=AMfl-YSyMSYE_BZYrGKbmbTubHtBKUtO-sf_OA2_jOMMk5PtWHCYIgU7FZv5qjKT0uWe46SnUzQNNJCJ8lGs1qvbXQsjcVeITr-eT4E&sig=Cg0ArKJSzG7DgbWWVxq7EAE&cid=CAQSKQBygQiDRu_c_0v6oW_RHSIgCQydeRrAlZ8NFZuBWPddVQqEuhsNayz9GAE&id=lidar2&mcvt=1065&p=0,0,90,728&mtos=1065,1065,1065,1065,1065&tos=1065,0,0,0,0&v=20230510&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2655341515&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132280605&rpt=1220&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK j-6834967-3881893.js Show response
cdn.flashtalking.com/xre/683/6834967/3881893/js/ Frame EF30 97 KB
25 KB 135ms
26ms Script
text/javascript 205.185.216.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/683/6834967/3881893/js/j-6834967-3881893.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/1/193398;6834967;201;js;GeniusSports;CAProspectingSportsGeniusMediaAppnexusSPOPRONHLOMP160x600/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fswiftmoves.blog%2F&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}&cachebuster=717040.920199119
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: c4a22c1396d55009eceae5257cc84e4b2c5c7e4baf817e824c791a2bcf7f6df7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
x-amz-request-id: FS1GQ01FHWYGWYKE
Connection: Keep-Alive
Content-Length: 25303
x-amz-id-2: nLm3dDLmGBuSU5KQ9gOnfAnpxfZTurslceyHUN08eiz86BHDv7Wg81jX32heOF8n7OfBlbztty4=
Last-Modified: Fri, 12 May 2023 08:59:59 GMT
ETag: "1683881999"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
X-HW: 1684132283.dop030.dc2.t,1684132283.cds224.dc2.shn,1684132283.dop030.dc2.t,1684132283.cds246.dc2.c
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=276
Accept-Ranges: bytes

OPTIONS
H2 204 1a
i.clean.gg/ Frame 0
0 59ms
26ms Preflight
text/plain 34.95.69.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=utf-8
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.6
via: 1.1 google

POST
H2 200 1a Show response
i.clean.gg/ Frame 896F 0
104 B 29ms
27ms XHR
application/octet-stream 34.95.69.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
via: 1.1 google
server: nginx/1.21.6
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/1/193398;6834967;201;js;GeniusSports;CAProspectingSportsGeniusMediaAppnexusSPOPRONHLOMP160x600/ Frame 896F 1 KB
1 KB 33ms
32ms Script
text/javascript 23.192.1.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.1.177 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

prod-xre-app23.ash11 /

Resource Hash

083fbf45bcf56b543efe2f6b5a1f59220ac60588b04ba230fcd3422e5b2dbb1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=86400
Server: prod-xre-app23.ash11
Vary: Accept-Encoding
Content-Type: text/javascript;charset=ISO-8859-1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 658
Expires: Mon, 15 May 2023 06:31:23 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame A31A 356 KB
120 KB 66ms
65ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 27ms
26ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:23 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 16 KB
8 KB 141ms
140ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e993a75d02f6aa8f99364bfd8087f7faaa067ca7afc578ac9de750788ef58596

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: d241a580-b4d5-4c09-af62-8972071e5c5b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
412 B 93ms
90ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250e_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=6e44c5ed-8ffb-49a8-a048-6843d21f3750&l_pb_bid_id=87a667205cab613&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250e_desktop&slots=1&rand=0.9317031855630515
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 7662f3f718f2b9270d61775dfa0dd68536d1f5b17db43a1f11ab02883e694de9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 15 KB
7 KB 107ms
105ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2d4135e51dfe576b0c51745d3b6673599717cb0b6042fb098694e4f700a98084

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 881 B
3 KB 80ms
79ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2291805e3e7624d18%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250e_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=d61d0764-c923-4823-838f-721c06ee7170&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

4bf41f9bef24e6af73c3497c2527d9fa1a546d6e7fff9138221f419e04ff04cd

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 535
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 6 KB
4 KB 148ms
146ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 6d8a7a122f2cad063253ed18e5ed3648160dfebb1da6676c811aaa9df64a1a50

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 123
content-length: 3499

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 37 B
506 B 54ms
53ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d21b397c780345f83cb8f6eb5471b88c8490315dc92c4ad486f0a997abb658c8

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktIywfvZcfEjI6mXpcMALXmIwv96KeK6%2FwVdqFiR96mLX79yoSnaboiQ%2BPrkVNlK3UHZ6P5kyqJLLcTts9CRXnfYlpi5SIkuEBBUHU%2FqRepAefOLgKVS9OKqQ%2B5Hs9ciZlLD94bz"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c795670e9a4a210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 111ms
111ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250e_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=6e44c5ed-8ffb-49a8-a048-6843d21f3750&l_pb_bid_id=97e2d6e121a1091&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250e_desktop&slots=1&rand=0.9749511466615608
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 846b7e5d3e70fde386ce445394a33f8c4255232e3bafba3e340d607404692198

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 40ms
33ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
2 KB 133ms
85ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b49bf8422941bb2a1a81da33115301623b1ef2676a19d96d7cf9b88f1526736f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 100

GET
H3 200 audio_024.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 39ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_024.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e463c28089a92c441eed46384d451a57f62db66e018acb109c69b9ff2c519bc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mvaVJLhbhI7qbhu%2BYGTrSkJW6JZzQwuPILKTo1RUexS3Qv%2F3c9qcR%2FT%2BIeKuiGDz2z3A4u5hiRzCPe1TEWh8T6wolm6QBMRUoNcjhkPV%2F0BBIP1pZCSQfWlC3INa1mZfiEkMruGbkj61BPvPG4Nf8I80"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795670fc345437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40731

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 25 KB
11 KB 234ms
233ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=1581526372937272&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250d_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=4&adks=1925621845&sfv=1-0-40&prev_scp=hb_format_medianet%3Dbanner%26hb_size_medianet%3D300x250%26hb_pb_medianet%3D0.01%26hb_adid_medianet%3D836a9904f50632b%26hb_bidder_medianet%3Dmedianet%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.01%26hb_adid%3D836a9904f50632b%26hb_bidder%3Dmedianet&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132283043&lmt=1684132283&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=4npx71u3ia3r&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

59aaf0fd71479717f90b36eec851c7e3d8e2b9b528dde704a0999fd6ab66c643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11133
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432754704
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E69B 0
0 41ms
36ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202305090101&jk=2913416228924394&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame A31A 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db0a6579290f4319c41c97b0ab856c444373dc236023ebe3d8e8c97fb74ea5d8

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1041 0
0 60ms
58ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuyFMWYRPdQpZrxNjLJ1A4hJ0HG76LEs_p7AOOaCyYaxFsqWhPlBkx2-S7gq-Evh7c4m83r_ykb02yMhH1N5dIb3TTqPRIGHQ1PXR5ECiMG0-e66ayq_IuXpmjn5JtgpQTPZaMBokDrUIyKi3fspdQjcY8Aib0bAERcHfas4RcHzzmWEGlWgSfdme7InNNzDOyx2kKz2Ejma-SAl9qhfAgybZS5DmZFTEWxU-oYYoTJMAFw3jPB8lvATfBL5N8O40tlFJqjemQzNtNAJPVILAbcm1WW3CfgCEoGUMhT7eoIAj2lKSF7qcGNb0Iyv64IiKE-fYdgPBwr_g&sai=AMfl-YTxlJFiaXn9n0N7aP8Kal3EEEmFCVajBNvV2cLhK15XE612EWhgcuQcn0ovcKTPKiGIsTqz9AcfiAYnl9SYxGahb4ZA9M3Zu4PEjFUfUaLAB1b0SfCppYknq6TimyU&sig=Cg0ArKJSzEYkXcfkfgWREAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 1041 91 KB
32 KB 55ms
53ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1041 169 KB
52 KB 52ms
49ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 11CD 42 B
64 B 47ms
47ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuU3CvuMNJ1LmrasxDQw9raIHd6vU-TFxqfw-Z3o--H5aZCctr0FbPU-o6NMJBywZdTxd50J1TOaRtp9C0XgGA8cMv8QQVCdzfGw1iwzESHg9aoxQEc&sig=Cg0ArKJSzJnoGvahlafcEAE&id=lidar2&mcvt=1053&p=275,1095,529,1345&mtos=0,1053,1053,1053,1053&tos=0,1053,0,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.98&vu=1&app=0&itpl=19&adk=1937768148&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132280956&rpt=1062&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 13FE 37 KB
14 KB 49ms
48ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540914
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H/1.1 200
OK j-6834967-3881893.js Show response
cdn.flashtalking.com/xre/683/6834967/3881893/js/ Frame 896F 97 KB
25 KB 23ms
23ms Script
text/javascript 205.185.216.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/683/6834967/3881893/js/j-6834967-3881893.js
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: c4a22c1396d55009eceae5257cc84e4b2c5c7e4baf817e824c791a2bcf7f6df7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
x-amz-request-id: FS1GQ01FHWYGWYKE
Connection: Keep-Alive
Content-Length: 25303
x-amz-id-2: nLm3dDLmGBuSU5KQ9gOnfAnpxfZTurslceyHUN08eiz86BHDv7Wg81jX32heOF8n7OfBlbztty4=
Last-Modified: Fri, 12 May 2023 08:59:59 GMT
ETag: "1683881999"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
X-HW: 1684132283.dop030.dc2.t,1684132283.cds224.dc2.shn,1684132283.dop030.dc2.t,1684132283.cds246.dc2.c
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=276
Accept-Ranges: bytes

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_024.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 142 KB
142 KB 50ms
50ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_024.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aecb941c5b91497fc739806b4dfdf948be8842a22703a950d567262d4589aa45

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1121
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OhFvTfz1mPdo0FfX1miYTKqYZ7QcyILcqkGAG0SRW%2Buf5cB%2FWWJIEyCfgwwhhT26ToziXDlo7desW9pzp6xpWflfzaIw2s%2FcTGqG84cZ4gbKOGh19oVr8n2XFrYQbKp3rT7dHGIW6tIajiTndvH%2F%2FLc%2F"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c7956718cee5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 145190

GET
H/1.1 200 d9core Show response
d9.flashtalking.com/ Frame EF30 11 KB
11 KB 156ms
25ms Script
application/javascript 18.204.50.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/683/6834967/3881893/js/j-6834967-3881893.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.50.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-50-167.compute-1.amazonaws.com
Software: Apache/2.4.52 () OpenSSL/1.0.2k-fips /
Resource Hash: 6ebd1c1542d86258d99cf5751150225154b0d248c9c081fcd86f80722d1ce2b1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:22 GMT
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fips
ETag: 5bc31bf7d4a298e1bef9d35fce222bfc
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: d9.flashtalking.com
Content-Type: application/javascript;charset=utf-8
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 10814

GET
H2 200 iframe Show response
c.bannerflow.net/scripts/ Frame E5CE 2 KB
1 KB 192ms
137ms Document
text/html 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/683/6834967/3881893/js/j-6834967-3881893.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2da5e0a4637e412b237d8a941f6800b3748cbdc969402c1cac8d3174e43d597e

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cf-cache-status: MISS
cf-ray: 7c795671ffda7151-YUL
content-encoding: br
content-md5: pRIJ2/N21dbBjDWXiJP+cQ==
content-type: text/html
date: Mon, 15 May 2023 06:31:23 GMT
last-modified: Wed, 29 Mar 2023 06:31:05 GMT
server: cloudflare
vary: Accept-Encoding
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: d7ee3322-201e-005a-2bf6-868bc1000000
x-ms-version: 2011-08-18

GET
H/1.1 200
OK score.min.js Show response
js.ad-score.com/ Frame EF30 443 KB
140 KB 150ms
43ms Script
application/javascript 2600:9000:24fd:6a00:a:deb0:3380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/683/6834967/3881893/js/j-6834967-3881893.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:6a00:a:deb0:3380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c16b3168220a708c3faa49795c9754a9789176522f2c2ee896255c4548f2fb96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Sun, 14 May 2023 19:35:31 GMT
Content-Encoding: br
Via: 1.1 5cf3f25bf905bc6e52b9e72f44811c98.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CMH68-P2
Age: 39352
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Sun, 14 May 2023 19:35:31 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Cache-Control
X-Amz-Cf-Id: QNz6TpzxFGvyHuJTvn2JB0h6XPfDfrIVV0VzOHLc4zo_ZjG6CS3e_g==
Expires: Mon, 15 May 2023 19:35:31 GMT

GET
H/1.1 200
OK iconc.png
secure.flashtalking.com/oba/icon/ Frame EF30 1 KB
2 KB 121ms
18ms Image
image/png 104.126.112.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.112.56 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-112-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Last-Modified: Sat, 12 Apr 2014 19:14:31 GMT
Server: Flashtalking (AKA)
ETag: W/"db320ef6f3c45ab5c90887ef618de2bb"
X-FT-Origin: us
X-Varnish: 856463642 467897440
Content-Type: image/png
Cache-Control: max-age=1982745
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1308
Expires: Wed, 07 Jun 2023 05:17:08 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6710 52 KB
17 KB 50ms
10ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 545
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:23 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 591
X-Served-By: cache-lga13626-LGA, cache-yul12820-YUL
X-Timer: S1684132283.200137,VS0,VE0

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame EF30 0
933 B 41ms
19ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QL1D_BM9QcAAAMA1gAFAQi1o4ejBhCSv6Dtjsih00MYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVERENhEd1B3Li7YAgDgAuGRPOoCGGh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nL_ICEQoGQURWX0lEEgcxaY8c8gISCgZDUEcBFAAIcXsBFQgFQ1ABFAQJMnF6OPICDQoIQURWX0ZSRVESAQkQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwFZEQ8QCwoHQ1AVDhAQCgVJTwFhCAc3NoUEAPIBIQRJTxUhOBMKD0NVU1RPTV9NT0RFTAErFADyAhoKFjIWABxMRUFGX05BTQVxCB4KGjYdAAhBU1QBPhBJRklFRAE-HBUKCFNQTElUAU0Z2fCagAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF______8BBRgBwAUAyQUABQEU8D_SBQkJBQuIAAAA2AUB4AUB8AX_jgP6BQQIABAAkAYAmAYAogYONzYyMCMNYxg3NLgGAMEGATIwAADwP9AGqSXaBhYKEAkRGQFgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsb0GW2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW5RpARBQUG0AGdVtAxBQUFJrWksSm9CQWdnQXFBRUFzLiAAeEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0tBgQ0QAG3CNoHBgH_8NcYAOAHAOoHAggA8AeRgAiKCLwBCrcBAAABiB4bKwhDpoZA7agfkrsNgvisLJd_RAsieScCofRsnY1ACVKksQY8ZQTDVVDtKfNljNwvVZMr_2-GFEZ_k6_MBg64X90_Ap0u8gQKKJqetiGsi-VnFXmnHOLk-g9qJyVrB4a5bHCjrZdOr6wrdTsfWaNzM5tp4U2Enb6JA3gcDstcLx4zqP0njNwEQyJenkafKmiQY0bCo-OYi59TzMNzYEe16nF0Y48hP5Nx4w5WPRKjbpsaEAGVCAAAgD-YCAE.&s=2ea2916fab6a5f5f6cb70199698405575ff48122&bdref=https%3A%2F%2Fswiftmoves.blog%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F&

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: ae2ef313-7f89-4d47-ac74-4b76851c6e2a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F744 0
0 56ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstKmmQl5wVVHOkqsNyinVQYocpIz6FEI35k0GtHMdh1PdSNHemcRRHdmVrZLGcXKF_90agvu5FW_TSyFgJ0ytnVCMh8CeGU0oEJa3HKF9SSwdqcYOTB5fLeRHYpeSBbW1qncpDSAR01dc3PQgPVlHPCjEObLPA0Zn5xKN8Gq40kpR2i5Gx5RvWDGUZd1KceLVamYa9V6v5rhN5QfSW3z-NRi1zahBrWkl_7RTD5nOQizo30VkhqYeYhoDhGrH20hR0pGCGVXUunMaVyxHSgLqI-zJGYpFWqmTMFjlQfmp5T5eaG61XwYc_UvXFT4aXDRHx3fFbfytM&sai=AMfl-YTdD7GLu27kcze1qrgGHqoZjHoA9w6scqk6Q8js7hVLCpKvmbNIuc4YZlw0S_LzCbnL6-K9Bt9TLP69QgOYJ5-suTpsiXU-h4UJx_KB3ZFZFEBLceSqBF7s__0P558&sig=Cg0ArKJSzFU6v7ae_ifxEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 / Show response
a2.adform.net/adfscript/ Frame F744 2 KB
1 KB 223ms
18ms Script
text/javascript 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/adfscript/?bn=62821215;click=https://nym1-ib.adnxs.com/click?1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjY0ODU=/bn=86922/clickenc=;encodedclick=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3D;ord=677038075

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7a7ab05277cdee93292ad3bd285d97e98fb62d64f81515df5ef7a17bf191cdec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 942
expires: -1

GET
H2

200

controller
ssl.connextra.com/servlet/ Frame F744
Redirect Chain

https://ssl.connextra.com/Wildz/selector/image?client=Wildz&placement=DDM_APN_Wildz_CA_Casino_Impression_1x1&_cb=677038075&apnauc=1467010799116474712
https://ssl.connextra.com/servlet/controller?service=DDM_Wildz_CA_Casino_Impression_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Wildz&placement=DDM_APN_Wildz_CA_Casino_Impression_1x1&_cb=6...

95 B
223 B

123ms
123ms

Image
image/gif

72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_Wildz_CA_Casino_Impression_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Wildz&placement=DDM_APN_Wildz_CA_Casino_Impression_1x1&_cb=677038075&apnauc=1467010799116474712
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 18c327afa903633f86c3efcf12b77f098077eacaa8be101bb007846fd74f8b93

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-served-by: vlp-cxtadsrv02.connextra.net
date: Mon, 15 May 2023 06:31:23 GMT
content-type: image/gif
content-length: 95
expires: Mon, 15 May 2023 06:32:08 GMT

Redirect headers

x-served-by: vlp-cxtadsrv08.connextra.net
pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
vary: *
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
location: https://ssl.connextra.com:443/servlet/controller?service=DDM_Wildz_CA_Casino_Impression_1x1&pubhost=swiftmoves.blog&image=image%2Fgif&client=Wildz&placement=DDM_APN_Wildz_CA_Casino_Impression_1x1&_cb=677038075&apnauc=1467010799116474712
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/232/ Frame F744 80 KB
28 KB 59ms
16ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/232/trk.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c93c88a9b0ecf4b158610988b79ffdc52501b1e995f14eb4dfc09c7eb9c3f6de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Thu, 25 Apr 2024 08:42:19 GMT
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 1633744
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27631
X-Served-By: cache-lga21975-LGA, cache-yyz4531-YYZ
Last-Modified: Wed, 26 Apr 2023 08:42:13 GMT
Server: AkamaiNetStorage
X-Timer: S1684132283.217416,VS0,VE0
ETag: "c342094e8bdad308ac07817d751fb315:1682498533.672161"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 13, 765194

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame F744 0
933 B 46ms
18ms Image
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fswiftmoves.blog%252F&e=wqT_3QKmDfBMpgYAAAMA1gAFAQi1o4ejBhDYsv_XydH3rRQYyLrI8MzCwaEnKjYJ1njpJjEItD8RhtpnfPzxpD8ZAAAAIK7HIEAhhtpnfPzxpD8p1XgJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUOblrMwBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAfoBoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNDQ2OTQ0MywgMCk7dWYoJ2knLCA3NzY0OTM4LCAwKQUULGcnLCAxOTQ5OTk0NxUpLHMnLCAyNzk3MzkxMxkWAHIBUxwyODU1MjkzNAUs8IuSAqUEIWltM2hjd2lYelB3WkVPYmxyTXdCR0FBZ3liRkxNQUk0QUVBQVNKZzVVT2FtZ0ExWUFHQ2dCV2dBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQ3FnQkNyQUJBTGtCX3ptMEQwWUl0RF9CQWY4NXRBOUdDTFFfeVFFQUFBQUFBQUR3UDlrQkFBQQUOdDhEX2dBY3IzMlFQMUFYTGxIajZZQWdDZ0FnRzFBZwEjBEM5CQjYREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3R2lBdzRJMkltbkpoQUxHQUl0QQFDwExvRENVNVpUVEk2TmpRNE5lQUR4ai1BQlBqVHpRcUlCSWlqelFtUUJBR1lCQUhCQkEBNQkBCHlRUQkJAQEYTmdFQVBFRQELCQFgQ0lCZFV5a0FYUTlWbVlCWUgyc1lVQnFRVQkfGEFEd1A3RUYBDVA0Tm5UNkRfQkJjM016RXl1M01NX3kuKAAAOQkoCQEIRFpCEXfwQ1BBXzRBV1JQZkFGcTVlbUNmZ0Z3LVdRQW9JR0ExVlRSSWdHQkpBR0FaZ0dBS0VHMl9sLWFyeDA3ei1vQmdTeUJpUUpBCVUBAQBSAQUNAQBaDQgBAQBoAQUJAUBDNEJnby6aApkBIWtoYWVvZzopAihNbXhTeUFBS0FBeBltBDg2MmEBFFVER1AwawlQIQUAMT00AEYRGAxBQUFHHRgARx0YAEgdGBBIZ0FpUREQ9CoBRHdQdy4u2AIA4ALhkTzqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQQCAAQBBj6ASD6ASgAMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo2NDg12gQCCAHgBAHwBOblrMwBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAF8-ku-gUECAAQAJAGAJgGAKIGDjc2MjAjTllNMjo2NDc0uAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAJCmAQABgA4AYB8gaHAQjQ9VkSgAFSaFAzRjFvIX_YREFBa0NCUUVJMjREX0NCQzQxcWNDR0tpWm93SWdCeWdBUUt1RXZBUkk5YVNTQ1ZER1AxaktNbjGNBEFBIZ0AZzWdDEFBQUmNGixKb0JBZ2dBcUFFQXMuIADAQS4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB4qnBdIHDQnNzMzMzMwoQBAAGADaBwYIAAXA8NQHAOoHAggA8AeRgAiKCLwBCrcBAAABiB4bKwgUW96Mmv_ZWHNJtuGI74EFdAC6HSvXjOG5NUKdG6fJL8U2wrFkgEAIfvJYWMfHc8lsZGd_mafQWdldmVm4NuGgURtCDfQ7nra0PfNy-HEUH-hSGg7SMT98iCjK4jha6FYD5lp9R9etoYprL0US-EON07swoM8_0bZ02lr3TucMjgv2feQJDNGZK_xk9_ejQ6BUb1OjSR9_vVZ7pMC7CRFn40Dex8bY_nl9kcrYwAGKEAGVCAAAgD-YCAE.&s=587ff98c3ee30b919243ffcd55b4e6084e9e98a2

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 9bb73391-0744-4061-a4d3-fc3eec93dc72
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 42ms
19ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIzNTYwNzIxMzM2MTE5ODMwIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiOWMzZTRlZThlYWU3ZjE0MzNjYjJmZTY5YjEzMjY2MDUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjM1NjA3MjEzMzYxMTk4MzAiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAuMDAwMDQwOTA5MDAwMDAwMDAwMDA0LCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA0MDkwOTAwMDAwMDAwMDAwNCwiYmlkX2Zsb29yX3ByZXYiOjAuMDAwMSwic3RhdF9zb3VyY2VfaWQiOjEwMDg3LCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InN0YXRfc291cmNlX2lkIiwidmFsIjoiMTAwODcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjM1NjA3MjEzMzYxMTk4MzAiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJtZWRpYV90eXBlIiwidmFsIjoiYmFubmVyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIzNTYwNzIxMzM2MTE5ODMwIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicHJlYmlkX3NvdXJjZSIsInZhbCI6ImNsaWVudCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 40ms
19ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MC4wMDAwNDA5MDkwMDAwMDAwMDAwMDQsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDQwOTA5MDAwMDAwMDAwMDA0LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAxLCJzdGF0X3NvdXJjZV9pZCI6MTAwODcsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F744 169 KB
52 KB 54ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074524

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AD9F 42 B
64 B 51ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuCP4hzU6gjfOy546mtib0JNSapBF7g_ACPxNRHS-yRAxbY8leXQUq0TrLrmeSuQAYRnzsA8OgpIr6qZUooo7LFkkVJmfAQaqu9Vc_uratbXUnGWcpc&sig=Cg0ArKJSzIVH7eHZ_1QmEAE&id=lidar2&mcvt=1051&p=1074,1070,1324,1370&mtos=0,0,1051,1051,1051&tos=0,0,1051,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1801785216&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132281049&rpt=1055&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame A31A 219 B
556 B 119ms
38ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a31f20b23c82fc5c624c2623b8be7b06aea9d1588c730778ed846ba3c727429e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame A31A 107 B
122 B 54ms
45ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame A31A 107 B
122 B 53ms
44ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A493 603 B
65 B 242ms
239ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=2563015643&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132283&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132282981&bpp=23&bdt=185&idt=197&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=2&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=970524818&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=928272217&scr_x=0&scr_y=0&eid=44788441%2C44790154&oid=2&pvsid=2927364914404732&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.k2lys5a8eijq&fsb=1&dtd=208

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FD12 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvKcrhfCwMkspEMIAq0YSfmkdZPxgY6l3IIIwS7xMZV6vDVG-2DBkcelJMAyIkBI7_AndKcaua4sWCBOcHdSkCGgz3JTG_OV12aA0Iyr44q7kC0ZD59SDhbyeSXRA6ZLNhp_6PDL5IFNuxKruOMaNoNnUBAu2qZg3BFq2hOVSI5DDXnwKRqpSuO0Hlrvr7nPTSZBO26-YDbKmfC0B7lt69hP9yTSfsK_lptXZrKdemtVjaDw-UrY6Or4qhwBLyrookExlpE0cbMGTJ-1O-sEA2WxOvsqkqcutosqXbpcL-jjxulWnLD_Mfmaf-fLdqnGl7oqso3VrLfYepr&sai=AMfl-YRXljGwEUiyVJP7JcgcNEqsy2feXHN8eRwGYoR1iADLrhVT7YFbM20JHLSglgl2YJlI8MBJ7pi0DG-FX4CwgQ5Xil7Ea2s01MY1rTH6HMh3UqlVV2Ami7gCrNRvRwQ&sig=Cg0ArKJSzH7Gow01o_1ZEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 client Show response
ssl.connextra.com/PowerPlay/selector/ Frame 1499 1012 B
1 KB 94ms
94ms Document
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=1612577226&apnauc=7903764057768265078&bidid=7903764057768265078&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA./bcr=AAAAAAAA8D8=/cnd=%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjU2MjM=/bn=58109/clickenc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6645ebcd24c4bf26812a65d544bfa3694f9b2cf763d14c0c7b7230426f60044b

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 701
content-type: text/html;charset=utf-8
date: Mon, 15 May 2023 06:31:23 GMT
expires: Mon, 15 May 2023 06:31:23 GMT
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
pragma: no-cache
vary: * Accept-Encoding
x-served-by: vlp-cxtadsrv02.connextra.net

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame BB80 52 KB
17 KB 12ms
11ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 545
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:23 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 593
X-Served-By: cache-lga13626-LGA, cache-yul12820-YUL
X-Timer: S1684132283.223875,VS0,VE0

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame FD12 0
933 B 47ms
47ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QK2D_BVtgcAAAMA1gAFAQi6o4ejBhD2ipzejfHz120YyLrI8MzCwaEnKjYJ8tngRJXSuj8RMY10rbgkpj8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eP3FA4ABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICpQQhbzJ6VXBBaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPATG9EQ1U1WlRUSTZOVFl5TS1BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBSEJCQQE1CQEIeVFRCQkBARhOZ0VBUEVFAQsJAWBDSUJmY3JrQVdqXzFPWUJmeTkySWNCcVFVCR8YQUR3UDdFRgENIFFFcEYyel9CQgFPHEdoT0MtRV95BSgcQkFXUkRaUDkJKAkBBERaBSgBAfBDUEFfNEFXWFV2QUZncG1FQ3ZnRnlxSzdBb0lHQTFWVFJJZ0dCSkFHQVpnR0FLRUcyX2wtYXJ4MDd6LW9CZ1N5QmlRSkEBSAkBAFIJBwUBAFoFBgkBAGgJBwEBREM0QmdvLpoCmQEha3hhUW9naTYpAihQeW5heUFBS0FBeBltBDg2MmEBFDBER1AwawFOAEElBQAxPTQARhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERDwTER3UHcuLtgC50PgAsPLWeoCGGh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nL_ICEQoGQURWX0lEEgc1MTY1Mzg28gISCgZDUEdfSUQSCDIxaUQs8gISCgVDUF9JRBIJdUMQ8gINCggBPhhGUkVREgEwBRAcUkVNX1VTRVIFEAAMCSAYQ09ERRIA8gEPCENQRxUPEAsKB0NQFQ4QEAoFSU8BYSAHODI3NTUxMvIBIQRJTxUhOBMKD0NVU1RPTV9NT0RFTAErFADyAhoKFjIWABxMRUFGX05BTQVxCB4KGjYdAAhBU1QBPhBJRklFRAE-HBUKCFNQTElUAU0Z2fC2gAMAiAMBkAOMv0GYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQSCAQQBBisAiD6ASgBKAIwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjU2MjPaBAIIAeAEAfAE6bOPzgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAQx4AADYBQHgBQHwBce7MvoFBAgAEACKBoABaGhQU0sxb0FQ2ERBQWtDQlFFSW0tdmZCaENkbnNFQ0dNNjYwQUlnQmlnQVFPdWwwZ1ZJZ0tqU0JWREdQMWlQSjNRXgRBQUFuAGdVbgRBQQE3AEGB6yxKb0JBZ2dBcUFFQXMuIABAQS4ukAYAmAYAogYOMzE1MyMJ5xwwMDe4BgDBBgm4KPA_0AapJdoGFgoQCREZASgQABgA4AYB6gYoddEEFDI2MzEzM6WvARQMaScsIEE0CDUyNgUUQPIGhwEIo_9TEoABSlJTRVQxNvoAQDk2UzlDQkNEX2JBQ0dLWGx0AcNAeWdBUU55UThRUkk5dkNtQ0b--gAJ-nCABwGIBwCgBwG6BwgqBDEtLS1AAcgH_cUD0gcNCQnkBERAAeII2gcGIa5wGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=d1e39187aab60f8b15ea74ab87e8c5f36df19236&bdref=https%3A%2F%2Fswiftmoves.blog%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F&

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 4392a217-2364-4875-955d-e2171d242094
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/232/ Frame FD12 80 KB
28 KB 40ms
16ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/232/trk.js
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c93c88a9b0ecf4b158610988b79ffdc52501b1e995f14eb4dfc09c7eb9c3f6de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Thu, 25 Apr 2024 08:42:19 GMT
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 1633744
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27631
X-Served-By: cache-lga21975-LGA, cache-yyz4531-YYZ
Last-Modified: Wed, 26 Apr 2023 08:42:13 GMT
Server: AkamaiNetStorage
X-Timer: S1684132283.248468,VS0,VE0
ETag: "c342094e8bdad308ac07817d751fb315:1682498533.672161"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 13, 765195

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame FD12 0
933 B 56ms
18ms Image
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fswiftmoves.blog%252F&e=wqT_3QKfDfBVnwYAAAMA1gAFAQi6o4ejBhD2ipzejfHz120YyLrI8MzCwaEnKjYJ8tngRJXSuj8RMY10rbgkpj8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eP3FA4ABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICpQQhbzJ6VXBBaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPATG9EQ1U1WlRUSTZOVFl5TS1BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBSEJCQQE1CQEIeVFRCQkBARhOZ0VBUEVFAQsJAWBDSUJmY3JrQVdqXzFPWUJmeTkySWNCcVFVCR8YQUR3UDdFRgENIFFFcEYyel9CQgFPHEdoT0MtRV95BSgcQkFXUkRaUDkJKAkBBERaBSgBAfBDUEFfNEFXWFV2QUZncG1FQ3ZnRnlxSzdBb0lHQTFWVFJJZ0dCSkFHQVpnR0FLRUcyX2wtYXJ4MDd6LW9CZ1N5QmlRSkEBSAkBAFIJBwUBAFoFBgkBAGgJBwEBREM0QmdvLpoCmQEha3hhUW9naTYpAihQeW5heUFBS0FBeBltBDg2MmEBFDBER1AwawFOAEElBQAxPTQARhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERDwtkR3UHcuLtgC50PgAsPLWeoCGGh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nL4ADAIgDAZADjL9BmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEggEEAQYrAIg-gEoASgCMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo1NjIz2gQCCAHgBAHwBIUoIIgFAZgFAKAF_xEBGAHABQDJBQAFARTwP9IFCQkFC3wAAADYBQHgBQHwBce7MvoFBAgAEACKBoABaGhQU0sxbyE52ERBQWtDQlFFSW0tdmZCaENkbnNFQ0dNNjYwQUlnQmlnQVFPdWwwZ1ZJZ0tqU0JWREdQMWlQSjMxRwRBQSFXAGc1VwRBQQE3AEFh1CxKb0JBZ2dBcUFFQXMuIABEQS4ukAYAmAYAogYOMzE1MyNOBeccMDA3uAYAwQYBtjAAAPA_0AapJdoGFgoQCREZASgQABgA4AYB6gYodZHtFDI2MzEzM4WYARQAaaEBFDUxMjUyNgUUQPIGhwEIo_9TEoABSlJTRVQxNvoAQDk2UzlDQkNEX2JBQ0dLWGx0AcNAeWdBUU55UThRUkk5dkNtQ0b--gAJ-nCABwGIBwCgBwG6BwgqBDEtLS1AAcgH_cUD0gcNCQnkBERAAeII2gcGIa5wGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=09420e39a0724f436ea311e2ced0db30eb98378c

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 94cf6676-1286-4b28-9b02-df62262a85ec
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FD12 169 KB
52 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 122ms
116ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250f_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=5a33d34a-b348-4802-b785-f4a75f87b7ea&l_pb_bid_id=105aad80beb8bcf9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250f_desktop&slots=1&rand=0.2668857794047954
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: c393385ece259dace82dab1f33e828ac6377d3028df8126b4fd6a8aacd87eed1

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 6 KB
4 KB 185ms
179ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 6eb3a35de229625631549b06323f3750b5e03aed3b080c7ad76428e46d41cc06

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 157
content-length: 3546

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
625 B 136ms
89ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: c8ae46c3392734e141359f17cc0d2e46c844a4db7911b22d77708f74555b8fb8

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 16 KB
8 KB 170ms
135ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

88c2d6b5fc3cf715bd05153ef9246e70fd20b402fb0270f5461b99ba57f34aa2

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 113119ee-dafb-44e4-b3a7-403379d62f3e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 100ms
95ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250f_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=5a33d34a-b348-4802-b785-f4a75f87b7ea&l_pb_bid_id=113844f901a5571d&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250f_desktop&slots=1&rand=0.1810695088562777
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 99df2fee97c1601d4aebae10fae86f2881c0495a4d5eb6dfff6b2aa08d6c65c2

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 15 KB
7 KB 123ms
119ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 340088d5dc74f437b34b5d0e5a78ebc56481441ba827454615b00589b61247b7

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:23 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 882 B
3 KB 123ms
75ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2211906ad97a5d9b15%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250f_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=edf515fd-7140-4e5b-9172-c262a9907c3b&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

272c4b2f9cac9b600eefdd47126f90afd7652beefd0d121e24114616b9603592

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 534
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 38 B
507 B 55ms
53ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2cc6519a5eb5d801bbf9118ee93c291fdaad320ba96a0377a622a1364d538281

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OG%2Buzb0P8rEXI2Xg7hC1%2FVXdgLj3WdffKe8%2F75Y0cJntyjsEztjrmyuyhPcvNej3DLmlmXHo1w2u5CB4ukxFu6%2BVvl1VUCvd2d4LhJt9YtOiq3LESyNxxW%2BH0lmG9TwMbyHPbJYt"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c7956724b1ea210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 31ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:23 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 26ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzNTQ0MjY5ODgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjM1NjA3MjEzMzYxMTk4MzAiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk4OCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNTcyODA3NTU5NyJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

GET
H3 200 5728075597 Show response
go.ezodn.com/dac/ 0
607 B 27ms
24ms XHR
text/plain 2606:4700:e4::ac40:a702
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/dac/5728075597
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/porpoiseant/banger.js?cb=195-0&bv=226&v=74&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a702 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Mon, 15 May 2023 06:03:21 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3eUJeoxIykn%2B%2BIRMIk%2B7SDT1ERsfc3hCgm%2B%2BfWl%2FIVvSS1EK73%2BB53IgLNSjZpfewClf95i8xxHSpuXRWt7b%2FvrfXQvCHEaLyKeP8O5p21%2BmQ3%2BacO661rTFOkAQDe6RIY5uBvrXQuyqF%2BE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
accept-ranges: bytes
cf-ray: 7c7956725870196c-EWR
access-control-allow-headers: Content-Type

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNS0xNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjYifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:22 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:22 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYXVjdGlvbl9lcG9jaCI6MTY4NDEzMjI4MywiYWRfcG9zaXRpb24iOjExMDIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MjQwLCJiaWRfZmxvb3JfcHJldiI6MTAsImJpZF9mbG9vcl9maWxsZWQiOjIsImF1Y3Rpb25fY291bnQiOjcsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjQzNywibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3fV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:23 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AD9F 107 B
122 B 40ms
40ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AD9F 107 B
122 B 35ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 26 KB
11 KB 81ms
80ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=2621343632996130&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250e_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=5&adks=1994560124&sfv=1-0-40&prev_scp=hb_format_medianet%3Dbanner%26hb_size_medianet%3D300x250%26hb_pb_medianet%3D0.01%26hb_adid_medianet%3D103d05f2b1dd1793%26hb_bidder_medianet%3Dmedianet%26hb_format_oftmedia%3Dbanner%26hb_size_oftmedia%3D300x250%26hb_pb_oftmedia%3D0.05%26hb_adid_oftmedia%3D1232f0acacdde222%26hb_bidder_oftmedia%3Doftmedia%26hb_deal_oftmedia%3D1073036%26hb_deal%3D1073036%26hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.03%26hb_adid_amx%3D12556a8f2f119425%26hb_bidder_amx%3Damx%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.05%26hb_adid%3D1232f0acacdde222%26hb_bidder%3Doftmedia&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132283266&lmt=1684132283&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=qbgqdywuix2k&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ%2CABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56e6f6299d459fc3d5117f778ef0c165772988185c7485a56f818c4d5ffc3013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11259
x-xss-protection: 0
google-lineitem-id: 5111852800
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138274588176
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame AD9F 0
17 B 372ms
371ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~lhogvm58&c=2913416228924394&e=31072019%2C31074536%2C31074542%2C31061691%2C31061693&ctx=1&met.3=54.1dv~598.1dv~947.1dv~11.1dv_1~725.1dw~894.1dx~1132.1e2_b~808.1ee~808.1ee~783.1g1~680.1in~54.1io~54.1io~598.1io~598.1io~598.1io~598.1io~598.1io~598.1io~947.1ip~947.1ip~573.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~598.1ip~54.1ip~598.1ip~598.1j8~947.1j8~947.1j9~947.1j9~573.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~649.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~947.1j9~573.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~54.1j9~598.1j9~598.1j9~649.1j9~54.1j9~598.1ja~54.1ja~598.1ja~54.1ja~598.1ja~54.1ja~598.1ja~54.1ja~598.1ja~54.1ja~598.1ja~947.1ja~11.1ja_1~725.1ja~894.1jb~1132.1jd_6~808.1jj~808.1jj~646.1kt~800.1ku~800.1ku~800.1ku~800.1ku~800.1ku~774.1kz~653.1kz_a~801.1l9~801.1l9~844.1l9~844.1l9~710.1l9~825.1l9~355.1l9~825.1l9~54.1l9~598.1l9~708.1l9~598.1l9~708.1l9~647.1la~965.1la~783.1my~734.1my_2~646.1nk~800.1nk~800.1nk~800.1nk~800.1nk~800.1nk~774.1no~653.1np_k~801.1o9~801.1o9~844.1o9~844.1o9~710.1o9~825.1o9~355.1o9~825.1o9~54.1o9~598.1o9~708.1o9~598.1o9~708.1o9~647.1oa~965.1oa~54.1oj~54.1oj~598.1oj~598.1oj~598.1oj~598.1oj~598.1oj~598.1oj~598.1oj~947.1ok~947.1ok~573.1ok~54.1ok~598.1ok~54.1ok~598.1ok~54.1ok~598.1ok~54.1ok~598.1ok~54.1ok~598.1ok~54.1ok~598.1ok~54.1ok~54.1ok~598.1ok~54.1ok~598.1ok~54.1ok~598.1ol~54.1ol~598.1ol~598.1p9~947.1p9~947.1p9~947.1p9~573.1pa~54.1pa~598.1pa~54.1pa~598.1pa~54.1pa~598.1pa~54.1pa~598.1pa~54.1pa~598.1pa~649.1pa_4~54.1pd~598.1pd~54.1pd~598.1pd~54.1pd~598.1pd~54.1pd~598.1pd~54.1pd~598.1pd~947.1pd~573.1pd~54.1pe~598.1pe~54.1pe~598.1pe~54.1pe~598.1pe~54.1pe~598.1pe~54.1pe~598.1pe~598.1pe~649.1pe~54.1pe~598.1pe~54.1pe~598.1pe~54.1pe~598.1pe~54.1pe~598.1pe~54.1pe~598.1pe~947.1pe~11.1pe_1~725.1pf~894.1pg~1132.1pk_7~808.1ps~808.1ps&met.10=1_3.IIQOEAAIABgAKAA~1_123.IIUOEAAIABiAmHUoAA~1_101.IKAOEKinAgj4yQQYgJh1KAE~1_4.IMYPEAAIABgAKAA~1_134.INQPEAAIABiAmHUoAA~1_112.IJsQEKinAgj4yQQYgJh1KAE~1_5.IKMREAAIABgAKAA&met.9=9.0~3_123.1ee~7_123.0~9.0~3_134.1jj~7_134.0~4_112.1kt~5_112.1kv~6_112.1kz~4_123.1nk~5_123.1nm~6_123.1no~9.0~3_145.1pr~7_145.0&met.7=CA8QDRgBILoLKLoLMK0NOPIBaL4LcKoNePBagAHEWIgBqc4BsAEBuAEDwAG_3prrBg~CBsQDSD-CziuAcAB5IOfqA0~CBsQDSD_CziyAcAB27vP_ws~CCcQBRgBIIUNKIUNMKQPOJ8CwAGZlZ-gCw~CBsQBRgBIIcNKIcNMK8POKkCwAHPxtriAQ~CBsQDSD2DTirAcAB5IOfqA0~CBsQDSD3DTiEAcAB2uGGnQE~CBsQDSD4DThxwAHbu8__Cw~CBsQDSD5DTiAAcABwpKj2gI~CBsQDSD5DTg7wAH7oYnCDw~CBsQDSD7DTgwwAGs8MCpAQ~CBsQDSD8DThhwAHbu8__Cw~CBsQDSD9DThmwAG9m-mVBw~CBsQDSD-DTgVwAHp_P2pDA~CBsQBSC3CDigB8AByP7fnQY~CC8QBxgBIIcOKIcOMLEOOCloig5wsA54kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIIgOKIgOMLAOOChojg5wrw54kAOAAWSIAWuwAQG4AQPAAZv_iccH~CA8QDRgBIK8MKK8MMOgPOLoDaK8McOcPeIBagAHUV4gB4c0BsAEBuAEDwAG_3prrBg~CBsQDSC1DzhSwAHa4YadAQ~CBsQDSC3Dzg3wAGs8MCpAQ~CBsQDSC4DzhGwAH7oYnCDw~CBsQDSC0DzhewAHbu8__Cw~CA8QDRgBIJYOKJYOMKEQOIsCaJgOcJ4QeNdZgAGrV4gBjMoBsAEBuAEDwAG_3prrBg~CBsQDSCzDzigAcAB6fz9qQw~CBsQDSC0DzhswAG9m-mVBw~CBsQDSC2DziVAcAB5IOfqA0~CBsQDSC3DzhwwAHbu8__Cw~CBsQDSC4DziTAcABwpKj2gI&qqid.2=CNX62dPZ9v4CFZHm4Qod4w8ASA&qqid.3=CMSn6NPZ9v4CFSUdwwodno0H5Q
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200 d9core Show response
d9.flashtalking.com/ Frame 896F 11 KB
11 KB 28ms
25ms Script
application/javascript 18.204.50.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.50.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-50-167.compute-1.amazonaws.com
Software: Apache/2.4.52 () OpenSSL/1.0.2k-fips /
Resource Hash: f124d1383f068e11c4833550c9d85bd51b99a7facd3bc9b7783c180b60290b7e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fips
ETag: 5bc31bf7d4a298e1bef9d35fce222bfc
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: d9.flashtalking.com
Content-Type: application/javascript;charset=utf-8
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 10814

GET
H2 200 iframe Show response
c.bannerflow.net/scripts/ Frame 0ABB 2 KB
921 B 166ms
165ms Document
text/html 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2da5e0a4637e412b237d8a941f6800b3748cbdc969402c1cac8d3174e43d597e

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cf-cache-status: MISS
cf-ray: 7c79567288567151-YUL
content-encoding: br
content-md5: pRIJ2/N21dbBjDWXiJP+cQ==
content-type: text/html
date: Mon, 15 May 2023 06:31:23 GMT
last-modified: Wed, 29 Mar 2023 06:31:05 GMT
server: cloudflare
vary: Accept-Encoding
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: d79e8524-d01e-0085-17f6-86c0fb000000
x-ms-version: 2011-08-18

GET
H/1.1 200
OK score.min.js Show response
js.ad-score.com/ Frame 896F 443 KB
140 KB 85ms
35ms Script
application/javascript 2600:9000:24fd:6a00:a:deb0:3380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=C756D4B4-7746-044D-FFF9-A78048FB43EB&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=534207031&pub_ts=1684132282
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:6a00:a:deb0:3380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c16b3168220a708c3faa49795c9754a9789176522f2c2ee896255c4548f2fb96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Sun, 14 May 2023 19:35:31 GMT
Content-Encoding: br
Via: 1.1 5cf3f25bf905bc6e52b9e72f44811c98.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CMH68-P2
Age: 39352
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Sun, 14 May 2023 19:35:31 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Cache-Control
X-Amz-Cf-Id: l5XY39iCqdpYZDFn5RFnW2TsFwJsaGltKqS_20ItEHdu-rjoSoGTGg==
Expires: Mon, 15 May 2023 19:35:31 GMT

GET
H/1.1 200
OK iconc.png
secure.flashtalking.com/oba/icon/ Frame 896F 1 KB
2 KB 21ms
19ms Image
image/png 104.126.112.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/683/6834967/3881893/js/j-6834967-3881893.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.112.56 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-112-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Last-Modified: Sat, 12 Apr 2014 19:14:31 GMT
Server: Flashtalking (AKA)
ETag: W/"db320ef6f3c45ab5c90887ef618de2bb"
X-FT-Origin: us
X-Varnish: 856463642 467897440
Content-Type: image/png
Cache-Control: max-age=1982745
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1308
Expires: Wed, 07 Jun 2023 05:17:08 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C629 52 KB
17 KB 33ms
10ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 545
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:23 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 847
X-Served-By: cache-lga13626-LGA, cache-yul12834-YUL
X-Timer: S1684132283.340041,VS0,VE0

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame 896F 0
933 B 18ms
18ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: da2e7277-d81e-455b-a8bc-c4363b19de70
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame 1041 356 KB
120 KB 60ms
60ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
DATA 200
OK truncated
/ Frame 1041 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05a115d68528cb63c0286aa555d97d7b654db15c05ac465471f6f3101f489d85

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6710 0
861 B 73ms
37ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7620&pub_id=964152&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 22e97694-4704-4ed0-85b6-4660de9abfa1
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D43C 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstaWHx3xPUaoX0mxdSX_lKK-ugZQVSF3ex4EmrDNbEvGD04lfTR9pC5gLvTPxSpj8vju6yWEMnZVEpnkSGdq4RgA5OLKlnb8EcG1W3Z2BI30rldSODKCxKRzX4EsxMd5uEFMX0fFX96-yMSJt9_3yPN_IJaRTHOjZfowfmrG3JJc5KqHUqKXn7ylxB1Nj-esQOtujzvYSX2jx0jUtIeHkclfKJiOBrIwAfHHdJFcl-ju5soBEioCUz6zmir4-lnG8QTuP8g8ulOtleef98na-_gfuhpFjJhM3iEyvHQu0OoCbIkDawZ0eM_omoIm8XJRiDPfGrYkhwJnQ&sai=AMfl-YSihSQ7saCeugJdmUXyykyD0flSjpbI5prnHr0QbUTKv8y8CSlLbzEw3BXS_3_JTPTdZ9BPbf1POQ4ZM7tNyfsWEBKWAtpB-aNv8BWME7ZcBxJbl_NhSEU-NTsU7l8&sig=Cg0ArKJSzHtagPJ-8BDqEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame D43C 91 KB
32 KB 43ms
43ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D43C 169 KB
52 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
574 B 164ms
161ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=4&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A700%2C%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

afac784066a0936106c9ae0877d0b021405fc3415b15bec000e019cecfc63e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: 2MCCJNESMQVTZHDG6YCB
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: UO--3f4BL0VHzuazhabGITpfO_4FyZlTtJLpW9Y1L7Tcx9sdxXTFHA==

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame BB80 0
861 B 21ms
21ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3153&pub_id=1424069&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 679b37f4-e180-4811-913b-b4d6aff2bf9a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK consumer-privacy-logo.png
secure.flashtalking.com/oba/icon/ Frame EF30 6 KB
6 KB 19ms
19ms Image
image/png 104.126.112.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/consumer-privacy-logo.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.112.56 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-112-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 49b19f7f2d3d0fc9d2270cd1ebd79d468ca86cf308f33b063595863e3f392e98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Last-Modified: Thu, 11 Feb 2021 15:39:51 GMT
Server: Flashtalking (AKA)
ETag: W/"d675694ab4d4d2eb56cca854c25d9c36"
X-FT-Origin: us
X-Varnish: 144627897 145267314
Content-Type: image/png
Cache-Control: max-age=532
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5953
Expires: Mon, 15 May 2023 06:40:15 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 146ms
142ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250g_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=22ef3d6a-45be-4b02-9fc3-6adff843924d&l_pb_bid_id=1276b619e011c36a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250g_desktop&slots=1&rand=0.1565896734604384
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: e69e4365022ccadf6945d6987cd37a8d479f731b0d83dafee2a79bc85a664533

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
625 B 83ms
80ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 94aced3010ca82d744878beff2180e8a4c860b5193db2d4b311d01f02a9cfb1d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 15 KB
7 KB 126ms
125ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

372e8216acd9b6efc45b7d7196412ae4a54703723edd412ece8150dfdcd07c9f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 73a1f4f8-4cf5-445f-9887-77206714a957
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 28ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:23 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 38 B
501 B 49ms
48ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfdd38c0d60f8b0584b1db3bb104025816f6bd9387bb732292dcd0c451748fb5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MOkTmabbeD0u%2Fpwt3OCI4NBYxihH8v5uo4sNrkp3crzPhPmUGfFi615FJu6CzY3q0nIJcdGhA6V6hKpHb1pezhKGzqYHoMVRl1RN6F8zlQuAucjh%2BydaRHIiPoa5GJa9L3OxJe2r"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c795673ace1a210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 84ms
81ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250g_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=22ef3d6a-45be-4b02-9fc3-6adff843924d&l_pb_bid_id=1359f706fe62059&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250g_desktop&slots=1&rand=0.18686988591183318
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 82d1fe0de791a1b1521c55e9d3c925ec261e440aaa79ad462f44326052e5d852

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 7 KB
4 KB 210ms
207ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 441e516987af928c6943f43d16f5e4095181148a00702c19f6d43019cc6b73b7

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:22 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 185
content-length: 3914

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 880 B
3 KB 87ms
85ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22139f746482ec73%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250g_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=a11cb4a5-a0b1-4b9b-994e-0361c79b69f3&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

323bb45d89ebf328456bcae4b61b7bde59eb7c90d5fa8bac937d7a4e82545369

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 533
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
433 B 97ms
95ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 031160ba4a362b985fe257823965e04c6da2a5cff60a3459d04f08919954f6f5

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:23 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:23 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E0EE 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstyXe4fhvvbWqW45lWGLMcBscaojYCJ0UD0DN_Zv1BR2qae5ESZhmvvnq0GSjejLoMMcpWFNv5r0pSNBlyD5bd5_16MDIxqK3nHJztus_E8hzATlX2x-rlIjzPGzlieHN4_ewsBUGEMLqxCSv_-eLsPC9EGedOKTTE46uhLzOXtUWVY-vrPW_lP4WsKsSyk-kspApwKoDxb0EqpUf4GHFJVyWwfZJBnFHXLiCd6YBlwprJ0eEfS8ZXvakY05t1OkcOrnlTsLkvLqNL4PojMd_VxCJjx7ZKPJr4mtNAg0Soqq5Hlfj-NG7k6n-CSjSV8v8yhA4tV0c1NgVb8&sai=AMfl-YTMC4S4dxizlyrYhE6fnWBsm9hX36m_JbiMYOZEVs119OAE_2dyrAQLCbhoMqc2-unXZqjj25daV130EU1XIGMl7W5MTk1yv9snS7JbnVKhtJAw1F7zS-jwvo2TV28&sig=Cg0ArKJSzCqQrv3EITo8EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 client Show response
ssl.connextra.com/PowerPlay/selector/ Frame CE2A 1010 B
1 KB 92ms
92ms Document
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=10830290&apnauc=6070106940761623787&bidid=6070106940761623787&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?EyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA./bcr=AAAAAAAA8D8=/cnd=%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjUwODA=/bn=89887/clickenc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c6964a429d9057e574d7d574f0707091be258eca2c11f5ff03fa3c6a7f413462

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 700
content-type: text/html;charset=utf-8
date: Mon, 15 May 2023 06:31:23 GMT
expires: Mon, 15 May 2023 06:31:23 GMT
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
pragma: no-cache
vary: * Accept-Encoding
x-served-by: vlp-cxtadsrv02.connextra.net

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 2B2B 52 KB
17 KB 35ms
11ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 545
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:23 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 594
X-Served-By: cache-lga13626-LGA, cache-yul12820-YUL
X-Timer: S1684132284.518432,VS0,VE0

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame E0EE 0
933 B 23ms
22ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QLOGfBVzgwAAAMA1gAFAQi7o4ejBhDrmeuFocPWnlQYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eJ--BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hZG9YVW5RaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOVEE0TU9BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBWFlKNUFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw0dUFZS5oCmQEha0JhNG8-QQdYUHluYXlBQUtBQXgyX2wtYXJ4MDd6ODYyeQYURURHUDBrDWcMRHdQMT1EAEYRGAxBQUFHHRgARx0YAEgdGAxIZ0FpLlUH0HcuLtgC50PgAsPLWeoCGGh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nL_ICEQoGQURWX0lEEgc1FnAIHPICEgoGQ1BHARQACB5cCAEVCAVDUAEUAAkiWwg88gINCghBRFZfRlJFURIBMAUQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwFZEQ8QCwoHQ1AVDhAQCgVJTwFhCAc4MhLlCADyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FcQgeCho2HQAIQVNUAT4QSUZJRUQBPhwVCghTUExJVAFNGdnwtoADAIgDAZADjL9BmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEggEEAQYrAIg-gEoASgCMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo1MDgw2gQCCAHgBAHwBOmzj84BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAEMeAAA2AUB4AUB8AXHuzL6BQQIABAAigaAATRSTi1QRm9BUNhEQUFrQ0JRRUltLXZmQmhDZG5zRUNHTTY2MEFJZ0JpZ0FRT3VsMGdWSWdLalNCVkRHUDFqaE1INm4CAGdVbgRBQQE3AEEOAwosSm9CQWdnQXFBRUFzLiAAQEEuLpAGAJgGAKIGDjMxNTMjBecgNjI0MbgGAMEGCbgo8D_QBqkl2gYWChAJERkBKBAAGADgBgHqBih1HhwLFDI2MzEzMxLHCgEUAGkOMAsUNTEyNTI2BRQ88gaHAQij_1MSgAFnQlF3WTr6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB5--BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=b457a52c5b1185121ebb5e44498aec2344c37423&bdref=https%3A%2F%2Fswiftmoves.blog%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F&

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: a31ab155-ffde-409f-b563-ce030ab91474
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/232/ Frame E0EE 80 KB
28 KB 50ms
16ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/232/trk.js
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c93c88a9b0ecf4b158610988b79ffdc52501b1e995f14eb4dfc09c7eb9c3f6de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Thu, 25 Apr 2024 08:42:19 GMT
Date: Mon, 15 May 2023 06:31:23 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 1633745
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27631
X-Served-By: cache-lga21975-LGA, cache-yyz4582-YYZ
Last-Modified: Wed, 26 Apr 2023 08:42:13 GMT
Server: AkamaiNetStorage
X-Timer: S1684132284.527093,VS0,VE0
ETag: "c342094e8bdad308ac07817d751fb315:1682498533.672161"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 13, 759257

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame E0EE 0
933 B 24ms
22ms Image
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fswiftmoves.blog%252F&e=wqT_3QK3F_BVtwsAAAMA1gAFAQi7o4ejBhDrmeuFocPWnlQYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eJ--BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hZG9YVW5RaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOVEE0TU9BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBWFlKNUFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw0dUFZS5oCmQEha0JhNG8-QQdYUHluYXlBQUtBQXgyX2wtYXJ4MDd6ODYyeQYURURHUDBrDWcMRHdQMT1EAEYRGAxBQUFHHRgARx0YAEgdGAxIZ0FpLlUH8N53Li7YAudD4ALDy1nqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy-AAwCIAwGQA4y_QZgDF6ADAaoDAMADrALIAwDYA5PL1QHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODOoBACyBBIIBBAEGKwCIPoBKAEoAjAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NTA4MNoEAggB4AQB8ATps4_OAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAABQ5w2AUB4AUB8AXHuzL6BQQIABAAigaAATRSTi1QRm8hOdhEQUFrQ0JRRUltLXZmQmhDZG5zRUNHTTY2MEFJZ0JpZ0FRT3VsMGdWSWdLalNCVkRHUDFqaE1INlcBAGc1VwRBQQE3AEEO7AgsSm9CQWdnQXFBRUFzLiAAPEEuLpAGAJgGAKIGDjMxNTMJ5yA2MjQxuAYAwQYFtywA8D_QBqkl2gYWChAJERkBKBAAGADgBgHqBih1HgUKFDI2MzEzMxKwCQEUAGkOGQoUNTEyNTI2BRQ88gaHAQij_1MSgAFnQlF3WTr6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB5--BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=d426a12dcaffa96cc41a632b405cfa959bef7981

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 2fbe2e66-ae01-449f-88b2-f7bfac80c437
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E0EE 169 KB
52 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:23 GMT

GET
DATA 200
OK truncated
/ Frame EF30 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b18e3726f763791bea1a708fc760c04f39566029e104d684ce5297c44232e06

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 controller Show response
ssl.connextra.com/servlet/ Frame A310 847 KB
71 KB 1589ms
1588ms Document
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=1612577226&apnauc=7903764057768265078&bidid=7903764057768265078&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA./bcr=AAAAAAAA8D8=/cnd=%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjU2MjM=/bn=58109/clickenc=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a5dccddd9245052ee6be96dfa25eaab8bc2178b492538a811080b01cd635bbd2

Request headers

Referer: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=1612577226&apnauc=7903764057768265078&bidid=7903764057768265078&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA./bcr=AAAAAAAA8D8=/cnd=%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjU2MjM=/bn=58109/clickenc=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 06:34:21 GMT
vary: Accept-Encoding
x-served-by: vlp-cxtadsrv02.connextra.net

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4542 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=3738170952900814&bg=!zs2lzZnNAAYldGN0BXQ7ADkAdvg8WsjhRPNlRoMeB3vW5ijpv5AWzYvM-9o10Fe0ln0vOH8OqM9EjLD2BsCa1gVOt1b4pm0WdVkCAAACF1IAAAACaAEHmQKqpYpD5c4zznh95eDx4QF2AO_50sCnnh5Ax67qkVzZZrSXsJuz0xmXLUOCtDFv2LaAbSk0z665AKfvyMZPcI166Im39fq6QqrnEJRHncSIJRdYhyKRpHKgqshnSnYmnwJliM8bRb0jSGBkXjGmtI_LLpQUjnzXLE2d-MrXh_Zvuepr6sbJPqBN7kwtPM4ZR-106nH2n4toxVfWrdCtUzRxOVVSaN4NE0BA87Ah2Yz6A7J0Z_cVUEkKgWTTr8l6gcdn7oi5pTlvnt5SCIgFjzvzsbS0BDp9R_0fEt65b5sjWGsxNPTzOTQbPAQrUjha0_PLgH-2hVd1VjDm9ipMgXXJ85rAlqa0RfUWHu_Lk39EAlUvWtNwVWziOlJqRC4Ao-mNXQKWWDvVAYSUHYUepW6ONYwSB9OZwhc9VqNHtsBryLIukwggI0MIkL6uqxHApO9jyLfwRnGlbE3-Y9El1kQlS3XcjaZMQRyd1MPx6-4j6ocEdOzOoXdmlLNBEoN6l-10JeZyIeYIwVpMBM3ZQrAJGmzXT3PGDsf16ezR6es056dHm52t--1DGvkjFY4HSZg7820PbI6FpuCZmd99Sxccalo7F14FiPLjzV_1kPUONt3F1taXmlDx_d4TW2TzaXXB5GO-CIshgE8fQLXZ0suAMMhdtjY3IVp5ccLFYZYNqBqmRsORj5QtYT2gZKLgVxWlpDtqUuoxgsg_Iey3kW8OsIkc-C-XoqmjQy_dMXn9_tH1ISoQjtQBaTnLEx3fDxiLXcZMptZlXds8WOUIbdOp-20_WV2qZp05y-YINGoAH7KTh0UNTASIBMk_PYnmsfqb3mwk0BzcQNRXEM_qXg2btHYPZE5w11kR2zpyDC7jUBARkHTYX6EINDcAw_F3TV6A4lF6ozOw57Vk9g
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 26 KB
11 KB 81ms
81ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=793070460677044&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250f_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=6&adks=1830954974&sfv=1-0-40&prev_scp=hb_format_medianet%3Dbanner%26hb_size_medianet%3D300x250%26hb_pb_medianet%3D0.00%26hb_adid_medianet%3D145056c6d26c5f88%26hb_bidder_medianet%3Dmedianet%26hb_format_oftmedia%3Dbanner%26hb_size_oftmedia%3D300x250%26hb_pb_oftmedia%3D0.05%26hb_adid_oftmedia%3D1463962dee24dc9a%26hb_bidder_oftmedia%3Doftmedia%26hb_deal_oftmedia%3D1072873%26hb_deal%3D1072873%26hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.03%26hb_adid_amx%3D148ad59885b99f97%26hb_bidder_amx%3Damx%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.05%26hb_adid%3D1463962dee24dc9a%26hb_bidder%3Doftmedia&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0%3AT%3D1684132273%3AS%3DALNI_Man1isIhLqbwzs6KbNTAazTJe_Aqg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132283557&lmt=1684132283&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=6osrvlvvxhb9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ%2CABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0%2CABHeCvhbNkjF3LrpFe-1wYs2ZaV8cktmPxfZRoe1aLV2GL3csnJ7Ora7co1wQ7kJ3r41n06jCxvAnMM3oohhUnrQ961wLK0d%2CABHeCvhS0pJYIgbubKkj3-a_Cp-VEfAkkOL1Z2DZBJ53L_6ydz4tTnkNI72GHfBuQu9Ih4cO6cy3ZZb-wuhoGDHNim5Sh6uUjKhH-F8&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1de8cb95da9016cc17905d15548683943fab2aa5e001f0efed11b7c4a8500d1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11263
x-xss-protection: 0
google-lineitem-id: 5111852800
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138274875292
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 625fe2e060223dbab8424f59 Show response
c.bannerflow.net/a/ Frame E5CE 66 KB
22 KB 102ms
101ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd37cb19589a8763d28c8ca53750090c19d022ca71676a3a55d04055ec1eb5fa

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 15 May 2023 06:31:23 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, s-maxage=10
cf-ray: 7c79567459ee7151-YUL
request-context: appId=cid-v1:1a5f66bd-0229-467a-a946-b3753e659ecb

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C629 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7620&pub_id=964152&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: eb90cad3-7871-48f9-a101-24de77ca29a4
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK consumer-privacy-logo.png
secure.flashtalking.com/oba/icon/ Frame 896F 6 KB
6 KB 20ms
19ms Image
image/png 104.126.112.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/consumer-privacy-logo.png
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.126.112.56 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-112-56.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 49b19f7f2d3d0fc9d2270cd1ebd79d468ca86cf308f33b063595863e3f392e98

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Last-Modified: Thu, 11 Feb 2021 15:39:51 GMT
Server: Flashtalking (AKA)
ETag: W/"d675694ab4d4d2eb56cca854c25d9c36"
X-FT-Origin: us
X-Varnish: 144627897 145267314
Content-Type: image/png
Cache-Control: max-age=532
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5953
Expires: Mon, 15 May 2023 06:40:15 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame EF30 0
955 B 18ms
18ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QLeDfBM3gYAAAMA1gAFAQi1o4ejBhCSv6Dtjsih00MYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVEREPQqAUR3UHcuLtgCAOAC4ZE86gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBf-OA_oFBAgAEACQBgCYBgCiBg43NjIwI05ZTTI6NjQ3NLgGAMEGAAAAAAAA8D_QBqkl2gYWChAAAAAAAAAAAAAACQpgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsbyF_2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW4xjQRBQSGdAGc1nQxBQUFJjVIsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0JCbUENEABtwzaBwYICcDw1AcA6gcCCADwB5GACIoIvAEKtwEAAAGIHhsrCEOmhkDtqB-Suw2C-Kwsl39ECyJ5JwKh9GydjUAJUqSxBjxlBMNVUO0p82WM3C9Vkyv_b4YURn-Tr8wGDrhf3T8CnS7yBAoomp62IayL5WcVeacc4uT6D2onJWsHhrlscKOtl06vrCt1Ox9Zo3Mzm2nhTYSdvokDeBwOy1wvHjOo_SeM3ARDIl6eRp8qaJBjRsKj45iLn1PMw3NgR7XqcXRjjyE_k3HjDlY9EqNumxoQAZUIAACAP5gIAQ..&s=70dd5d417e7ddee2fa9d4377d495b6bf5bfc2313&type=nv&nvt=5&jm=1003&px=1440&py=302&bw=160&bh=600&sid=8087001251715739968&vd=ct~0|rr~0&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27267942&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=10796&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:23 GMT
AN-X-Request-Uuid: 13b5e954-47b8-483e-9519-ccaf884d6984
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FD12 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss5H406xqjmPpAeHN9j6n9FeT_TKTljU6GRMbrGr2B8jt2FO9veM0-e3lrJo_qD-oT6S9NsKB_QiXJissIUDKR0kuvZcVVS8Wd2dZutIAgjOr7HE7vu_2aF7U3SdtHnsqIAfeN9xJlEXIDmBvPddHyydyc-kRO7W7gzvOIrsWrd8SLAZDxNnZSXkMqZ5tN81kOaPIGMYiEkOmQffeC_7yMW6KezKdcdJ_Q_WiSP7-fm5b8h0UnLqUwy0a9snWcnXXQGUcDR8T3akwbKkvIZvjdLzb5mTso5ynOH9PbOu9B7i49qEwpjTg5fqwYQ4b5sv64KplCbhTTj5Kskr5Y&sai=AMfl-YRa2_w0kpzBK4oa4L5R8rkgUWoLKpBtPzP_d6U8rj0Gbx9Nhe6mEn7c23ROZpn48HR5HkISL1cajuzmLrE759ME879mHFqkWgHy_GiRShjoQ980iFEpHOU9ZexHmgY&sig=Cg0ArKJSzBPbyzmzSXGOEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:23 GMT

GET
DATA 200
OK truncated
/ Frame FD12 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 40a3d66acb39f71a9d90d74be47076bb7ebab6810cf6dffe8265f30fd46b0a27

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200 lgc Show response
d9.flashtalking.com/ Frame EF30 103 B
710 B 102ms
56ms XHR
application/json 18.204.50.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/lgc
Requested by: Host: d9.flashtalking.com
URL: https://d9.flashtalking.com/d9core
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.50.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-50-167.compute-1.amazonaws.com
Software: Apache/2.4.52 () OpenSSL/1.0.2k-fips /
Resource Hash: 69563a7f27bac6aa4029625bccef177eaafa10dec6cb93b27a39e0c365137455

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fips
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: https://swiftmoves.blog
Content-Type: application/json;charset=ISO-8859-1
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 103

GET
H2 200 bootstrap.js Show response
s2.adform.net/stoat/626/s2.adform.net/ Frame F744 34 KB
16 KB 150ms
34ms Script
text/javascript 185.167.164.46
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Requested by: Host: a2.adform.net
URL: https://a2.adform.net/adfscript/?bn=62821215;click=https://nym1-ib.adnxs.com/click?1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjY0ODU=/bn=86922/clickenc=;encodedclick=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3D;ord=677038075
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.167.164.46 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8b1719d28e80205c8ce4ec2285a705276ff3bd6c2e6ba01ecb73d0a4f77b94a9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: HIT, STALE, STALE
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Wed, 07 Dec 2022 14:29:56 GMT

POST
H/1.1 200 lgc Show response
d9.flashtalking.com/ Frame 896F 103 B
710 B 109ms
63ms XHR
application/json 18.204.50.167
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/lgc
Requested by: Host: d9.flashtalking.com
URL: https://d9.flashtalking.com/d9core
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.50.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-50-167.compute-1.amazonaws.com
Software: Apache/2.4.52 () OpenSSL/1.0.2k-fips /
Resource Hash: 69563a7f27bac6aa4029625bccef177eaafa10dec6cb93b27a39e0c365137455

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Mon, 15 May 2023 06:31:23 GMT
Server: Apache/2.4.52 () OpenSSL/1.0.2k-fips
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: https://swiftmoves.blog
Content-Type: application/json;charset=ISO-8859-1
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 103

GET
H/1.1 200
OK nlp-bp.min.js Show response
js.ad-score.com/ Frame EF30 225 KB
71 KB 33ms
33ms Script
text/javascript 2600:9000:24fd:6a00:a:deb0:3380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/nlp-bp.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:6a00:a:deb0:3380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d286eef851ea0aee1720ce356279dc9bce93b3955eb577dd2a6a96d6277be004

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Sun, 14 May 2023 19:35:31 GMT
Content-Encoding: gzip
Via: 1.1 5cf3f25bf905bc6e52b9e72f44811c98.cloudfront.net (CloudFront)
Last-Modified: Sun, 14 May 2023 19:30:55 GMT
X-Amz-Cf-Pop: CMH68-P2
Age: 39352
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: text/javascript; charset=utf-8
Cache-Control: public, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Id: qKUxBE_1wIk3kOuxdVRdVS25alB56f5wirRNsyLLup_LixekLYlLRQ==

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame EF30 100 B
647 B 180ms
50ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=7d95c3724768367a4d071a3d&pm_pl=1684132283893&pm_td=20&pid=1000791&en=1.1&callback=__pm_glbl_RleYKpIp4C6VUsatiFCm99ot._gc1&tt=g&v=e3c1265
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 7c1cc30f9a9065d7000772b3aab2702c76b20339aba6d6b0df4cd3ab51d508a6

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Age: 0
Access-Control-Allow-Methods: POST
P3p: CP="CURa ADMa DEVa TAIi PSAi PSDi IVAi IVDi CONi HISa TELi OUR IND DSP CAO COR"
Access-Control-Allow-Origin: https://swiftmoves.blog
Content-Type: text/plain; charset=utf-8
Cache-Control: post-check=0, pre-check=0, false, proxy-revalidate, no-cache, no-cache=Set-Cookie, no-store, must-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 100

GET
DATA 200
OK truncated
/ Frame 11DB 266 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame EF30 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 28ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:24 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 6 KB
3 KB 168ms
167ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 6e0fb03e5fd0ea34d3ab0b2465336d6a3e459bd2d5fea46eb74aba6198f5f6c9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:23 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 144
content-length: 3397

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
412 B 98ms
97ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250h_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=e243a28f-b2ce-4396-a247-b82a32b3eda0&l_pb_bid_id=1540c196887f0c97&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250h_desktop&slots=1&rand=0.6231522126757572
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 805cae028281ab7ad00f348c2fa3fe88874bd9678915bf14dff549b3b4505c85

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 882 B
3 KB 81ms
80ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22156205cd0664dd7b%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250h_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=e470f229-5a33-45a7-9047-58b64376da89&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

3a1317c80a59ca0a76b997d2224934af8271cbe060e221a85704c9c82f27feab

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 533
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 119ms
119ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250h_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=e243a28f-b2ce-4396-a247-b82a32b3eda0&l_pb_bid_id=158b57adafa0501f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250h_desktop&slots=1&rand=0.4075416537615353
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f586c82e052359971ebb7c8f1943659607bfe56d405c75dc332794b98613014d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 38 B
510 B 41ms
41ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faf011fe7b2a378935eb578930927a984cd3e3db87128ff9b17c2b84de84ec10

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BPwMGPvxQeFUmCFwjlyFpw%2FL%2F6w4judIoV55nKY6%2BucfmRpw%2BxfJvn9Mdhu4f3YR4wh0FxcGBjbbzeb3HHeJ%2FLFAqeUk416%2FVuqD2TUCHp2dy02xLqSCAN%2FbYHqambMr2qk0CGYM"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c795677e9a1a210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 146 B
1 KB 128ms
127ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5bd3d442d27953e00fcd38c8053ed343ca87bea6b0ef5221f74a3c033eba94f1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: b0910857-ecd1-4ded-ab9f-56ee65b5d680
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 146
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
625 B 84ms
83ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 5e5052801e6f0ebbb4a9bc6d01f42407adbcce3ec5f5a0194535688ee1d55c5f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
432 B 295ms
294ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: db7828476f7d0007b32267edc807c1dbf241c4297f3a6c5cece808a43b0f1a04

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:24 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 39ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 39ms
39ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame D43C 356 KB
120 KB 64ms
64ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:24 GMT

GET
H2 200 625fe2e060223dbab8424f59 Show response
c.bannerflow.net/a/ Frame 0ABB 66 KB
22 KB 109ms
108ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd37cb19589a8763d28c8ca53750090c19d022ca71676a3a55d04055ec1eb5fa

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 15 May 2023 06:31:24 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, s-maxage=10
cf-ray: 7c7956781c6f7151-YUL
request-context: appId=cid-v1:1a5f66bd-0229-467a-a946-b3753e659ecb

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EF30 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvyUHW4byeXc6siVWHNBn8iqQh19DtwuguYwUt6ZwGwNvyCsMgaMGSSmDfYrO_WOvZxJ3mG42NL-EbeD7yMgOVW7a9lQ8mg6SZlXHAFL4C3H4LJaDOP4TK2Km_6kGqa1EC4s2gOgw_D_aeKZSrAfRQnlbD7YpGj1Tk0YtMaBKu9n1bW6n1wf6HKbyc-t367ybs4T0WVwDdQ4A98LjWXmNfHIJWnnVId-h7DON5Qccyccqpc-u64jkDYUk3NSRvHy7PtlK2WY2gi95khJ79s0iR6ERpTrMERzYBFgrxOD27NxEgqJJDPd4sI9ALiuSrTatBHZ22QLqqeW8g&sai=AMfl-YQ4Af2sE9jk1FE8CUkH42d3xHeTMUqDdtGsXbxnnkuvvriMl8TQF0D9g45tQbsps-ypnObQBj7YQsJMvCOTsc5brGZKKyEh_4OJJ8oiZF04hhJ2RSoXgsTkhSQmf2c&sig=Cg0ArKJSzLOE5kSoU6yXEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:24 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9D7E 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstERPxnQQoozIi53hhfWJOPN5kBh4cgclcZA5t2lhpUn-8Yw6PhElNfRaK8L0ISw2WDL9Pcxxh8vqqmwKSBZZS5A24hXc9jjhgHJgebgSve-FzH3Khkaz4eSqM7s_gxXJ_jHZAsuS3X1iP6bdLLvDTDzCrjQvHlvEDrek9Vmb8jIM1_3EO9aVhhG4jBhvFLTCY1RqKjFfbZuyLKRaRu5MwCZD8NYsp81RAvDxtdMDXwsWnbZMjaomjTrpDhy60J5MX75xQ2bC8j9NskSjRtwgPFMWUV_Tbi6BObBkeOwNeuz-LNjZkd-aFgXAgpw8MnDvBChuHa6bKe4BZs&sai=AMfl-YQbLOGV0BBVqj6cMpAqRtJv1UzcJK6ib-WIWLnH9aHEMRroJvcUrnmOFvSyKZTFojA7ijoYwUTxC5xQz-kZtx-7ytGN9zn5Rmh7VSyqJ20vfL2C-Q2IFynfAqtdo1E&sig=Cg0ArKJSzFNzo00yQF4XEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 client Show response
ssl.connextra.com/PowerPlay/selector/ Frame EEC4 1012 B
1 KB 92ms
92ms Document
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=1847144721&apnauc=8720478740126647032&bidid=8720478740126647032&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?EyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjYxOTU=/bn=97885/clickenc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0581a57d16bf84c546c73c929e5fe3f6acefb5995f1db6ffdea87fce32da7561

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 702
content-type: text/html;charset=utf-8
date: Mon, 15 May 2023 06:31:24 GMT
expires: Mon, 15 May 2023 06:31:24 GMT
p3p: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
pragma: no-cache
vary: * Accept-Encoding
x-served-by: vlp-cxtadsrv08.connextra.net

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E65B 52 KB
17 KB 38ms
10ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 546
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:24 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 834
X-Served-By: cache-lga13626-LGA, cache-yul12826-YUL
X-Timer: S1684132284.240131,VS0,VE0

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame 9D7E 0
933 B 19ms
18ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QLOGfBVzgwAAAMA1gAFAQi7o4ejBhD4heHE4KbXgnkYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eN38BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hWW9XNXNRaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOakU1TmVBRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBV3pNSkFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw4dUFZS5oCmQEhbUJidW93OkEHWFB5bmF5QUFLQUF4Ml9sLWFyeDA3ejg2MnkGFFVER1Awaw1nDER3UDE9RABGERgMQUFBRx0YAEcdGABIHRgMSGdBaS5VB9B3Li7YAudD4ALDy1nqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy_yAhEKBkFEVl9JRBIHNRZwCBzyAhIKBkNQRwEUAAgeXAgBFQgFQ1ABFAAJIlsIPPICDQoIQURWX0ZSRVESATAFEBxSRU1fVVNFUgUQAAwJIBhDT0RFEgDyAQ8BWREPEAsKB0NQFQ4QEAoFSU8BYQgHODIS5QgA8gEhBElPFSE4EwoPQ1VTVE9NX01PREVMASsUAPICGgoWMhYAHExFQUZfTkFNBXEIHgoaNh0ACEFTVAE-EElGSUVEAT4cFQoIU1BMSVQBTRnZ8LaAAwCIAwGQA-m9QZgDF6ADAaoDAMADrALIAwDYA5PL1QHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODOoBACyBBIIBBAEGKwCIPoBKAEoAjAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjE5NdoEAggB4AQB8ATps4_OAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAABDHgAANgFAeAFAfAFx7sy-gUECAAQAIoGgAFTQlRyVzFvQVDYREFBa0NCUUVJN2VuZkJoQ2Ruc0VDR002NjBBSWdCaWdBUU91bDBnVkkwcWJTQlZER1AxaW9NSDZuAgBnVW4EQUEBNwBBDgMKLEpvQkFnZ0FxQUVBcy4gAEBBLi6QBgCYBgCiBg4zMTUzIw3nGDg0uAYAwQYJuCjwP9AGqSXaBhYKEAkRGQEoEAAYAOAGAeoGKHUeHAsUMjYzMTMzEscKARQAaQ4wCxQ1MTI1MjYFFEDyBocBCKP_UxKAAVJ4UzVWVjb6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB938BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=9c6253d975a2b5e1629ce374caa6a8fcfd8a4a5c&bdref=https%3A%2F%2Fswiftmoves.blog%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F,https%3A%2F%2Fswiftmoves.blog%2F&

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: 7d0e5c61-efb3-4007-8613-5d448325d735
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/232/ Frame 9D7E 80 KB
28 KB 16ms
16ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/232/trk.js
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c93c88a9b0ecf4b158610988b79ffdc52501b1e995f14eb4dfc09c7eb9c3f6de

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Expires: Thu, 25 Apr 2024 08:42:19 GMT
Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 1633745
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27631
X-Served-By: cache-lga21975-LGA, cache-yyz4582-YYZ
Last-Modified: Wed, 26 Apr 2023 08:42:13 GMT
Server: AkamaiNetStorage
X-Timer: S1684132284.212360,VS0,VE0
ETag: "c342094e8bdad308ac07817d751fb315:1682498533.672161"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 13, 759258

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame 9D7E 0
933 B 21ms
20ms Image
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fswiftmoves.blog%252F&e=wqT_3QK3F_BVtwsAAAMA1gAFAQi7o4ejBhD4heHE4KbXgnkYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eN38BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hWW9XNXNRaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOakU1TmVBRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBV3pNSkFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw4dUFZS5oCmQEhbUJidW93OkEHWFB5bmF5QUFLQUF4Ml9sLWFyeDA3ejg2MnkGFFVER1Awaw1nDER3UDE9RABGERgMQUFBRx0YAEcdGABIHRgMSGdBaS5VB_Dedy4u2ALnQ-ACw8tZ6gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAPpvUGYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQSCAQQBBisAiD6ASgBKAIwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjYxOTXaBAIIAeAEAfAE6bOPzgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAUOcNgFAeAFAfAFx7sy-gUECAAQAIoGgAFTQlRyVzFvITnYREFBa0NCUUVJN2VuZkJoQ2Ruc0VDR002NjBBSWdCaWdBUU91bDBnVkkwcWJTQlZER1AxaW9NSDZXAQBnNVcEQUEBNwBBDuwILEpvQkFnZ0FxQUVBcy4gADxBLi6QBgCYBgCiBg4zMTUzEecYODS4BgDBBgW3LADwP9AGqSXaBhYKEAkRGQEoEAAYAOAGAeoGKHUeBQoUMjYzMTMzErAJARQAaQ4ZChQ1MTI1MjYFFEDyBocBCKP_UxKAAVJ4UzVWVjb6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB938BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=01b70a54c8cfcb89d122c793af52a4328b383abf

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: 52683f9a-f8bd-4309-9678-1f3dae6d55fa
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9D7E 169 KB
52 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:24 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 36ms
33ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:24 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 480 B
442 B 227ms
226ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 4c8aa95c5eb0a14554e4005f7fd415168330915205db15fc46c733b674eb785c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 203
content-length: 267

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 882 B
3 KB 82ms
81ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%221720d2820a9c0cc4%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250i_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=751dfb17-5ed9-41fa-93ef-458f7bf96d5d&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

bd3f826c68cb6a13f818e59f573a1e10f2cc9fdd89335690800aaa69fa008475

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 533
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
455 B 99ms
99ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: d6d109d4d04c29f586c45410144774681cf48716a851538525e23369e5b7710d

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:24 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 156ms
155ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250i_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=d3832eef-935f-42bc-b69c-28a12be71f55&l_pb_bid_id=1767046c9cf87082&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250i_desktop&slots=1&rand=0.8838823066204577
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: e665dd1c440a7f32f98b7b735f827bd53d809078ef40c7ea35fc6aae0b57896b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 38 B
508 B 48ms
48ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8a0dd8fee966c1f20402bb9b546d881990c21ec7366d95f5396c8cdfd3790a6

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TYw7QeidZU1OTO29IzbEVCt%2Bz88rKZF4gIjYsnIGlscK5WfG%2BIMLJObZ%2BGtPIXqKEAjBZ2LFAhXZso9%2FoC0hqEXK6e9XmqrRC5jALlpL%2Bw7tBzPjEAN7chhyAeq8A4mfoFLZkt5v"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c7956788a4ba210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 12 KB
7 KB 130ms
127ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

91e2dfc815870cbda79e1f11681f388a66443b67082d3c63794a27e34ceab805

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: bde44f32-d705-4eec-b445-d3ec8621af59
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
627 B 86ms
83ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: fce85ff68518da834aef17739edd1ba45ecc56eaf36c8c204daed3e87f01c410

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 100

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 106ms
104ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250i_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=d3832eef-935f-42bc-b69c-28a12be71f55&l_pb_bid_id=18690ce533a4e073&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250i_desktop&slots=1&rand=0.3900098403296197
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 5bcfacc86a82848536db110307f6413fe770d46bdf66f269834ab5e3a2d0479a

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame FD12 0
955 B 26ms
26ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QKfDfBVnwYAAAMA1gAFAQi6o4ejBhD2ipzejfHz120YyLrI8MzCwaEnKjYJ8tngRJXSuj8RMY10rbgkpj8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eP3FA4ABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICpQQhbzJ6VXBBaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPATG9EQ1U1WlRUSTZOVFl5TS1BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBSEJCQQE1CQEIeVFRCQkBARhOZ0VBUEVFAQsJAWBDSUJmY3JrQVdqXzFPWUJmeTkySWNCcVFVCR8YQUR3UDdFRgENIFFFcEYyel9CQgFPHEdoT0MtRV95BSgcQkFXUkRaUDkJKAkBBERaBSgBAfBDUEFfNEFXWFV2QUZncG1FQ3ZnRnlxSzdBb0lHQTFWVFJJZ0dCSkFHQVpnR0FLRUcyX2wtYXJ4MDd6LW9CZ1N5QmlRSkEBSAkBAFIJBwUBAFoFBgkBAGgJBwEBREM0QmdvLpoCmQEha3hhUW9naTYpAihQeW5heUFBS0FBeBltBDg2MmEBFDBER1AwawFOAEElBQAxPTQARhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERDwtkR3UHcuLtgC50PgAsPLWeoCGGh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nL4ADAIgDAZADjL9BmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEggEEAQYrAIg-gEoASgCMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo1NjIz2gQCCAHgBAHwBIUoIIgFAZgFAKAF_xEBGAHABQDJBQAFARTwP9IFCQkFC3wAAADYBQHgBQHwBce7MvoFBAgAEACKBoABaGhQU0sxbyE52ERBQWtDQlFFSW0tdmZCaENkbnNFQ0dNNjYwQUlnQmlnQVFPdWwwZ1ZJZ0tqU0JWREdQMWlQSjMxRwRBQSFXAGc1VwRBQQE3AEFh1CxKb0JBZ2dBcUFFQXMuIABEQS4ukAYAmAYAogYOMzE1MyNOBeccMDA3uAYAwQYBtjAAAPA_0AapJdoGFgoQCREZASgQABgA4AYB6gYodZHtFDI2MzEzM4WYARQAaaEBFDUxMjUyNgUUQPIGhwEIo_9TEoABSlJTRVQxNvoAQDk2UzlDQkNEX2JBQ0dLWGx0AcNAeWdBUU55UThRUkk5dkNtQ0b--gAJ-nCABwGIBwCgBwG6BwgqBDEtLS1AAcgH_cUD0gcNCQnkBERAAeII2gcGIa5wGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=09420e39a0724f436ea311e2ced0db30eb98378c&type=nv&nvt=5&jm=1003&px=1070&py=1074&bw=300&bh=250&sid=8087001251715739968&vd=ct~0|rr~0&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27300707&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=10796&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: c723445a-f3fe-4a1f-b405-d2d5f4de61ae
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 896F 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssEK37OF02dsvdnamM4sdUCXLtFSHvrolpxCfYHI3vDV742to7K-v2h0fFcoA5pXbVL4Vb4DrwsPXiCkBtfNrd_3dG7I5lObmI-M1P5tQlkOlOJBBS3R0Ue2KSGezd4v19ExOBto1Ib0HYBdoRSwCgA8cY-ZmkxKV17pwKbzBFv1Jypg9IspKiteH-Wg_ojTudhJk7yZg74HWF7WivOZs2WVEwTJU4G7C0mvZscc2iu-oWsTB-Gh_wL1fDbrGK-ND9ZTiz2BB_fgMO-eoB_ZuRV_Q5JUgxXsmk0U4ai4rEq6artBAn4innE7LhMypEu0VSmXtgTyEf_kzU&sai=AMfl-YR6xvakg7EUzcZ4ai32eAQUDAdlfv_5HyCB_rf72FK2vLES_eX6r6IxCSBEipureaxhr5RfN7R0Ca5-JKpfLgqK1hzCYourupJUkkxU2bq6Z0NW8d72Sxvu6gcwo68&sig=Cg0ArKJSzPPHRs2MQ-1oEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:24 GMT

GET
DATA 200
OK truncated
/ Frame 896F 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44291e4baead782f1e37eb9ba5cce6cee1c328bd6bbd0e137fce120e0af7ac6a

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 2B2B 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3153&pub_id=1424069&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: ca7b9c91-5ed3-465c-9854-c31a2fb4f28e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/6834967;3881893;0;401;15F0D346-D356-B756-186C-BDA544C42A21/ Frame EF30 42 B
343 B 129ms
128ms Image
image/gif 23.192.1.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servedby.flashtalking.com/state/6834967;3881893;0;401;15F0D346-D356-B756-186C-BDA544C42A21/?ft_data=d9:4a033ed5fac442f780cc4780df29dd4b;d9s:4a033ed5fac442f780cc4780df29dd4b&cachebuster=734274933

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.1.177 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

prod-xre-app14.ash11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Strict-Transport-Security: max-age=86400
Server: prod-xre-app14.ash11
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 42
Expires: Mon, 15 May 2023 06:31:24 GMT

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/6834967;3881893;0;401;C756D4B4-7746-044D-FFF9-A78048FB43EB/ Frame 896F 42 B
343 B 325ms
254ms Image
image/gif 23.192.1.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servedby.flashtalking.com/state/6834967;3881893;0;401;C756D4B4-7746-044D-FFF9-A78048FB43EB/?ft_data=d9:4a033ed5fac442f780cc4780df29dd4b;d9s:4a033ed5fac442f780cc4780df29dd4b&cachebuster=974007725

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.192.1.177 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

prod-xre-app19.ash11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Strict-Transport-Security: max-age=86400
Server: prod-xre-app19.ash11
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 42
Expires: Mon, 15 May 2023 06:31:24 GMT

GET
BLOB 200
OK a1988b82-8e2e-410c-8453-ca953dee06d0
https://swiftmoves.blog/ Frame EF30 720 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/a1988b82-8e2e-410c-8453-ca953dee06d0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2ec07a6e77bc3abc56f801e141e9889c018ca8e96dfbe4042f49378699ee85f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 720
Content-Type: application/javascript

GET
BLOB 200
OK 2fbe6c6f-e721-4eb8-8c99-ed4a4a611d28
https://swiftmoves.blog/ Frame EF30 725 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/2fbe6c6f-e721-4eb8-8c99-ed4a4a611d28
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb32ef70baf6f49f09b1fe50f680f2217d8fc8021f2b91beaabb96f6d582c96b

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 725
Content-Type: text/javascript

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 1041 12 B
100 B 37ms
36ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame 1041 107 B
122 B 37ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 1041 107 B
122 B 33ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8FCE 603 B
65 B 157ms
156ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=2563048740&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132284&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132283327&bpp=5&bdt=229&idt=1036&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132284&ga_hid=1351263205&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=1039922214&scr_x=0&scr_y=0&eid=31071755%2C44772269%2C44788442%2C44792089&oid=2&pvsid=4376816124959109&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.6dyldr6rwc06&fsb=1&dtd=1045

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK nlp-bp.min.js Show response
js.ad-score.com/ Frame 896F 225 KB
71 KB 33ms
33ms Script
text/javascript 2600:9000:24fd:6a00:a:deb0:3380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/nlp-bp.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=C756D4B4-7746-044D-FFF9-A78048FB43EB&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=534207031&pub_ts=1684132282
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:6a00:a:deb0:3380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d286eef851ea0aee1720ce356279dc9bce93b3955eb577dd2a6a96d6277be004

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Sun, 14 May 2023 19:35:31 GMT
Content-Encoding: gzip
Via: 1.1 5cf3f25bf905bc6e52b9e72f44811c98.cloudfront.net (CloudFront)
Last-Modified: Sun, 14 May 2023 19:30:55 GMT
X-Amz-Cf-Pop: CMH68-P2
Age: 39353
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: text/javascript; charset=utf-8
Cache-Control: public, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Id: ANsox2XknVkOAEnCARlSr-VVwuyqIjE4Zg4QpojBAp9WQalDxXqUjw==

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 896F 100 B
647 B 51ms
50ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=e5dee7f10e44a019efb39927&pm_pl=1684132284489&pm_td=16&pid=1000791&en=1.1&callback=__pm_glbl_cZYhO3K9c149mwORnLbbRUIU._gc1&tt=g&v=e3c1265
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: d58e107dca9171fa491e7d7f4edebfd37bbf709512eb6af3ad953ab76c98c2f9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Age: 0
Access-Control-Allow-Methods: POST
P3p: CP="CURa ADMa DEVa TAIi PSAi PSDi IVAi IVDi CONi HISa TELi OUR IND DSP CAO COR"
Access-Control-Allow-Origin: https://swiftmoves.blog
Content-Type: text/plain; charset=utf-8
Cache-Control: post-check=0, pre-check=0, false, proxy-revalidate, no-cache, no-cache=Set-Cookie, no-store, must-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 100

GET
DATA 200
OK truncated
/ Frame 896F 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 797C 266 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

Referer

Response headers

Content-Type: image/svg+xml

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A31A 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvmMiQM5jMU3GFelEkQ0iFVUQjPwXblOrUu_rR8WKzugQeaWSeqdjmKAr_rEcHRQKBqk4vcno3H0ECoxk1ZA3OIStiLH2sd4Potsncw_00pnPyXWhboqKestC2NJEobEgRdNA78BNfIEKLMdyI8PxuhC0JzpT8NS9B14rvY-nVmbLAFRuF_3eVLOwHjGYbxTkp9v9Uhmk5m14_mgS_qwSFZk4ViGJ8AS0w1kcHNCrFuoLHG_0L4UF1VUwyT2TwovUIQ-67Qrrl3PRxsGKdJq10CNXoJDkRUrWqihRU1O_KeE7I0M520_4tIm9_jtYqxG08CE2tzEao_Ris&sai=AMfl-YRnj596rk5XOkYIg6fnOd26y74SA_v3FWH-IHHMOfrZdXRuD3Kua99_36n53stkSFL2s3CT7FMgFxt0joFkHjOGaNItNPUU0XIb48s4m4O_AVDKY3dTyhS-b2Y8Mj0&sig=Cg0ArKJSzOOm4PF4jqAyEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:24 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A31A 15 KB
11 KB 45ms
45ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d64fb20a951acf612d58bab64dd0854ce0492a766b28c7a341eb623ad164e93d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11220
x-xss-protection: 0

GET
H2 204 g_pbst
1x1.a-mo.net/hbx/ Frame AD9F 0
88 B 25ms
23ms Image
text/plain 18.210.45.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbst?A=amx&w=300&h=250&bid=168f74ffa152766d&c1=banner&np=0.03577061922508443&aud=13770d654fde54bd&a=div-gpt-ad-saambaa300x250x1-6&c2=hb_bidder%3Damx%26hb_adid%3D168f74ffa152766d%26hb_pb%3D0.03%26hb_size%3D300x250%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_adomain%3Droobet.com%26hb_acat%3D&ts=1684132284729&eid=2064c6944e7656de
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.45.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-45-24.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame AD9F 35 B
296 B 53ms
17ms Image
image/gif 104.117.182.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=dee5b54f-54ba-426f-8172-af4abb7a7ed8&cid=8CU533H8Y&crid=247323461&adunit_count=1&dn=swiftmoves.blog&requrl=https://swiftmoves.blog/&istop=true&event=client_timeout&value=1&rd=700
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.117.182.8 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 15 May 2023 06:31:24 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AD9F 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AD9F 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 25 KB
11 KB 459ms
459ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=600413851427149&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250g_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=7&adks=1442373129&sfv=1-0-40&prev_scp=hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.03%26hb_adid_amx%3D168f74ffa152766d%26hb_bidder_amx%3Damx%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.03%26hb_adid%3D168f74ffa152766d%26hb_bidder%3Damx&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132284738&lmt=1684132284&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=tvsy9brdft19&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ%2CABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0%2CABHeCvhbNkjF3LrpFe-1wYs2ZaV8cktmPxfZRoe1aLV2GL3csnJ7Ora7co1wQ7kJ3r41n06jCxvAnMM3oohhUnrQ961wLK0d%2CABHeCvhS0pJYIgbubKkj3-a_Cp-VEfAkkOL1Z2DZBJ53L_6ydz4tTnkNI72GHfBuQu9Ih4cO6cy3ZZb-wuhoGDHNim5Sh6uUjKhH-F8%2CABHeCvisP77ipA7kXsDpaR8U3StI_MWtCArY0tV7tp74qcY_Xz5scK-Q821i4X621ohLnZs-1rlYzRobuceRpzaoHCbK_qKQTd_nSks&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ce250c6aca5cb215b94798754a4065cb41fd7cb4bdc008d60f8426b55e9abe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11127
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760800
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 controller Show response
ssl.connextra.com/servlet/ Frame 6A96 847 KB
71 KB 367ms
366ms Document
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=10830290&apnauc=6070106940761623787&bidid=6070106940761623787&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?EyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA./bcr=AAAAAAAA8D8=/cnd=%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjUwODA=/bn=89887/clickenc=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a5dccddd9245052ee6be96dfa25eaab8bc2178b492538a811080b01cd635bbd2

Request headers

Referer: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=10830290&apnauc=6070106940761623787&bidid=6070106940761623787&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?EyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA./bcr=AAAAAAAA8D8=/cnd=%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjUwODA=/bn=89887/clickenc=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 06:34:21 GMT
vary: Accept-Encoding
x-served-by: vlp-cxtadsrv02.connextra.net

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 26ms
25ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MCw2MDBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyMTY4NjQ0NjUwMTUyMjk3IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExOTMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI1ODAzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjIxNjg2NDQ2NTAxNTIyOTciLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTE5MywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjU4MDMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:24 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjE2ODY0NDY1MDE1MjI5NyIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTE5MywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNTgwMywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:24 GMT

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 27ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:24 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 38 B
506 B 68ms
67ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed407dd43775e850a3b742281d291dc61dca47c030ed9f06feb8f1987e200f56

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MIBrfcl1f51TyzVOmPBQ750bHrQxu1O9J6Qw%2FSl%2BRY9JEluOxgBAsSLconypuUgMLld8l0728Je8UZ63dPonKOiQk4inNSgu74%2FOL3%2FgJWJnGOBsgivzxTskGwgv%2Ft2vXimGvbSm"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c79567c0e63a210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 882 B
3 KB 78ms
78ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2219120c4783f46121%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250j_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=c30a517d-2802-4280-94ab-27127ae5ece3&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

ed2890a4a7964d686c76e3c8496d5f378d9f7cc15f3d6ae9b75b33f4747b8726

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 534
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
627 B 151ms
150ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: c55e7b1194bfffdb2707de58df31acbe999aecf932ff8e1a82b876fdf73e2c9f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 100

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
433 B 91ms
90ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1df3733bdbababdecacb33f597250dcd4f1e60dea30517f6f66fa67d7dbd2376

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:24 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 94ms
94ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250j_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=5a552f52-cea1-40d4-9b34-78f8c46cbf5c&l_pb_bid_id=19752ccd31aa8596&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250j_desktop&slots=1&rand=0.22693295217417253
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 021f17c7c055b94ec58209eddc618c0039da7c742a16c0f14d2ff85106a0353e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
162 B 29ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 354 B
389 B 116ms
116ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250j_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=5a552f52-cea1-40d4-9b34-78f8c46cbf5c&l_pb_bid_id=201559298b917333&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250j_desktop&slots=1&rand=0.9337798733696165
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d505a9ff29283f93a179e9a9633a6d8a5b0583b3105111d6716d8006fa83d87b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 354
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 12 KB
7 KB 157ms
157ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

7e8529712f3f37902ba841e58c8a84d50bdb9d66c9a305764d33461ac75e79e3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:24 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a53b20ff-255f-425b-bea3-64b0ffc526aa
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame AD9F 480 B
418 B 233ms
233ms XHR
application/json 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 4c8aa95c5eb0a14554e4005f7fd415168330915205db15fc46c733b674eb785c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 210
content-length: 267

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
62 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTkyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk1MiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MCw2MDBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0MDk1OTAzMjg0MTYyOTM2IiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExOTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTUyLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQwOTU5MDMyODQxNjI5MzYiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTE5MiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5NTIsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:27 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:27 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame 896F 0
955 B 31ms
31ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QLeDfBM3gYAAAMA1gAFAQi1o4ejBhDIxtvwtPzLxwUYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVEREPQqAUR3UHcuLtgCAOAC4ZE86gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBf-OA_oFBAgAEACQBgCYBgCiBg43NjIwI05ZTTI6NjQ3NLgGAMEGAAAAAAAA8D_QBqkl2gYWChAAAAAAAAAAAAAACQpgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsbyF_2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW4xjQRBQSGdAGc1nQxBQUFJjVIsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0JCbUENEABtwzaBwYICcDw1AcA6gcCCADwB5GACIoIvAEKtwEAAAGIHhsrCAWPL-NOFuNIRSj7lA3s00YiDhYHrh9_WDUACdVBJpV8rMecT50k8tSE0tKgpF1Bk56jrKvuwOtXjxOJe7dop7EvlpfwLAWn0wt2ZMCC59vY_TUCY_LSJ_YgO7MDckamwByHWkOf-y_10SGPwDFC_1SXJpk_OplXVjgUTg-tExMy7WY2O0vLg0dFtHGI7C5bY8GHyL8SpoX9ZdbvVhANjlc9iYAFMsbbtisk7HAnCs4QAZUIAACAP5gIAQ..&s=9c592c4dbb99682798c65c8cb85d058073863e05&type=nv&nvt=5&jm=1003&px=0&py=302&bw=160&bh=600&sid=8087001251715739968&vd=ct~0|rr~0&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27267942&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=10796&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: b4d00f91-d17d-49a1-99c7-30ba521475d9
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame D43C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48441057d3efde18afea04c4d28e16697ad0ffe60184e45840cdebfe7f7832c1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 / Show response
a2.adform.net/adfserve/ Frame F744 5 KB
3 KB 21ms
21ms Script
text/javascript 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/adfserve/?bn=62821215;click=https://nym1-ib.adnxs.com/click?1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjY0ODU=/bn=86922/clickenc=;encodedclick=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3D;ord=677038075;js=1;adfxid=1x;6058;set=en-US|en-US|1600X1200|0|250|250|24|8|3|7|0|0;cmpgdpr=;cmpgdprconsent=;fd=0|2&CREFURL=https%3A%2F%2Fswiftmoves.blog%2F

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

fecda91cc0c8c436cb46dc071222fa3d1062c731aac0d39e952e7655ece6418d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 2346
expires: -1

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 24ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDA5NTkwMzI4NDE2MjkzNiIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTE5MiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk1MiwiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:24 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6710 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7620&pub_id=964152&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: c47df29a-90d3-43d9-9d8f-ffced31cf6c0
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 g_pbst
1x1.a-mo.net/hbx/ Frame AD9F 0
88 B 25ms
25ms Image
text/plain 18.210.45.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbst?A=amx&w=300&h=250&bid=2089d00cf10fe56d&c1=banner&np=0.03577061922508443&aud=152386964f4cd855&a=div-gpt-ad-saambaa300x250x1-7&c2=hb_bidder%3Damx%26hb_adid%3D2089d00cf10fe56d%26hb_pb%3D0.03%26hb_size%3D300x250%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_adomain%3Droobet.com%26hb_acat%3D&ts=1684132284934&eid=209868f98167ad09
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.45.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-45-24.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:24 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 25 KB
11 KB 472ms
471ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=1797941526157387&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250h_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=8&adks=2125634353&sfv=1-0-40&prev_scp=hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.03%26hb_adid_amx%3D2089d00cf10fe56d%26hb_bidder_amx%3Damx%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.03%26hb_adid%3D2089d00cf10fe56d%26hb_bidder%3Damx&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132284941&lmt=1684132284&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=6zyzthdz9b73&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ%2CABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0%2CABHeCvhbNkjF3LrpFe-1wYs2ZaV8cktmPxfZRoe1aLV2GL3csnJ7Ora7co1wQ7kJ3r41n06jCxvAnMM3oohhUnrQ961wLK0d%2CABHeCvhS0pJYIgbubKkj3-a_Cp-VEfAkkOL1Z2DZBJ53L_6ydz4tTnkNI72GHfBuQu9Ih4cO6cy3ZZb-wuhoGDHNim5Sh6uUjKhH-F8%2CABHeCvisP77ipA7kXsDpaR8U3StI_MWtCArY0tV7tp74qcY_Xz5scK-Q821i4X621ohLnZs-1rlYzRobuceRpzaoHCbK_qKQTd_nSks&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41e76efd6c266016f621cf43e5367cb8aaf195d1bdffcbbf027c2df0174a8831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11128
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760800
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 9dc32f5a-013c-41fd-a02d-c6dd9af5c618
https://swiftmoves.blog/ Frame 896F 720 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/9dc32f5a-013c-41fd-a02d-c6dd9af5c618
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2ec07a6e77bc3abc56f801e141e9889c018ca8e96dfbe4042f49378699ee85f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 720
Content-Type: application/javascript

GET
BLOB 200
OK 6553b39e-d44e-45ce-a604-fb3b5cf54d21
https://swiftmoves.blog/ Frame 896F 725 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/6553b39e-d44e-45ce-a604-fb3b5cf54d21
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb32ef70baf6f49f09b1fe50f680f2217d8fc8021f2b91beaabb96f6d582c96b

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 725
Content-Type: text/javascript

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame BB80 0
861 B 20ms
20ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3153&pub_id=1424069&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:24 GMT
AN-X-Request-Uuid: 98ae94fb-c6aa-41fd-a025-85b7dd17df10
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C629 0
861 B 27ms
26ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7620&pub_id=964152&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: 2d61c554-0a90-48cc-98cc-fdebcd127b44
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame A31A 61 KB
23 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1670
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 25ms
24ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwiYWRfcG9zaXRpb24iOjExMDIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMjUwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjM1NjA3MjEzMzYxMTk4MzAiLCJkb21haW5faWQiOiIyODQ4MzciLCJ1bml0IjoiZGl2LWdwdC1hZC1zd2lmdG1vdmVzX2Jsb2ctYm94LTItMCIsInRfZXBvY2giOjE2ODQxMzIyNzIsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiQ0EiLCJwYWdldmlld19pZCI6ImJhMDg4MjczLTQxN2ItNGRkNS01NWY1LTRmNWZlZmRkYzM5ZiIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NTcyODA3NTU5NywiY3JlYXRpdmVfaWQiOjEzODM1NDQyNjk4OCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIzNTYwNzIxMzM2MTE5ODMwIiwiZG9tYWluX2lkIjoiMjg0ODM3IiwidW5pdCI6ImRpdi1ncHQtYWQtc3dpZnRtb3Zlc19ibG9nLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg0MTMyMjcyLCJhZF9wb3NpdGlvbiI6MTEwMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkNBIiwicGFnZXZpZXdfaWQiOiJiYTA4ODI3My00MTdiLTRkZDUtNTVmNS00ZjVmZWZkZGMzOWYiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjU3MjgwNzU1OTcsImNyZWF0aXZlX2lkIjoxMzgzNTQ0MjY5ODgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:25 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:25 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A31A 17 KB
6 KB 38ms
37ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E0EE 0
0 41ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuevlsYUC3qgJ6xSWk2eToR0PJwtLco4vmelllkekeokydN0ulkhcwb_M4-NRvn_t2ZyNnxoEunrp6rRAe68aVu3pnyFZRCR4AcUud6Xl7U3KPFvyWLGpRk2QsF2wBOUsGYTSTAiXC4PzFGFI7KP2Godp4B78xY10lJOsNRWd09GaMd2cE1e_rkfXAEuF_LpkNPHDSp2zghNjufKw1KuyGO_bnR3tYU9OiB5nLEWOZ-OMThEM0fKTU2B1a3siG6h4V1iu_sjLYlFr44nIlZIIJsph6GcG4LkxfobEq9G3ruEtKg1AjEJxba1BC7utoFvYKn2nnJFFAGCXcuDTw&sai=AMfl-YTL0THkqi2_uwZByozOA85gcsnfxZTP0og43yRF9VIzET4Z1THYjO0zLILC_1RLN1R2V2aTTO3DqJ-0geUeAs_M6YojEhafCNkG9f4WKhQF70t17jGBcE-k76SaFyE&sig=Cg0ArKJSzOw7cBZKbKoBEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:25 GMT

GET
DATA 200
OK truncated
/ Frame E0EE 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c139da48064b9dd5ce400813fad85b86f7b86d430a3fddd671ab9daf018eb4f9

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 widget.a0ee525be0aa0e318bac.js Show response
c.bannerflow.net/scripts/ Frame E5CE 20 KB
7 KB 20ms
17ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.a0ee525be0aa0e318bac.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01dc3974a3547aca42208299f82cef5e6b0dee9977d5c5a50b1753afd03aef5c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 1joVYV0qQYfRzVl/isxzog==
age: 27504738
cf-polished: origSize=20342
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 30 Jun 2022 08:21:42 GMT
server: cloudflare
etag: W/"0x8DA5A71906D5B19"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0b9fb75e-001e-0010-46b9-8c284e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79567e68d87151-YUL

GET
H2 200 feed.441c69936f1e15d1037a.js Show response
c.bannerflow.net/scripts/ Frame E5CE 5 KB
3 KB 19ms
16ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/feed.441c69936f1e15d1037a.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4542ff719b7f71dda953d35c75a41428bf407c0287f0af83af44372a749e7532

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: HjCD0xuNE9h4q0XgjcZIhQ==
age: 9085826
cf-polished: origSize=5036
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Mon, 27 Jun 2022 09:04:23 GMT
server: cloudflare
etag: W/"0x8DA581C078507CE"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 306ed3c5-701e-009c-14fc-8a4040000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79567e68dd7151-YUL

GET
H2 200 document.f70c078e3a.js Show response
c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/published/2180173/2729039/ Frame E5CE 96 KB
21 KB 21ms
19ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/published/2180173/2729039/document.f70c078e3a.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91b57db7237541b6379ce312c96b7784885ff63ef13e7a15a8abc953e2a8c68a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 9wwHjjodN849iXpVZuIhqQ==
age: 19285923
cf-polished: origSize=101729
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 07 Jul 2022 13:24:47 GMT
server: cloudflare
etag: W/"0x8DA601C1039BF63"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 62d0e280-a01e-00a0-458f-d76987000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79567e68df7151-YUL

GET
H2 200 animated-creative.62c08aa132f36f133041.js Show response
c.bannerflow.net/scripts/ Frame E5CE 144 KB
50 KB 22ms
20ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06e3280dbb4ee5cb074a7eb90d27da1331e9a197b2e69ca5ec18bf855fadfb2b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 8DnEqA1lSGC6aUU7Nn6dcw==
age: 557934
cf-polished: origSize=147411
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 30 Jun 2022 08:21:42 GMT
server: cloudflare
etag: W/"0x8DA5A71904BA524"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 854e92b4-201e-0007-3225-388145000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79567e68e17151-YUL

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E65B 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3153&pub_id=1424069&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: 9fcd8089-4421-41e7-96a7-402464a2fea9
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_025.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 109 KB
110 KB 36ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_025.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5965eb2c3c5fe73b1b141a2597868068af57b729183d498a4a4a791b6e8a82fd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1123
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cWEQz%2FaMtvDuSocwOdTmFvy17rIaccNNk66YtsTY4P2I6FAfPwmfwuS7nIAVMvaEQmAP5GqD46ek3iZme0DYcYwsPLtf9DgoKqYWCONVInVQrsqZVSnBUCGeRDJfnCJiqT8Nc3I9jIeq0IJ3XbTKppRo"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79567e8dbb5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 111954

GET
H2 200 controller Show response
ssl.connextra.com/servlet/ Frame 1FF6 847 KB
71 KB 21ms
18ms Document
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=1847144721&apnauc=8720478740126647032&bidid=8720478740126647032&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?EyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjYxOTU=/bn=97885/clickenc=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a5dccddd9245052ee6be96dfa25eaab8bc2178b492538a811080b01cd635bbd2

Request headers

Referer: https://ssl.connextra.com/PowerPlay/selector/client?client=PowerPlay&placement=DDM_CAS_ACQ_CA_ROC_300x250&_cb=1847144721&apnauc=8720478740126647032&bidid=8720478740126647032&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?EyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw../cca=NzMyMCNOWU0yOjYxOTU=/bn=97885/clickenc=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-length: 72240
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 06:34:21 GMT
vary: Accept-Encoding
x-served-by: vlp-cxtadsrv02.connextra.net

POST
H2 204 army.gif
swiftmoves.blog/porpoiseant/ 0
16 B 23ms
23ms Ping
text/plain 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://swiftmoves.blog/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMzU2MDcyMTMzNjExOTgzMCIsImRvbWFpbl9pZCI6IjI4NDgzNyIsInVuaXQiOiJkaXYtZ3B0LWFkLXN3aWZ0bW92ZXNfYmxvZy1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NDEzMjI3MiwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTAyLCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJDQSIsInBhZ2V2aWV3X2lkIjoiYmEwODgyNzMtNDE3Yi00ZGQ1LTU1ZjUtNGY1ZmVmZGRjMzlmIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo1NzI4MDc1NTk3LCJjcmVhdGl2ZV9pZCI6MTM4MzU0NDI2OTg4LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://swiftmoves.blog
x-middleton-display: ezp_sol
date: Mon, 15 May 2023 06:31:24 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Sun, 14 May 2023 06:31:24 GMT

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame EF30 1 B
271 B 94ms
93ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=7d95c3724768367a4d071a3d&pm_pl=1684132283893&pm_td=1323&pid=1000791&en=1.1&callback=__pm_glbl_RleYKpIp4C6VUsatiFCm99ot._gc2&tt=g&v=e3c1265
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:25 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
142 B 479ms
478ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=2320137887434351&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3D8b07bae800b215e481d05a271b3e723b%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132285221&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=timeout

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 g_pbto
1x1.a-mo.net/hbx/ Frame AD9F 0
88 B 25ms
23ms Image
text/plain 18.210.45.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbto?A=undefined&bid=undefined&a=undefined&cn=undefined&aud=undefined&ts=1684132285239&eid=2107ca53123cd0ab
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.45.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-45-24.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame AD9F 35 B
296 B 19ms
18ms Image
image/gif 104.117.182.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=a838f3ea-23d3-4e68-ad65-4216775fc05e&cid=8CU533H8Y&crid=247323461&adunit_count=1&dn=swiftmoves.blog&requrl=https://swiftmoves.blog/&istop=true&event=client_timeout&value=1&rd=700
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.117.182.8 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-117-182-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 25 KB
11 KB 221ms
221ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=1492118069433226&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250i_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=9&adks=163791493&sfv=1-0-40&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132285245&lmt=1684132285&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=cakhfv3fib17&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ%2CABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0%2CABHeCvhbNkjF3LrpFe-1wYs2ZaV8cktmPxfZRoe1aLV2GL3csnJ7Ora7co1wQ7kJ3r41n06jCxvAnMM3oohhUnrQ961wLK0d%2CABHeCvhS0pJYIgbubKkj3-a_Cp-VEfAkkOL1Z2DZBJ53L_6ydz4tTnkNI72GHfBuQu9Ih4cO6cy3ZZb-wuhoGDHNim5Sh6uUjKhH-F8%2CABHeCvisP77ipA7kXsDpaR8U3StI_MWtCArY0tV7tp74qcY_Xz5scK-Q821i4X621ohLnZs-1rlYzRobuceRpzaoHCbK_qKQTd_nSks&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c25ce02346828cbc2a36841dbf09f0381445fa57478af46c25526e7b9f35371

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11142
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760761
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 load3.js Show response
ssl.connextra.com/services/ActiveAd/ Frame A310 3 KB
873 B 20ms
18ms Script
application/x-javascript 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/services/ActiveAd/load3.js
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: efa868a96d117a28e0d2d0e338e2b248179d0247cd5e4bfa73363d8001e03a82

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
last-modified: Wed, 16 Nov 2016 14:10:53 GMT
server: AkamaiNetStorage
etag: "743a5e7701b844723629ba8123740a92:1479305453"
vary: Accept-Encoding
content-type: application/x-javascript
accept-ranges: bytes
content-length: 687

GET
H3 200 css
fonts.googleapis.com/ Frame A310 2 KB
559 B 50ms
49ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:900

Requested by

Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

84a947089c5f55ed502c6d680ff58c1bbca5a267f83255a07fce396190380935

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 06:22:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame A310 139 KB
48 KB 38ms
34ms Script
text/javascript 2607:f8b0:400c:c12::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c12::95 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ec5fd82b2b5642bcd2bb6f6db113306135239c684e8b41ee971aaeeb436d84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:21:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 621
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48652
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 15 May 2023 06:36:04 GMT

GET
H2 200 load3.js Show response
ssl.connextra.com/services/ActiveAd/ Frame 6A96 3 KB
873 B 20ms
18ms Script
application/x-javascript 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/services/ActiveAd/load3.js
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: efa868a96d117a28e0d2d0e338e2b248179d0247cd5e4bfa73363d8001e03a82

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
last-modified: Wed, 16 Nov 2016 14:10:53 GMT
server: AkamaiNetStorage
etag: "743a5e7701b844723629ba8123740a92:1479305453"
vary: Accept-Encoding
content-type: application/x-javascript
accept-ranges: bytes
content-length: 687

GET
H3 200 css
fonts.googleapis.com/ Frame 6A96 2 KB
559 B 60ms
58ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:900

Requested by

Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

84a947089c5f55ed502c6d680ff58c1bbca5a267f83255a07fce396190380935

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 06:30:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 6A96 139 KB
48 KB 45ms
44ms Script
text/javascript 2607:f8b0:400c:c12::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400c:c12::95 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ec5fd82b2b5642bcd2bb6f6db113306135239c684e8b41ee971aaeeb436d84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:21:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 621
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48652
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 15 May 2023 06:36:04 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FD12 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstjbRZWj2NXjBKdTOc2TvtMf0sMgdvCbOeHbZMmi5Yn8AOB2Zs6eJ4-QdUW31Ir4Ad-fvt73D42mx33wpvpKpkTNo6xakRNnfGcnsAnQoRCRXdJvABb&sig=Cg0ArKJSzNgdPAYMlfrNEAE&id=lidar2&mcvt=1237&p=1074,1070,1324,1370&mtos=0,0,1237,1237,1237&tos=0,0,1237,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=453499054&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132283196&rpt=579&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame E0EE 0
955 B 18ms
17ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QK3F_BVtwsAAAMA1gAFAQi7o4ejBhDrmeuFocPWnlQYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eJ--BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hZG9YVW5RaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOVEE0TU9BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBWFlKNUFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw0dUFZS5oCmQEha0JhNG8-QQdYUHluYXlBQUtBQXgyX2wtYXJ4MDd6ODYyeQYURURHUDBrDWcMRHdQMT1EAEYRGAxBQUFHHRgARx0YAEgdGAxIZ0FpLlUH8N53Li7YAudD4ALDy1nqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy-AAwCIAwGQA4y_QZgDF6ADAaoDAMADrALIAwDYA5PL1QHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODOoBACyBBIIBBAEGKwCIPoBKAEoAjAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NTA4MNoEAggB4AQB8ATps4_OAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAABQ5w2AUB4AUB8AXHuzL6BQQIABAAigaAATRSTi1QRm8hOdhEQUFrQ0JRRUltLXZmQmhDZG5zRUNHTTY2MEFJZ0JpZ0FRT3VsMGdWSWdLalNCVkRHUDFqaE1INlcBAGc1VwRBQQE3AEEO7AgsSm9CQWdnQXFBRUFzLiAAPEEuLpAGAJgGAKIGDjMxNTMJ5yA2MjQxuAYAwQYFtywA8D_QBqkl2gYWChAJERkBKBAAGADgBgHqBih1HgUKFDI2MzEzMxKwCQEUAGkOGQoUNTEyNTI2BRQ88gaHAQij_1MSgAFnQlF3WTr6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB5--BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=d426a12dcaffa96cc41a632b405cfa959bef7981&type=nv&nvt=5&jm=1003&px=1070&py=1074&bw=300&bh=250&sid=8087001251715739968&vd=ct~0|rr~0&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27300707&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=10796&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: 469577cc-c1d0-4df8-aff0-93a4d5875470
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame D43C 12 B
53 B 39ms
38ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame D43C 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame D43C 107 B
122 B 35ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 115A 603 B
65 B 116ms
115ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=2565566358&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132285&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132284155&bpp=5&bdt=786&idt=1287&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132285&ga_hid=952083748&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=3214504027&scr_x=0&scr_y=0&eid=44788441%2C44792088&oid=2&pvsid=2779369445405892&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.mxfgylfepk8j&fsb=1&dtd=1297

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 widget.a0ee525be0aa0e318bac.js Show response
c.bannerflow.net/scripts/ Frame 0ABB 20 KB
7 KB 17ms
16ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.a0ee525be0aa0e318bac.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01dc3974a3547aca42208299f82cef5e6b0dee9977d5c5a50b1753afd03aef5c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 1joVYV0qQYfRzVl/isxzog==
age: 27504738
cf-polished: origSize=20342
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 30 Jun 2022 08:21:42 GMT
server: cloudflare
etag: W/"0x8DA5A71906D5B19"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0b9fb75e-001e-0010-46b9-8c284e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c7956805a187151-YUL

GET
H2 200 feed.441c69936f1e15d1037a.js Show response
c.bannerflow.net/scripts/ Frame 0ABB 5 KB
2 KB 18ms
17ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/feed.441c69936f1e15d1037a.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4542ff719b7f71dda953d35c75a41428bf407c0287f0af83af44372a749e7532

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: HjCD0xuNE9h4q0XgjcZIhQ==
age: 9085826
cf-polished: origSize=5036
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Mon, 27 Jun 2022 09:04:23 GMT
server: cloudflare
etag: W/"0x8DA581C078507CE"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 306ed3c5-701e-009c-14fc-8a4040000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c7956805a197151-YUL

GET
H2 200 document.f70c078e3a.js Show response
c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/published/2180173/2729039/ Frame 0ABB 96 KB
21 KB 20ms
20ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/published/2180173/2729039/document.f70c078e3a.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91b57db7237541b6379ce312c96b7784885ff63ef13e7a15a8abc953e2a8c68a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 9wwHjjodN849iXpVZuIhqQ==
age: 19285923
cf-polished: origSize=101729
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 07 Jul 2022 13:24:47 GMT
server: cloudflare
etag: W/"0x8DA601C1039BF63"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 62d0e280-a01e-00a0-458f-d76987000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c7956805a1a7151-YUL

GET
H2 200 animated-creative.62c08aa132f36f133041.js Show response
c.bannerflow.net/scripts/ Frame 0ABB 144 KB
49 KB 21ms
21ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06e3280dbb4ee5cb074a7eb90d27da1331e9a197b2e69ca5ec18bf855fadfb2b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 8DnEqA1lSGC6aUU7Nn6dcw==
age: 557934
cf-polished: origSize=147411
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 30 Jun 2022 08:21:42 GMT
server: cloudflare
etag: W/"0x8DA5A71904BA524"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 854e92b4-201e-0007-3225-388145000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c7956805a1d7151-YUL

POST
H3 204 csi
csi.gstatic.com/ Frame AD9F 0
17 B 385ms
385ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~lhogvmhc&c=2913416228924394&e=31072019%2C31074536%2C31074542%2C31061691%2C31061693&ctx=1&met.3=783.1r8~735.1r8_1~646.1sd~800.1sd~800.1sd~800.1sd~800.1se~800.1se~774.1si~653.1si_c~801.1su~801.1su~844.1su~844.1su~710.1su~825.1su~355.1su~825.1su~54.1su~598.1su~708.1su~598.1sv~708.1sv~647.1sv~965.1sv~783.1ts~54.1uv~54.1uv~598.1uv~598.1uv~598.1uv~598.1uv~598.1uv~598.1uv~598.1uv~598.1uv~947.1uw~947.1uw~573.1uw~54.1uw~598.1uw~54.1ux~598.1ux~54.1ux~598.1ux~54.1ux~598.1ux~54.1ux~598.1ux~54.1ux~598.1ux~54.1ux~598.1ux~54.1ux~54.1ux~598.1ux~54.1ux~598.1ux~54.1ux~598.1ux~646.1v7~800.1v7~800.1v7~800.1v7~800.1v7~800.1v7~774.1vb~653.1vc_g~801.1vr~801.1vr~844.1vr~844.1vr~710.1vr~825.1vr~355.1vr~825.1vr~54.1vs~598.1vs~708.1vr~598.1vs~708.1vs~647.1vs~965.1vs~783.1xd~598.1xh~947.1xh~947.1xi~947.1xi~573.1xi~54.1xi~598.1xi~54.1xi~598.1xi~54.1xi~598.1xi~54.1xi~598.1xi~54.1xi~598.1xi~54.1xi~598.1xi~649.1xi_2~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~947.1xk~573.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~598.1xk~649.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~54.1xk~598.1xk~947.1xk~11.1xk_1~725.1xl~894.1xm~1132.1xn_5~808.1xt~808.1xt~54.2dl~54.2dl~598.2dl~598.2dl~598.2dl~598.2dl~598.2dl~598.2dl~598.2dl~598.2dl~598.2dl~947.2dq~947.2dq~573.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~598.2dq~54.2dq~54.2dq~598.2dq~54.2dq~598.2dq~646.2f3~800.2f4~800.2f4~800.2f4~800.2f4~800.2f4~774.2f8~653.2f9_i~801.2fr~801.2fr~844.2fr~844.2fr~710.2fr~825.2fr~355.2fr~825.2fr~54.2fr~598.2fr~708.2fr~598.2fs~708.2fs~647.2fs~965.2fs~680.2gf~680.2gf~680.2gf~824.2gf~824.2gf~680.2gg~680.2gg~680.2gg~54.2gh~54.2gh~598.2gh~598.2gh~598.2gh~598.2gh~598.2gh~598.2gh~598.2gh~598.2gh~598.2gh~598.2gh~947.2gj~947.2gj~573.2gj~54.2gj~598.2gj~54.2gj~598.2gj~54.2gj~598.2gj~54.2gj~598.2gj~54.2gj~598.2gj~54.2gj~598.2gk~54.2gk~598.2gk~54.2gk~598.2gk~54.2gk~598.2gk~54.2gk~54.2gk~598.2gk~680.2jo~680.2jo~680.2jo~680.2jp~680.2jp~680.2jp~54.2kf~715.2kf~54.2ts~54.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~598.2ts~947.2tw~947.2tw~573.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2tw~54.2tw~598.2u7~947.2u8~947.2u8~947.2u8~573.2u8~54.2u8~598.2u8~54.2u8~598.2u8~54.2u8~598.2u8~54.2u8~598.2u8~54.2u8~598.2u8~54.2u8~598.2u8~54.2u8~598.2u8~649.2u8~54.2u8~598.2u8~54.2u8~598.2u8~54.2u8~598.2u8~947.2u8~573.2u8~54.2u8~598.2u8~54.2u8~598.2u9~54.2u9~598.2u9~54.2u9~598.2u9~54.2u9~598.2u9~54.2u9~598.2u9~54.2u9~598.2u9~598.2u9~649.2u9~54.2u9~598.2u9~54.2u9~598.2u9~54.2u9~598.2u9~947.2u9~11.2u9_1~725.2ub~894.2uc~1132.2ug_5~808.2um~808.2um~54.2us~715.2us~680.2uy~680.2uy~680.2uy~680.2uy~680.2uy~680.2uy~783.2w0~680.2yu~680.2yu~680.2yu~680.2yu~680.2yu~680.2yu~54.2z1~715.2z1~598.2zw~947.2zw~947.2zx~947.2zx~573.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~649.2zx~54.2zx~598.2zx~54.2zx~598.2zx~947.2zx~573.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zx~598.2zx~54.2zy~598.2zy~598.2zy~649.2zy~54.2zy~598.2zy~54.2zy~598.2zy~947.2zy~11.2zy_1~725.2zz~894.300~1132.303_6~808.30a~808.30a~680.319~680.319~680.319~680.319~680.319~680.319~54.31f~715.31f~54.32d~715.32d~680.32f~680.32f~680.32f~680.32f~680.32f~680.32f~680.34p~824.34p~824.34q~680.34q~680.34q~680.34q~680.34q~680.34q~598.38c~947.38c~947.38c~947.38c~573.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~54.38c~598.38c~649.38c~54.38c~598.38c~947.38d~573.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~54.38d~598.38d~598.38d~649.38d~54.38d~598.38d~947.38d~11.38d_1~725.38e~894.38g~1132.38i_8~808.38r~808.38r~680.3ce~680.3ce~680.3ce~680.3ce~680.3ce~824.3ce~824.3ce~680.3ce~646.3fj~800.3fk~800.3fk~800.3fk~800.3fk~800.3fk&met.10=1_145.IOMREAAIABiAmHUoAA~1_134.IL8SEKinAgj4yQQYgJh1KAE~1_145.ILETEKinAgj4yQQYgJh1KAE~1_6.IMkTEAAIABgAKAA~1_156.IJQVEAAIABiAmHUoAA~1_7.IOMcEAAIABgAKAA~1_156.IOoYEKinAgj4yQQYgJh1KAE~1_8.ILAeEAAIABgAKAA~1_167.IL8dEAAIABiAmHUoAA~1_178.ILQfEAAIABiAmHUoAA~1_9.IN8gEAAIABgAKAA&met.7=CBsQARgBIIMOKIMOMIEROP4CwAGkoPylBw~CA8QDRgBIM8PKM8PMLoROOsBaNAPcLkReKlZgAH9VogBzsoBsAEBuAEDwAG_3prrBg~CBsQDSCGETh_wAHbu8__Cw~CBsQDSCHETiMAcABwpKj2gI~CBsQDSCJEThowAHbu8__Cw~CBsQDSCKETiAAcABvZvplQc~CBsQDSCLETh-wAHa4YadAQ~CA8QDRgBILARKLARMIISOFJosRFwgRJ4p1qAAftXiAHFzAGwAQG4AQPAAb_emusG~CCAQBBgBIMwQKMwQMIARODVo2hBw_xB41gKAASqIASqwAQG4AQPAAeuIwvYM~CBsQDSCHETi-AcAB5IOfqA0~CBsQDSCIETivAcAB6fz9qQw~CBsQDSCKEThAwAH7oYnCDw~CBsQDSCMETg6wAGs8MCpAQ~CC8QBxgBIKURKKURMM4ROClophFwzRF4kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIKYRKKYRMMoROCRoqBFwyRF4kAOAAWSIAWuwAQG4AQPAAZv_iccH~CBsQARgBILgRKLgRMKwUOPUCwAGkoPylBw~CBsQDSDqEjiTAcAB27vP_ws~CBsQDSDuEjjTAcAB5IOfqA0~CA8QDRgBINETKNETMKMUOFNo0RNwohR4q1qAAf9XiAHNzAGwAQG4AQPAAb_emusG~CBsQDSDrEjhTwAHCkqPaAg~CBsQDSDrEjiAAcAB6fz9qQw~CBsQDSDsEjgywAGs8MCpAQ~CBsQDSDtEjhVwAHbu8__Cw~CBsQDSDuEjhYwAHa4YadAQ~CBsQDSDvEjhiwAG9m-mVBw~CBsQDSDvEjg6wAH7oYnCDw~CBsQDSCQGDg6wAH7oYnCDw~CBsQDSCRGDioAcAB5IOfqA0~CBsQDSCSGDhiwAHbu8__Cw~CBsQDSCTGDhSwAHa4YadAQ~CBsQDSCUGDh4wAHbu8__Cw~CBsQDSCVGDgqwAGs8MCpAQ~CBsQDSCWGDiBAcAB6fz9qQw~CBsQDSCWGDhVwAHCkqPaAg~CBsQDSCXGDioAsABvZvplQc~CBsQDSD2GDjjAcAB5IOfqA0~CBsQDSD3GDhUwAHa4YadAQ~CBsQDSD3GDhkwAG9m-mVBw~CBsQDSD4GDidAcAB27vP_ws~CBsQDSD6GDgxwAGs8MCpAQ~CBsQDSD6GDiDAcAB6fz9qQw~CBsQDSD7GDhDwAH7oYnCDw~CBsQDSD8GDhXwAHCkqPaAg~CBsQDSD9GDhrwAHbu8__Cw~CBsQBiDjHDgawAHZgty5Cg~CBsQBiDjHDg2wAGrgvSJDw~CBsQBiCvHjgawAHZgty5Cg&met.9=4_134.1sd~5_134.1sf~6_134.1si~4_145.1v7~5_145.1v9~6_145.1vb~9.0~3_156.1xt~7_156.0~4_156.2f3~5_156.2f5~6_156.2f8~9.0~3_167.2ul~7_167.0~9.0~3_178.309~7_178.0~9.0~3_189.38q~7_189.0~4_167.3fj&qqid.4=CJa189PZ9v4CFZL24QodjB8Lsw&qqid.5=COGbgdTZ9v4CFQfZ4QodZJMMMA&qqid.6=CMfwktTZ9v4CFUnm4QodekUF9w&qqid.7=CNnl2tTZ9v4CFcbZ4Qod_-0Jhw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:25 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A250 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssbDxwGKH0Z1Mzg4R2UUI1yGJ_doKI76BbvYkkB419ehSuLtWcIL0Pcu_I_6sResTC4jvitlh-1FlL5n5ioG7YknQBfSULmoUyqPapaFhne00ynLtmITmZIqLSGiXHOQ6PT6QIgLlBlvb74lI7rAI48nyN18s43G9FBrziqMFjGeymkdERzkmeWctutYXkE0nfpmnPMdrcTzWmlwxppf0lvaScHu86FQFWqBVg2nRRs03b3rBOi7PHktpl0viiVEus759Oobaec0hpuaRAh7yyflWGKbROHqoN8DnKlhmNxUqWdMDY9V_QoNTUJGVyGesOFykltB62d6A&sai=AMfl-YQmib43O7hZnI_dBmSnel4hpS7G-INHPqf1032Y4KcP_hdAO_JM8ZR8mRWc-sPt9b55AJ286DT_pc64DEGFna0T3TnQjpz-aBjd5E9isbK61FcXQmdA9JUKzzd4nLs&sig=Cg0ArKJSzHo2uDSOGv9ZEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame A250 91 KB
32 KB 45ms
44ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A250 169 KB
52 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:25 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame EF30 0
955 B 18ms
17ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QLeDfBM3gYAAAMA1gAFAQi1o4ejBhCSv6Dtjsih00MYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVEREPQqAUR3UHcuLtgCAOAC4ZE86gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBf-OA_oFBAgAEACQBgCYBgCiBg43NjIwI05ZTTI6NjQ3NLgGAMEGAAAAAAAA8D_QBqkl2gYWChAAAAAAAAAAAAAACQpgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsbyF_2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW4xjQRBQSGdAGc1nQxBQUFJjVIsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0JCbUENEABtwzaBwYICcDw1AcA6gcCCADwB5GACIoIvAEKtwEAAAGIHhsrCEOmhkDtqB-Suw2C-Kwsl39ECyJ5JwKh9GydjUAJUqSxBjxlBMNVUO0p82WM3C9Vkyv_b4YURn-Tr8wGDrhf3T8CnS7yBAoomp62IayL5WcVeacc4uT6D2onJWsHhrlscKOtl06vrCt1Ox9Zo3Mzm2nhTYSdvokDeBwOy1wvHjOo_SeM3ARDIl6eRp8qaJBjRsKj45iLn1PMw3NgR7XqcXRjjyE_k3HjDlY9EqNumxoQAZUIAACAP5gIAQ..&s=70dd5d417e7ddee2fa9d4377d495b6bf5bfc2313&type=pv&jm=1003&px=1440&py=302&bw=160&bh=600&sf=1&sid=8087001251715739968&vd=ct~0|rr~6&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27267942&cid=3&cr=pv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: 79466399-0404-49e0-bece-77881edecf0c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 audio_025.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 34ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_025.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b88797da6c4d03c126f45defcd43f73fd5af3a5cbb1e03cee68ff2bd12ae1b1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1123
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xn%2FLkoPacf%2FdDA5KKO1I3Tp80gG5OIm3%2FuVlcF%2FdmwIhJuXsIGPOz0GPOS6%2BGBMGGYpjxuX61Wl8wO2SQk1dHGuCoivwIZDdgon5sk9KUg8czqOKC8aqAheLoi8zZ6dapO9Il7uvTipTpyfXNoxUBZsQ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79568089805437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40713

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EF30 42 B
64 B 37ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstVqGonO91UZTJLT0P7VVDlCHGRQdJaWA38tRD07hkYeGfxiPS4-qrLHJFJQHgGhYH4xbXalfiizDzTE7Y3oTwPyEc4LQ3OLpxGBJdOjRRyswhchlMA&sig=Cg0ArKJSzJ8jEU-raFGOEAE&id=lidar2&mcvt=1295&p=302,1440,906,1600&mtos=0,1295,1295,1295,1295&tos=0,1295,0,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=19&adk=798944132&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132282663&rpt=1514&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 load3.js Show response
ssl.connextra.com/services/ActiveAd/ Frame 1FF6 3 KB
873 B 21ms
19ms Script
application/x-javascript 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.connextra.com/services/ActiveAd/load3.js
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: efa868a96d117a28e0d2d0e338e2b248179d0247cd5e4bfa73363d8001e03a82

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
last-modified: Wed, 16 Nov 2016 14:10:53 GMT
server: AkamaiNetStorage
etag: "743a5e7701b844723629ba8123740a92:1479305453"
vary: Accept-Encoding
content-type: application/x-javascript
accept-ranges: bytes
content-length: 687

GET
H3 200 css
fonts.googleapis.com/ Frame 1FF6 2 KB
559 B 47ms
47ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:900

Requested by

Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

84a947089c5f55ed502c6d680ff58c1bbca5a267f83255a07fce396190380935

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 06:31:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 1FF6 139 KB
48 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c12::95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::95 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ec5fd82b2b5642bcd2bb6f6db113306135239c684e8b41ee971aaeeb436d84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:21:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 621
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48652
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 15 May 2023 06:36:04 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame F61E 52 KB
17 KB 11ms
11ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 547
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:25 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 56, 836
X-Served-By: cache-lga13626-LGA, cache-yul12826-YUL
X-Timer: S1684132286.550122,VS0,VE0

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame F744 0
933 B 38ms
36ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: 5219beb2-b9c5-4849-9464-6e823950913c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 896F 1 B
271 B 50ms
49ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=e5dee7f10e44a019efb39927&pm_pl=1684132284489&pm_td=1113&pid=1000791&en=1.1&callback=__pm_glbl_cZYhO3K9c149mwORnLbbRUIU._gc2&tt=g&v=e3c1265
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:25 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 25 KB
11 KB 220ms
220ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=2546020910405550&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250j_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=10&adks=2671887349&sfv=1-0-40&prev_scp=hb_format_oftmedia%3Dbanner%26hb_size_oftmedia%3D300x250%26hb_pb_oftmedia%3D0.00%26hb_adid_oftmedia%3D21159f90c84051c3%26hb_bidder_oftmedia%3Doftmedia%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_adid%3D21159f90c84051c3%26hb_bidder%3Doftmedia&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132285666&lmt=1684132285&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=qksqk0yb35s4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x0&fws=384&ohw=0&ea=0&psts=ABHeCvj-jU1ID3gUcjxDRYf-mDBzU772VsqgxnqsC8DN38GgztCP5SY1-bBkg42RMNHxdzrs0W9cSrfp0hocU2mmoLYtkUxJ%2CABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0%2CABHeCvhbNkjF3LrpFe-1wYs2ZaV8cktmPxfZRoe1aLV2GL3csnJ7Ora7co1wQ7kJ3r41n06jCxvAnMM3oohhUnrQ961wLK0d%2CABHeCvhS0pJYIgbubKkj3-a_Cp-VEfAkkOL1Z2DZBJ53L_6ydz4tTnkNI72GHfBuQu9Ih4cO6cy3ZZb-wuhoGDHNim5Sh6uUjKhH-F8%2CABHeCvisP77ipA7kXsDpaR8U3StI_MWtCArY0tV7tp74qcY_Xz5scK-Q821i4X621ohLnZs-1rlYzRobuceRpzaoHCbK_qKQTd_nSks%2CABHeCviPh82bWNYfdJhtl8mytIEyAI7bI80ui9yHxwRexPlsnnNKXmEC0b5zLXXVmguKJ_rI8GbNlfYovWUJEFKWnbhoF94S&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae430113428cacc73d81c9aa7d93a21d1d481297c307424c0343c50ebd683eaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11138
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760797
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 896F 42 B
64 B 37ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssEji-zC7GA0puKVxiyBRKn2D_r12lrk4obZBg0YeFmZQBLBG0Wfm3gIVxxLS3zXXIzpKvD-9LHgQWXLmgcsknzIb9OhCiVtDm1XZX-gWCVRaVOhmAm&sig=Cg0ArKJSzAq8x06psRkNEAE&id=lidar2&mcvt=1359&p=302,0,906,160&mtos=0,1359,1359,1359,1359&tos=0,1359,0,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=19&adk=2650088509&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132282746&rpt=1567&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 2B2B 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3153&pub_id=1424069&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: f4e10cf3-26bd-4828-b9b4-f4f5a6b88de1
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9D7E 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstDeGCEy9xVLeOXUlq0wFiFL7xWNtxQw4_3qskR5T7wgYE5Yest97tQYym0cEbC70H5-geekaq8Gy2zCmHdLSPtrhzZnWoN0p2Tm9NajE1_bsVG-dXw7xP0yNMs7zHbXwsNlxUpdR_i4loPlPmWJh43dSnKacx0fNMJJqiSBaB7NUXHGn05YNYiGdRkLi8JtgiNwWRQeqMTm-WKNZPZmtUz8sqHazt17UqrLsrwDg365AXUjBHKZ974cciAvqWJw_4PHZhlNfmQYj2af1M4oOWE2F-_76XkDR-aiSKZZ6WMtS6ktA9bjGxz0iaf-pfC6NqvWKK5dcszTezoUJA&sai=AMfl-YSk97uTn_eNX6_62Bzv-G5bEdYS-HzSKV6C9gPTKlEoKuIo5nZqlM-yJDWx_VwCqNUbDdQWB45mFDHWxHJ2gDS5sX1iTw8KBaRs_9mH2LwQZeASxcWs0mWJrwQfbFA&sig=Cg0ArKJSzJvq2Wl2OokXEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:25 GMT

GET
DATA 200
OK truncated
/ Frame 9D7E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f8145577bcfa2838b942981c4d29398f8a489582ad42f57eaedd895dbb46f80

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame FD12 0
955 B 18ms
18ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QKfDfBVnwYAAAMA1gAFAQi6o4ejBhD2ipzejfHz120YyLrI8MzCwaEnKjYJ8tngRJXSuj8RMY10rbgkpj8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eP3FA4ABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICpQQhbzJ6VXBBaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPATG9EQ1U1WlRUSTZOVFl5TS1BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBSEJCQQE1CQEIeVFRCQkBARhOZ0VBUEVFAQsJAWBDSUJmY3JrQVdqXzFPWUJmeTkySWNCcVFVCR8YQUR3UDdFRgENIFFFcEYyel9CQgFPHEdoT0MtRV95BSgcQkFXUkRaUDkJKAkBBERaBSgBAfBDUEFfNEFXWFV2QUZncG1FQ3ZnRnlxSzdBb0lHQTFWVFJJZ0dCSkFHQVpnR0FLRUcyX2wtYXJ4MDd6LW9CZ1N5QmlRSkEBSAkBAFIJBwUBAFoFBgkBAGgJBwEBREM0QmdvLpoCmQEha3hhUW9naTYpAihQeW5heUFBS0FBeBltBDg2MmEBFDBER1AwawFOAEElBQAxPTQARhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERDwtkR3UHcuLtgC50PgAsPLWeoCGGh0dHBzOi8vc3dpZnRtb3Zlcy5ibG9nL4ADAIgDAZADjL9BmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEggEEAQYrAIg-gEoASgCMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo1NjIz2gQCCAHgBAHwBIUoIIgFAZgFAKAF_xEBGAHABQDJBQAFARTwP9IFCQkFC3wAAADYBQHgBQHwBce7MvoFBAgAEACKBoABaGhQU0sxbyE52ERBQWtDQlFFSW0tdmZCaENkbnNFQ0dNNjYwQUlnQmlnQVFPdWwwZ1ZJZ0tqU0JWREdQMWlQSjMxRwRBQSFXAGc1VwRBQQE3AEFh1CxKb0JBZ2dBcUFFQXMuIABEQS4ukAYAmAYAogYOMzE1MyNOBeccMDA3uAYAwQYBtjAAAPA_0AapJdoGFgoQCREZASgQABgA4AYB6gYodZHtFDI2MzEzM4WYARQAaaEBFDUxMjUyNgUUQPIGhwEIo_9TEoABSlJTRVQxNvoAQDk2UzlDQkNEX2JBQ0dLWGx0AcNAeWdBUU55UThRUkk5dkNtQ0b--gAJ-nCABwGIBwCgBwG6BwgqBDEtLS1AAcgH_cUD0gcNCQnkBERAAeII2gcGIa5wGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=09420e39a0724f436ea311e2ced0db30eb98378c&type=pv&jm=1003&px=1070&py=1074&bw=300&bh=250&sf=0.5&sid=8087001251715739968&vd=ct~0|rr~5&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27300707&cid=3&cr=nv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:25 GMT
AN-X-Request-Uuid: bc0a419c-421a-455f-a972-26e3166d6285
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 13FE 0
10 B 35ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?9UmLcw
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4D4D 0
0 41ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst2qJKxTCmnJWoqRjRpG__X8pZcx3wE_NIxyw0emr1XXf8gEtH9YXzI9wGdURPky_bY9JiHMf_owog07afSFJ8HOK5XrJPBzqVkvmilMMcEIer72P6xfTDS1gxyK6OVHnz5c8eR_i8VAUDGXKIvqMyy13BNJWYYTeqyj8Bqdy--s7eZWLzoyB2X_WMDGe2tRnLA-4c7_cKcXHY8YCHVP9bUrgarYMpGVHWJmHTdkGIV7RZH_li4Vy8a-ADwr2zKRMUAsCyOgy3YUVuMDIjUbK7n_dlKPxTN7H4IBWoKdyuszBD0Py8aGq0_Na--i-BbwREDSVgl05dSFQ&sai=AMfl-YSptbSGvU4a6oa1xap1mW7bDeqtnjnf8n_VW0Rd5e2QLo8W5J685DBnjcIb5-DagZblVGjLOxnSL6gZH-NmBUhNHf3cCSkAvTSRPneQdLcxjElj1vmwsBYsKzryzck&sig=Cg0ArKJSzJb275eMhfZmEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 4D4D 91 KB
32 KB 45ms
44ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4D4D 169 KB
52 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3C5C 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssn2r8ggf_1zfNLOKc8pYFgHuSIyS-ZDFGgFecG54vaC-Aef5ufzrgEVLnq6sBVAJrJucgKz0Ke-umq117ISAdIoDG1kmq60IN0CwNGTGPY0IGKHmbMmO7sXFuLskoMA7ItiWnWUqpJsJfcrgrhQGYDqMJT42RK1KCwwZXtOyvZFjbEtXEjoiNcXcH0kOoCPwZaHVWCbWFQmGPjVrXkSB6d7f10-LnH_zwcpU02i6MDjiDoCWOlKvvQFmxuD-EHShbte8B-Yaztolcca9aLtx0HwARwqfxkIfoqQQqpu5V-tT5t-qGsQfSYAccwKtzoEED1gpu2ttk8WQ&sai=AMfl-YQRT32NP4KTckeYIEFNYo2GmDY1GhI8jGg4m4ObF6tu6N8tA1DkgNFqlsr3Oc_Gvt9CSYX8btZhaKAlQpPdYLvkoR1tGx0x9jPyeTDLdftZXlgzkXK5uqJo85iWlEw&sig=Cg0ArKJSzLan4RoyHfJIEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 3C5C 91 KB
32 KB 45ms
44ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3C5C 169 KB
52 KB 37ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:25 GMT

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 4C1A 3 KB
2 KB 91ms
25ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 674
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7c7956828ade3fcd-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 10:31:25 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame F1C1 3 KB
1 KB 98ms
34ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 674
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7c7956829adf3fcd-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 10:31:25 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame BD81 3 KB
1 KB 89ms
28ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 674
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7c7956829ae13fcd-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 10:31:25 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 6629 33 KB
11 KB 175ms
172ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

06dcfbc540263f7b1dc80a10146b082085c9f68aaf73f729fcd40c9844705ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11199
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Wed, 17 May 2023 06:31:25 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1

200
OK

beacon Show response
ce.lijit.com/ Frame B13E
Redirect Chain

https://ap.lijit.com/beacon?us_privacy=1---&informer=13401719
https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

664 B
2 KB

87ms
40ms

Document
text/html

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 05654f6e95b8bd3338874b7a82b2e828c7e89eb2370b111de2567847f7fcbb4a

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 320
content-type: text/html
date: Mon, 15 May 2023 06:31:25 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 15

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 87EB 33 KB
11 KB 176ms
175ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

06dcfbc540263f7b1dc80a10146b082085c9f68aaf73f729fcd40c9844705ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11199
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Wed, 17 May 2023 06:31:25 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1

200
OK

beacon Show response
ce.lijit.com/ Frame 0220
Redirect Chain

https://ap.lijit.com/beacon?us_privacy=1---&informer=13401719
https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

664 B
2 KB

88ms
41ms

Document
text/html

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 49dd6d7326af6f98d8e15ec952dcda596b91a495324011eec9f1095178373a0c

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 321
content-type: text/html
date: Mon, 15 May 2023 06:31:25 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 16

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

GET
H/1.1

200
OK

beacon Show response
ce.lijit.com/ Frame C009
Redirect Chain

https://ap.lijit.com/beacon?us_privacy=1---&informer=13401719
https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

664 B
2 KB

83ms
40ms

Document
text/html

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 49dd6d7326af6f98d8e15ec952dcda596b91a495324011eec9f1095178373a0c

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 321
content-type: text/html
date: Mon, 15 May 2023 06:31:25 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 15

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

GET
H/1.1

200
OK

beacon Show response
ce.lijit.com/ Frame 794B
Redirect Chain

https://ap.lijit.com/beacon?us_privacy=1---&informer=13401719
https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

664 B
2 KB

74ms
41ms

Document
text/html

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 49dd6d7326af6f98d8e15ec952dcda596b91a495324011eec9f1095178373a0c

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 321
content-type: text/html
date: Mon, 15 May 2023 06:31:25 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 15

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

GET
H2 200 isyn Show response
prebid.a-mo.net/ Frame EDD7 672 B
453 B 28ms
23ms Document
text/html 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 4ffce84bc6b4fd32bd99e4aa3edfd4601e49092e8fe531057e32073cd1f64217

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 367
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:25 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 1429 3 KB
1 KB 71ms
26ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 674
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7c7956829ae23fcd-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 10:31:25 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

beacon Show response
ce.lijit.com/ Frame 8DB5
Redirect Chain

https://ap.lijit.com/beacon?us_privacy=1---&informer=13401719
https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

664 B
2 KB

96ms
51ms

Document
text/html

3.211.190.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.190.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-190-157.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 34d0799e3053ff38f2f82a4b5e70c598f097b6c6686ba895689f31fa4a322f6e

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-encoding: gzip
content-length: 324
content-type: text/html
date: Mon, 15 May 2023 06:31:25 GMT
expires: Fri, 20 Mar 2009 00:00:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: envoy
vary: Accept-Encoding, User-Agent
x-envoy-upstream-service-time: 25

Redirect headers

Content-length: 0
Location: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame CD40 281 B
554 B 74ms
26ms Document
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 May 2023 06:31:25 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 00A1 33 KB
11 KB 107ms
106ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

06dcfbc540263f7b1dc80a10146b082085c9f68aaf73f729fcd40c9844705ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11199
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Wed, 17 May 2023 06:31:25 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame BF47 33 KB
11 KB 108ms
107ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

06dcfbc540263f7b1dc80a10146b082085c9f68aaf73f729fcd40c9844705ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11199
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Wed, 17 May 2023 06:31:25 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame D748 3 KB
1 KB 65ms
27ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 674
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7c7956829ae33fcd-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Mon, 15 May 2023 10:31:25 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame BAC7 33 KB
11 KB 160ms
158ms Document
text/html 104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

06dcfbc540263f7b1dc80a10146b082085c9f68aaf73f729fcd40c9844705ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11199
content-type: text/html; charset=UTF-8
date: Mon, 15 May 2023 06:31:25 GMT
expires: Wed, 17 May 2023 06:31:25 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/ Frame AD9F
Redirect Chain

https://p.rfihub.com/cm?pub=35683&in=1
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2810035086818332396

49 B
934 B

66ms
22ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2810035086818332396

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2810035086818332396
Date: Mon, 15 May 2023 06:31:25 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/ Frame AD9F
Redirect Chain

https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=277a2357-1e32-4313-9dd0-85518179de6d&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25
https://sync.go.sonobi.com/us.gif?nw=pp&nuid=UMxte5rHSSDS

49 B
927 B

67ms
22ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=pp&nuid=UMxte5rHSSDS

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://sync.go.sonobi.com/us.gif?nw=pp&nuid=UMxte5rHSSDS
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-b9f9f4b7f-hkthr
expires: -1

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/ Frame AD9F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=8b725e5cd3&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=td&nuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&pubid=8b725e5cd3

49 B
951 B

68ms
23ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=td&nuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&pubid=8b725e5cd3

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:25 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.go.sonobi.com/us.gif?nw=td&nuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&pubid=8b725e5cd3
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 227

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/ Frame AD9F
Redirect Chain

https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=102b6461-d1b1-4f00-b06c-5186e28fb05c

49 B
951 B

69ms
22ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=102b6461-d1b1-4f00-b06c-5186e28fb05c

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: image/gif
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:25 GMT
Server: MT3 851 9bd98ae master ord-pixel-x51 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=102b6461-d1b1-4f00-b06c-5186e28fb05c
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 15 May 2023 06:31:24 GMT

GET
H3 200 receive
pixel.tapad.com/idsync/ex/ Frame AD9F 95 B
123 B 48ms
42ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3061&partner_device_id=277a2357-1e32-4313-9dd0-85518179de6d

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:25 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

GET
H2 200 Standard Show response
s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/.gSBgiDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/ Frame F744 91 KB
39 KB 34ms
34ms Script
text/javascript 185.167.164.46
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/stoat/626/s2.adform.net/load/v/0.0.225/e/.gSBgiDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.167.164.46 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 0506588d6503367f42582fd66839c5687cee6a53dc6236091848ac63ff8f01af

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 08:06:48 GMT
server: nginx
x-cache-status: EXPIRED, EXPIRED, STALE
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Thu, 08 Dec 2022 18:33:24 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame 9D7E 0
955 B 20ms
20ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QK3F_BVtwsAAAMA1gAFAQi7o4ejBhD4heHE4KbXgnkYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eN38BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hWW9XNXNRaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOakU1TmVBRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBV3pNSkFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw4dUFZS5oCmQEhbUJidW93OkEHWFB5bmF5QUFLQUF4Ml9sLWFyeDA3ejg2MnkGFFVER1Awaw1nDER3UDE9RABGERgMQUFBRx0YAEcdGABIHRgMSGdBaS5VB_Dedy4u2ALnQ-ACw8tZ6gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAPpvUGYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQSCAQQBBisAiD6ASgBKAIwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjYxOTXaBAIIAeAEAfAE6bOPzgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAUOcNgFAeAFAfAFx7sy-gUECAAQAIoGgAFTQlRyVzFvITnYREFBa0NCUUVJN2VuZkJoQ2Ruc0VDR002NjBBSWdCaWdBUU91bDBnVkkwcWJTQlZER1AxaW9NSDZXAQBnNVcEQUEBNwBBDuwILEpvQkFnZ0FxQUVBcy4gADxBLi6QBgCYBgCiBg4zMTUzEecYODS4BgDBBgW3LADwP9AGqSXaBhYKEAkRGQEoEAAYAOAGAeoGKHUeBQoUMjYzMTMzErAJARQAaQ4ZChQ1MTI1MjYFFEDyBocBCKP_UxKAAVJ4UzVWVjb6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB938BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=01b70a54c8cfcb89d122c793af52a4328b383abf&type=nv&nvt=5&jm=1003&px=1070&py=1074&bw=300&bh=250&sid=8087001251715739968&vd=ct~0|rr~0&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27300707&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=10796&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: 6aa815cb-ffa9-4861-924e-7ed27d659073
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame EDD7 9 KB
4 KB 66ms
17ms Script
text/javascript 2606:4700::6813:9f13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: prebid.a-mo.net
URL: https://prebid.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6813:9f13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1d0e50c440571cffce4c7aea610d6cbee0f2a15f1058aef12b225e3e246e404

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
via: 1.1 4ec5f8da969dc981ba2067c9dad5dad8.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: YTO50-P2
age: 247
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Mon, 27 Mar 2023 18:10:34 GMT
server: cloudflare
etag: W/"60125fcf1fcf576eebb45554f83ada73"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 7c795685de377151-YUL
x-amz-cf-id: 2qyi4zw5tEB2gQIee_oIHNtWI5syVraYb3vQ_KU4N3ZtN7JGM7QJog==
expires: Mon, 15 May 2023 07:31:26 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A31A 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunwM-NDYliJ2c1c1-vz9-8vWJvZYCoJ-Q0xy7bfuEiVBrS2xUO8KINS8CAIxc84uaJYCvoLggBk04JdUU0xX7joseRIXToUZQ6D5P3p4U3oYamnxEU&sig=Cg0ArKJSzGZvK08x1qoHEAE&id=lidar2&mcvt=1507&p=1074,1070,1324,1370&mtos=0,0,1507,1507,1507&tos=0,0,1507,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1517229526&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132282798&rpt=1926&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame CD40 34 KB
10 KB 23ms
23ms Script
text/html 23.192.7.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.7.104 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-7-104.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 72f6dba4450382b8579a6fe007825673805fbd8009fd37004a446b36b2c63ca1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 May 2023 01:05:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=66779
Connection: keep-alive
Content-Length: 10021
Expires: Tue, 16 May 2023 01:04:25 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame AADA 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudNjc1VG7b2dHXX1FzhqL5qY2GuG6L0Of_YuTazIBUciGGBLwqTJvSoXtkdlxPHCR5LblhyLnBrFyrU93DeLq6V7fLwMo30fx75jNUujtKYaHRRSNJ06Pdmw00VFyLhfeNyfiuAHkdcPmDVBShOwnQ-ZmJzhj7t0q0ppwUYqFva39w83mLmSgR1-7ueSb6lMO9ZVF0KTkC8-kLYwE-EhenxGf-VRecsiFqiaC3hbKByx2SrH09GK8K5bfvwnR5UpE4jyF3xOzohqtTDE26CXK35vlTTH6VUGGuuvlOXHRH-VlYT2kYUOfvA2p3YqASsE6YaDOCKMo5jQ&sai=AMfl-YT2KIJ9GENuJKqFw5j-gAgDrwOK--xAmP1zBMQRxfsbnpCEm3IQmpJJCibMUAqTXpS5sNJGuGX9KrBCac2QqK0paD3okplKgLRnsod8c7f3AzN-4swc0lSe6fzN3y8&sig=Cg0ArKJSzOY_P-NAFJJWEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame AADA 91 KB
32 KB 45ms
44ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AADA 169 KB
52 KB 36ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:26 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B13E
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

41ms
38ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame B13E
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

0
0

40ms
39ms

Image
text/html

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: H3
Server: 74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),
Reverse DNS: vj-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame B13E 0
0 83ms
33ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame 0220 0
0 80ms
33ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame 0220
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

0
0

39ms
38ms

Image
text/html

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: H3
Server: 74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),
Reverse DNS: vj-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0220
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

51ms
50ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame C009 0
0 76ms
29ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame C009
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

0
0

38ms
38ms

Image
text/html

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: H3
Server: 74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),
Reverse DNS: vj-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C009
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

51ms
50ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame 794B 0
0 78ms
30ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame 794B
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

0
0

40ms
40ms

Image
text/html

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: H3
Server: 74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),
Reverse DNS: vj-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 794B
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

51ms
50ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
BLOB 200
OK c5ae51ba-879f-4392-afd3-a296f0384739
https://swiftmoves.blog/ Frame EF30 288 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/c5ae51ba-879f-4392-afd3-a296f0384739
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97bf326860f50a3e48b937a395da44fb697f230259b45d63cca9dcd24fddb243

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 288
Content-Type: text/javascript

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 26ms
25ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:26 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: 76291c58-5c12-1fdd-ffa3-c18d4bde717f

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F61E 0
861 B 53ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7620&pub_id=964152&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: 1d91d5ed-93df-4aee-b5f6-7df5d15ae18f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame F744 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e0b829f3e26cc7e57b69eb2ee9fa6ce600a9ed2f2599df0e0c7fba12a8050b1e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame A250 356 KB
120 KB 59ms
59ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:26 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8DB5
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

170 B
188 B

39ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

Requested by

Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1 200
OK ae12848777b41970a5f2
s.amazon-adsystem.com/x/ Frame 8DB5 0
0 83ms
35ms Image
text/html 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame 8DB5
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0

0
0

41ms
39ms

Image
text/html

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Requested by: Host: ce.lijit.com
URL: https://ce.lijit.com/beacon?us_privacy=1---&informer=13401719
Protocol: H3
Server: 74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),
Reverse DNS: vj-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ce.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Redirect headers

Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3BmSEFQWkhTeXZrWW83R1JjcXZtS3hN&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame 896F 0
955 B 18ms
17ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QLeDfBM3gYAAAMA1gAFAQi1o4ejBhDIxtvwtPzLxwUYyLrI8MzCwaEnKjYJm5SCbi9pxD8R2ef3HqqAsz8ZAAAAIK7HIEAh2ef3HqqAsz8pmpQJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUPv0lLkBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAaABoAHYBKgBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgMTQzNTQ4NiwgMCk7dWYoJ2knLCA3NjM0NjI2LCAwKQUUAGcBKBg5MDI4NjI1FSkwcycsIDI4MDUxMTUzMBUWMHInLCAzODgzMTU3NzEFFvCLkgLdBCFoNEZVZFFqNmxOOFpFUHYwbExrQkdBQWd5YkZMTUFJNEFFQUFTSmc1VU9hbWdBMVlBR0NnQldnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkNxZ0JDckFCQUxrQnZhRnd1Z2xweERfQkFiMmhjTG9KYWNRX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnQ4RF9nQWNMOTBRUDFBWFJhd0Q2WUFnQ2dBZ0cxQWcBIwRDOQkI2ERBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0SWxfRDlKQkFMR0FJdEEBQ_BVTG9EQ1U1WlRUSTZOalE0TmVBRHhqLUFCSy1sNWdxSUJMYWw1Z3FRQkFHWUJBR3lCQW9JbHFqakRoQ0htTEVOdWdRYUNPMElFYmdlaGV0UnVKNF9HUUEBWgUBKElKYW80dzdCQkxnFSAIeVFRBRwFARhOZ0VBUEVFBQwFAWBDSUJkVXlrQVg0azFDWUJhcUk0WVVCcVFVBR4cQUFEd1A3RUYBDSA0Tm5UNkRfQkIBTxxPRFowOWdfeQUoHERBczg3dVA5CSgJAQREWgUoAQHwQ1BBXzRBWEtmUEFGa2JXSkNmZ0YzczVYZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUWJiLVg1cXZIVHZQNmdHQkxJR0pBa0FBAUgBAQBCHbsEQmsBEgkBAEMdGERMZ0dDZy4umgKZASF4UnJmTmc6YQJYTW14U3lBQUtBQXgyX2wtYXJ4MDd6ODYymQEQVURHUDARYQxEd1AxHWEARhEYPEFBQUdHNEhvWHJVYmllUDIdGABIHTAQSGdBaVEREPQqAUR3UHcuLtgCAOAC4ZE86gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDk8vVAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4M6gEALIEEAgAEAQYoAEg2AQoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQ4NdoEAggB4AQB8AT79JS5AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBf-OA_oFBAgAEACQBgCYBgCiBg43NjIwI05ZTTI6NjQ3NLgGAMEGAAAAAAAA8D_QBqkl2gYWChAAAAAAAAAAAAAACQpgEAAYAOAGAfIGhwEI-JNQEoABVkJSUldsbyF_2ERBQWtDQlFFSV85dUpDQkRka09JQ0dPLUZuUU1nQnlnQVFPUG4xQWRJM0lEWUIxREdQMWpLTW4xjQRBQSGdAGc1nQxBQUFJjVIsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAeKpwXSBw0JCbUENEABtwzaBwYICcDw1AcA6gcCCADwB5GACIoIvAEKtwEAAAGIHhsrCAWPL-NOFuNIRSj7lA3s00YiDhYHrh9_WDUACdVBJpV8rMecT50k8tSE0tKgpF1Bk56jrKvuwOtXjxOJe7dop7EvlpfwLAWn0wt2ZMCC59vY_TUCY_LSJ_YgO7MDckamwByHWkOf-y_10SGPwDFC_1SXJpk_OplXVjgUTg-tExMy7WY2O0vLg0dFtHGI7C5bY8GHyL8SpoX9ZdbvVhANjlc9iYAFMsbbtisk7HAnCs4QAZUIAACAP5gIAQ..&s=9c592c4dbb99682798c65c8cb85d058073863e05&type=pv&jm=1003&px=0&py=302&bw=160&bh=600&sf=1&sid=8087001251715739968&vd=ct~0|rr~6&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27267942&cid=3&cr=pv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: 1c28d0ed-9e8e-4c7d-b9b7-c4ba014b26f2
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
BLOB 200
OK 54bf79b4-009c-441a-a4b8-e957ce82a1f8
https://swiftmoves.blog/ Frame 896F 288 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/54bf79b4-009c-441a-a4b8-e957ce82a1f8
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97bf326860f50a3e48b937a395da44fb697f230259b45d63cca9dcd24fddb243

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 288
Content-Type: text/javascript

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame EF30 1 B
271 B 129ms
51ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=7d95c3724768367a4d071a3d&pm_pl=1684132283893&pm_td=2685&pid=1000791&en=1.1&callback=__pm_glbl_RleYKpIp4C6VUsatiFCm99ot._gc3&tt=g&v=e3c1265
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:26 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 29ms
29ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: 4a6b61d18d58a084ed935866e03f4695cf0da3318395502ac26324f0dfd7648b

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 140ms
138ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

3aea7454691046b277d5b1da650dc5d8031697259851d775ae755f7c05e1c516

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: 0aae5f7d-e7e2-4bcd-8b33-fe724c43a6d0
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 545 B
866 B 143ms
93ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: e6707981aaa77477fbaf593a3cace562e088ca7718cf83ca06572f897b46bd02

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 350

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
410 B 28ms
27ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: 90b7a0a8f756146488ed12e4eac726877549ef819988f2433a2252b0ffac0bfb

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 76ms
75ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 203ms
203ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=166f60c91dd788b1&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22amxdt.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22amx*3*8220b2d1-4aec-4d94-9d18-b2fae200417f*df8d05a053203544d26b49db3b030b93%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22xuRgVV9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmMXo1dmw2SXFWRnBKTVoza0VQMkRJZnIzaVJjbllMYVpEeFpYZTdFU0hhODh0SHdGZVc4NEJiSTlkNUMlMkZjbTdS%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=4.5&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:26 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 88ms
87ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: c243d1ecd06abfa3b39e94c14bd8bc8c9da9d609f5620792642bc35ed50e323c

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 153ms
153ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 88ms
87ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:26 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H3 204 csi
csi.gstatic.com/ Frame A31A 0
17 B 369ms
369ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvony&chm=1&c=2913416228924394&ctx=2&qqid=CMWO09PZ9v4CFVLV4Qod9ZUKXg&met.4=fb.d~lb.7r~ol.1hl~idt.fu~dt.-84&met.3=739.7r~1032.al~738.1hi~749.1hi_3~736.1k8~735.1up_1~740.1xj_1~113.2k2_2~112.2k2_2~734.2q6_2&met.1=1.lhogvm3y~14.0~15.0~16.0~17.0~18.0~19.1~20.1~21.1~22.7z~23.7z&met.7=CCIQBBgBIA4oDjA5OCtoD3A4eKwCsAEBuAED~CAIQChgBIA8oDzBDODVoEnBAeJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIA8oDzA8OC1oEnA3eNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIMEBKMEBMJICOFFowgFwgwJ4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBIIIDKIIDMPsDOHlAiQNIjgNQjgNY1ANgsANo1ANw-gN4-QOAAc0BiAHbAbABAbgBAw~CC8QBxgBIIQDKIQDML0DODhojgNwuwN4kAOAAWSIAWuwAQG4AQM~CC8QBxgBIIUDKIUDMLwDODhojgNwugN4kAOAAWSIAWuwAQG4AQM~CAUQBRgBIIoDKIoDMP8EOPUBaI8DcP4EeNoCgAEuiAHbBLABAbgBAw~CCIQBBgBIIkPKIkPMLEPOCloig9wsQ94rAKwAQG4AQM~CCcQDRgBIIoPKIoPMLkPOC9oig9wtw94gFqAAdRXiAGRdLABAbgBAw~CCgQChgBIIcSKIcSMK4SOCdoiBJwrBJ4hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame A31A 0
17 B 375ms
374ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~lhogvp2b&chm=1&c=2913416228924394&ctx=2&qqid=CMWO09PZ9v4CFVLV4Qod9ZUKXg&met.6=6.1_CgwYowYglwEqBAgIEgAKDBjxByCwAioECAgSAAoPGMULIDIqCAgEEgQQATABCgwYtAwgvwIqBAgIEgAKDxi9FSA1KggIBBIEEAEwAQoPGLgXIDUqCAgEEgQQATABCgwY9BkgkAEqBAgIEgA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E0EE 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuOKcUQzHUfC9R5q8IZZ-8filCmbQ78ytzQPnXSMMIUHXdTm0nOAR6B0t9Oclntu0oEfxK7X0pUn4lhisOEZFJYSPsGoWhrXX8DFsZgCxBcwxwJRH8j&sig=Cg0ArKJSzNQimm4eiAVWEAE&id=lidar2&mcvt=1453&p=1074,1070,1324,1370&mtos=0,0,1453,1453,1453&tos=0,0,1453,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1994560124&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132283471&rpt=1697&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E65B 0
861 B 53ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3153&pub_id=1424069&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3153&pub_id=1424069

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: b1719531-01b8-4b2f-941c-a1424a577875
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame 4D4D 356 KB
120 KB 61ms
61ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:26 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame 3C5C 356 KB
120 KB 77ms
77ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:26 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1041 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssnWkL5ENAAsYvpGeutO-dkVjSzwEd7PFCXhZ1Bq4v5k4rC-dDyqdpsTidMnJmFa8Ab_t52kC-8U0_uO2CMbk_9GMx0s2DZWZuQVPoKKoSup3Pn8C66mjDQPAVu4YIUbJsi2sCTBXNZCwrZ3f-LLJ1efpHQXA0jjB9KiW0QXI9P_EIFPAW0kzOdgXRM3DfC3_6fjCnyO5yOB-gLuFQYHgVFx0xLZj7VzrPzu1gJUruPuAQ5_o3TE_tvw5YWXr1eKCmHR6VjhxlHdbHnrfthhvgC9ldRacRegD57tOHHKEUZ4jMxnawqQQXWmP95GbV05egYm-QPKxj26RpZ&sai=AMfl-YTBga5ol-RBAO3xE38qMgphaLmozdOQPD2ivsAuAzW6CqYab2RAFxKxrOQ4Yd1f1mB_mFWHXQbVlbZnF-tcimSOClk0bVGfUGYcVJHFHUIVaaiuIJh2z2i5g6eOXys&sig=Cg0ArKJSzLsyOn6cOaCJEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:26 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1041 14 KB
11 KB 46ms
45ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a124b20b733d76896d55148e9bc5821e924458ffdd3e84d71707966fd7ba34f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11200
x-xss-protection: 0

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 809C 2 KB
2 KB 61ms
21ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 2edcbe83e0a0e1119ab46bec7a100543195fc0085497b658f1a4b9c6fc7b21e8

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1728
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:26 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 4BF1 2 KB
2 KB 60ms
21ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b8a5fb6880038a9c4319c8710df8dd86adfc0ef28a4665306083d8e358c94ede

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1723
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:26 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 9F63 2 KB
2 KB 59ms
21ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 73b85a23224efc17ab6dc4f034199f28e927f66e793729e3be0a7da308cf3248

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1808
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:26 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 5538 2 KB
2 KB 59ms
21ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: c5751fcb3501744c8f76bfe0c0533671dc0b915678bec57ced074072e2b8219e

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1631
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:26 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame BB23 2 KB
2 KB 64ms
20ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b932d8e532c884c4993f1b7b3af5156633a94a341ce3bed107698c3c57a3d3d7

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1771
Content-Type: text/html
Date: Mon, 15 May 2023 06:31:26 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame E0EE 0
955 B 25ms
21ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QK3F_BVtwsAAAMA1gAFAQi7o4ejBhDrmeuFocPWnlQYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eJ--BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hZG9YVW5RaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOVEE0TU9BRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBWFlKNUFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw0dUFZS5oCmQEha0JhNG8-QQdYUHluYXlBQUtBQXgyX2wtYXJ4MDd6ODYyeQYURURHUDBrDWcMRHdQMT1EAEYRGAxBQUFHHRgARx0YAEgdGAxIZ0FpLlUH8N53Li7YAudD4ALDy1nqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy-AAwCIAwGQA4y_QZgDF6ADAaoDAMADrALIAwDYA5PL1QHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODOoBACyBBIIBBAEGKwCIPoBKAEoAjAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NTA4MNoEAggB4AQB8ATps4_OAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAABQ5w2AUB4AUB8AXHuzL6BQQIABAAigaAATRSTi1QRm8hOdhEQUFrQ0JRRUltLXZmQmhDZG5zRUNHTTY2MEFJZ0JpZ0FRT3VsMGdWSWdLalNCVkRHUDFqaE1INlcBAGc1VwRBQQE3AEEO7AgsSm9CQWdnQXFBRUFzLiAAPEEuLpAGAJgGAKIGDjMxNTMJ5yA2MjQxuAYAwQYFtywA8D_QBqkl2gYWChAJERkBKBAAGADgBgHqBih1HgUKFDI2MzEzMxKwCQEUAGkOGQoUNTEyNTI2BRQ88gaHAQij_1MSgAFnQlF3WTr6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB5--BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=d426a12dcaffa96cc41a632b405cfa959bef7981&type=pv&jm=1003&px=1070&py=1074&bw=300&bh=250&sf=0.5&sid=8087001251715739968&vd=ct~0|rr~5&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27300707&cid=3&cr=nv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: 179ac111-eb6e-4df0-99f3-b73a5f3c9487
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame 7E2F
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3271338731455172000V10%26type%3Drkt%26refUrl%3D%26vid%3D413228676732713387314551720...
https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322867673271338731455172000V10&ovsid=2810035086818332396

235 B
668 B

60ms
58ms

Document
text/html

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322867673271338731455172000V10&ovsid=2810035086818332396

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

7adfac299561b9d5ab03c88e9d582cf76bd31746a4c0564d7d0d428199c943df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 235
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:26 GMT
expires: Mon, 15 May 2023 06:31:26 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Mon, 15 May 2023 06:31:26 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322867673271338731455172000V10&ovsid=2810035086818332396
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

cksync.php
contextual.media.net/ Frame 00A1
Redirect Chain

https://sync.go.sonobi.com/us?https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867673271338731455172000V10&ovsid=[UID]
https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867673271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

61 B
481 B

143ms
142ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867673271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867673271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 00A1
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__https%3A%2F%2Fcontextual.media.net%2Fcksync.php...
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2MJGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJXM5YXKSZRGRHEQQZXI4ZGUZKJNJTGY...
https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=413228676732713387314551...

60 B
307 B

48ms
47ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322867673271338731455172000V10&vsid=3271338731455172000V10

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 60
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:28 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322867673271338731455172000V10&vsid=3271338731455172000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 284
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync
cs.media.net/ Frame 00A1
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490

61 B
467 B

133ms
132ms

Image
image/gif

23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

cksync.php
contextual.media.net/ Frame 00A1
Redirect Chain

https://creativecdn.com/cm-notify?pi=medianet
https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

61 B
472 B

281ms
280ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet
pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT, Mon, 15 May 2023 06:31:26 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame F243
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3271338731455172000V10%26type%3Drkt%26refUrl%3D%26vid%3D413228679432713387314551720...
https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322867943271338731455172000V10&ovsid=2810035086818332396

235 B
668 B

68ms
67ms

Document
text/html

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322867943271338731455172000V10&ovsid=2810035086818332396

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

7adfac299561b9d5ab03c88e9d582cf76bd31746a4c0564d7d0d428199c943df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 235
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:26 GMT
expires: Mon, 15 May 2023 06:31:26 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Mon, 15 May 2023 06:31:26 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322867943271338731455172000V10&ovsid=2810035086818332396
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

cksync
cs.media.net/ Frame BF47
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490

61 B
467 B

104ms
104ms

Image
image/gif

23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

cksync.php
contextual.media.net/ Frame BF47
Redirect Chain

https://creativecdn.com/cm-notify?pi=medianet
https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

61 B
472 B

133ms
132ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet
pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT, Mon, 15 May 2023 06:31:26 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame BF47
Redirect Chain

https://sync.go.sonobi.com/us?https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867943271338731455172000V10&ovsid=[UID]
https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867943271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

61 B
481 B

370ms
369ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867943271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322867943271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame BF47
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__https%3A%2F%2Fcontextual.media.net%2Fcksync.php...
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2MJGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJXM5YXKSZRGRHEQQZXI4ZGUZKJNJTGY...
https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=413228679432713387314551...

60 B
307 B

40ms
39ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322867943271338731455172000V10&vsid=3271338731455172000V10

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 60
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:28 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322867943271338731455172000V10&vsid=3271338731455172000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 284
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame 9B3D
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3271338731455172000V10%26type%3Drkt%26refUrl%3D%26vid%3D413228682832713387314551720...
https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322868283271338731455172000V10&ovsid=2810035086818332396

235 B
668 B

63ms
63ms

Document
text/html

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322868283271338731455172000V10&ovsid=2810035086818332396

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

7adfac299561b9d5ab03c88e9d582cf76bd31746a4c0564d7d0d428199c943df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 235
content-type: text/html;charset=UTF-8
date: Mon, 15 May 2023 06:31:26 GMT
expires: Mon, 15 May 2023 06:31:26 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Mon, 15 May 2023 06:31:26 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3271338731455172000V10&type=rkt&refUrl=&vid=41322868283271338731455172000V10&ovsid=2810035086818332396
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

cksync
cs.media.net/ Frame 6629
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490

61 B
467 B

88ms
87ms

Image
image/gif

23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

cksync.php
contextual.media.net/ Frame 6629
Redirect Chain

https://creativecdn.com/cm-notify?pi=medianet
https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

61 B
472 B

318ms
317ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet
pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT, Mon, 15 May 2023 06:31:26 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 6629
Redirect Chain

https://sync.go.sonobi.com/us?https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322868283271338731455172000V10&ovsid=[UID]
https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322868283271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

61 B
481 B

140ms
140ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322868283271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322868283271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 6629
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__https%3A%2F%2Fcontextual.media.net%2Fcksync.php...
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2MJGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJXM5YXKSZRGRHEQQZXI4ZGUZKJNJTGY...
https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=413228682832713387314551...

60 B
307 B

40ms
39ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322868283271338731455172000V10&vsid=3271338731455172000V10

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 60
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:28 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322868283271338731455172000V10&vsid=3271338731455172000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 284
Expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 896F 1 B
271 B 229ms
151ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=e5dee7f10e44a019efb39927&pm_pl=1684132284489&pm_td=2346&pid=1000791&en=1.1&callback=__pm_glbl_cZYhO3K9c149mwORnLbbRUIU._gc3&tt=g&v=e3c1265
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:27 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame F744 0
955 B 53ms
18ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QKmDfBMpgYAAAMA1gAFAQi1o4ejBhDYsv_XydH3rRQYyLrI8MzCwaEnKjYJ1njpJjEItD8RhtpnfPzxpD8ZAAAAIK7HIEAhhtpnfPzxpD8p1XgJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUOblrMwBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAfoBoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNDQ2OTQ0MywgMCk7dWYoJ2knLCA3NzY0OTM4LCAwKQUULGcnLCAxOTQ5OTk0NxUpLHMnLCAyNzk3MzkxMxkWAHIBUxwyODU1MjkzNAUs8IuSAqUEIWltM2hjd2lYelB3WkVPYmxyTXdCR0FBZ3liRkxNQUk0QUVBQVNKZzVVT2FtZ0ExWUFHQ2dCV2dBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQ3FnQkNyQUJBTGtCX3ptMEQwWUl0RF9CQWY4NXRBOUdDTFFfeVFFQUFBQUFBQUR3UDlrQkFBQQUOdDhEX2dBY3IzMlFQMUFYTGxIajZZQWdDZ0FnRzFBZwEjBEM5CQjYREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3R2lBdzRJMkltbkpoQUxHQUl0QQFDwExvRENVNVpUVEk2TmpRNE5lQUR4ai1BQlBqVHpRcUlCSWlqelFtUUJBR1lCQUhCQkEBNQkBCHlRUQkJAQEYTmdFQVBFRQELCQFgQ0lCZFV5a0FYUTlWbVlCWUgyc1lVQnFRVQkfGEFEd1A3RUYBDVA0Tm5UNkRfQkJjM016RXl1M01NX3kuKAAAOQkoCQEIRFpCEXfwQ1BBXzRBV1JQZkFGcTVlbUNmZ0Z3LVdRQW9JR0ExVlRSSWdHQkpBR0FaZ0dBS0VHMl9sLWFyeDA3ei1vQmdTeUJpUUpBCVUBAQBSAQUNAQBaDQgBAQBoAQUJAUBDNEJnby6aApkBIWtoYWVvZzopAihNbXhTeUFBS0FBeBltBDg2MmEBFFVER1AwawlQIQUAMT00AEYRGAxBQUFHHRgARx0YAEgdGBBIZ0FpUREQ9CoBRHdQdy4u2AIA4ALhkTzqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQQCAAQBBj6ASD6ASgAMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo2NDg12gQCCAHgBAHwBOblrMwBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAF8-ku-gUECAAQAJAGAJgGAKIGDjc2MjAjTllNMjo2NDc0uAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAJCmAQABgA4AYB8gaHAQjQ9VkSgAFSaFAzRjFvIX_YREFBa0NCUUVJMjREX0NCQzQxcWNDR0tpWm93SWdCeWdBUUt1RXZBUkk5YVNTQ1ZER1AxaktNbjGNBEFBIZ0AZzWdDEFBQUmNGixKb0JBZ2dBcUFFQXMuIADAQS4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB4qnBdIHDQnNzMzMzMwoQBAAGADaBwYIAAXA8NQHAOoHAggA8AeRgAiKCLwBCrcBAAABiB4bKwgUW96Mmv_ZWHNJtuGI74EFdAC6HSvXjOG5NUKdG6fJL8U2wrFkgEAIfvJYWMfHc8lsZGd_mafQWdldmVm4NuGgURtCDfQ7nra0PfNy-HEUH-hSGg7SMT98iCjK4jha6FYD5lp9R9etoYprL0US-EON07swoM8_0bZ02lr3TucMjgv2feQJDNGZK_xk9_ejQ6BUb1OjSR9_vVZ7pMC7CRFn40Dex8bY_nl9kcrYwAGKEAGVCAAAgD-YCAE.&s=587ff98c3ee30b919243ffcd55b4e6084e9e98a2&type=nv&nvt=5&jm=1003&px=495&py=215&bw=250&bh=250&sid=8087001251715739968&vd=ct~0|rr~0&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27267942&cid=3&cr=nv&sw=1600&sh=1200&pw=1600&ph=10796&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
AN-X-Request-Uuid: ffc91c89-bcf4-42d4-a102-7d5857baef7e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
424 B 26ms
26ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: 7321a5f10992cacae4175ddf99ba320dcf9f7792ea4f810a4b8d70568980518f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 189
expires: 0

GET
H2

200

cksync
cs.media.net/ Frame 87EB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490

61 B
467 B

69ms
69ms

Image
image/gif

23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

cksync.php
contextual.media.net/ Frame 87EB
Redirect Chain

https://creativecdn.com/cm-notify?pi=medianet
https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

61 B
472 B

183ms
181ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet
pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT, Mon, 15 May 2023 06:31:26 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 87EB
Redirect Chain

https://sync.go.sonobi.com/us?https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869213271338731455172000V10&ovsid=[UID]
https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869213271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

61 B
481 B

352ms
352ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869213271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:26 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869213271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 87EB
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__https%3A%2F%2Fcontextual.media.net%2Fcksync.php...
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2MJGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJXM5YXKSZRGRHEQQZXI4ZGUZKJNJTGY...
https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=413228692132713387314551...

60 B
307 B

40ms
40ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322869213271338731455172000V10&vsid=3271338731455172000V10

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 60
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:28 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322869213271338731455172000V10&vsid=3271338731455172000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 284
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

cksync
cs.media.net/ Frame BAC7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490

61 B
467 B

76ms
75ms

Image
image/gif

23.33.180.25
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU533H8Y&prvid=2034%2C2011%2C2033%2C3022%2C2030%2C3020%2C251%2C273%2C175%2C450%2C2009%2C178%2C255%2C2028%2C3018%2C2027%2C3017%2C214%2C2025%2C237%2C117%2C3014%2C459%2C97%2C99%2C77%2C38%2C3012%2C3011%2C182%2C3010%2C261%2C141%2C262%2C461%2C222%2C201%2C3007%2C246%2C301%2C4%2C203%2C225%2C10000%2C80%2C108%2C9&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H2
Server: 23.33.180.25 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-33-180-25.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=cb640652-5013-46a4-8cfe-1b84d3b7b490
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

cksync.php
contextual.media.net/ Frame BAC7
Redirect Chain

https://creativecdn.com/cm-notify?pi=medianet
https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

61 B
472 B

234ms
233ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=VpfbHUC29S3305XiHykA&pi=medianet
pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT, Mon, 15 May 2023 06:31:26 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame BAC7
Redirect Chain

https://sync.go.sonobi.com/us?https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869323271338731455172000V10&ovsid=[UID]
https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869323271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

61 B
481 B

184ms
182ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869323271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:27 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:27 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-46
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3271338731455172000V10&type=son&refUrl=&vid=41322869323271338731455172000V10&ovsid=277a2357-1e32-4313-9dd0-85518179de6d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame BAC7
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?puid=${VSID}&cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dzem%26ovsid%3D__ZUID__https%3A%2F%2Fcontextual.media.net%2Fcksync.php...
https://stags.bluekai.com/site/23178?id=7gquK14NHC7G2jeIjfln&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2MJGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJXM5YXKSZRGRHEQQZXI4ZGUZKJNJTGY...
https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=413228693232713387314551...

60 B
307 B

42ms
41ms

Image
image/gif

104.126.112.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322869323271338731455172000V10&vsid=3271338731455172000V10

Requested by

Protocol

Server

104.126.112.26 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-126-112-26.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:28 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 60
x-mnet-hl2: E
expires: Mon, 15 May 2023 06:31:28 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:28 GMT
Content-Type: text/html; charset=utf-8
Location: https://contextual.media.net/cksync.php?cs=1&ovsid=7gquK14NHC7G2jeIjflnhttps%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8&ovsid=__ZUID__&refUrl=&type=zem&type=zem&vid=41322869323271338731455172000V10&vsid=3271338731455172000V10
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 284
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9149 13 KB
5 KB 35ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118236
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E104 783 B
535 B 43ms
42ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d7dbf4e52457fcf0325a786773734a96b5cabf9dea791b8138a6f632741d05ef

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-L7DlGM9CfI0lwPCaNruGEA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-L7DlGM9CfI0lwPCaNruGEA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:26 GMT
expires: Mon, 15 May 2023 06:31:26 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ Frame A250 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01b062caad5ed0b1aa2c207fd6c8f666fedd64fe9bef7cd4f6f3caf28c17e931

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 1041 61 KB
23 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1672
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1041 17 KB
6 KB 36ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:27 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9D7E 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstGUHjMJ2fhPuL-lRNB8r45onR8Oae4nhq0j-B3rZtDatam8OUJsnROlU7vlVaAdyyjw4oXsXKF7c4ExOyhsMPVhiX9ECINmu2f23_nYWYxL_BPKJZu&sig=Cg0ArKJSzD-oEI6xWWk8EAE&id=lidar2&mcvt=1332&p=1074,1070,1324,1370&mtos=0,0,1332,1332,1332&tos=0,0,1332,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1830954974&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132284188&rpt=1531&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 809C 42 B
181 B 90ms
23ms Image
image/gif 2600:1f18:61c0:2204:6305:8510:f60c:aae5
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:61c0:2204:6305:8510:f60c:aae5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 809C
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8.SUQDBYssPdFQAA%261358&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

43 B
632 B

61ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
date: Mon, 15 May 2023 06:31:27 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 21801

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 809C
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:27 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f1ff55bf-adee-4622-b287-f80276e2b861
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 809C
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

43 B
603 B

28ms
26ms

Image
image/gif

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 809C 43 B
603 B 62ms
28ms Image
image/gif 2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 809C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

55ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 809C
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=3135ab51-7600-4853-8940-06363dfdc48f&expiration=1715754687

43 B
632 B

19ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=3135ab51-7600-4853-8940-06363dfdc48f&expiration=1715754687
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=3135ab51-7600-4853-8940-06363dfdc48f&expiration=1715754687
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 809C 43 B
103 B 118ms
26ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 47003
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79568ccbb4a20a-YYZ
content-length: 43
expires: Tue, 16 May 2023 06:31:27 GMT

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 4BF1 42 B
180 B 79ms
24ms Image
image/gif 2600:1f18:61c0:2204:6305:8510:f60c:aae5
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:61c0:2204:6305:8510:f60c:aae5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4BF1
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8.SUQDBYssPdFQAA%261358&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

43 B
632 B

57ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
date: Mon, 15 May 2023 06:31:27 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 21801

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 4BF1
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672

43 B
632 B

24ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:27 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 150de6dc-132e-4c2b-aad9-c2ab58752d7a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 4BF1
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

43 B
603 B

29ms
28ms

Image
image/gif

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 4BF1 43 B
855 B 97ms
32ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HXW7KADYFTAWFG3CSGVQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 4BF1 43 B
603 B 57ms
27ms Image
image/gif 2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame 4BF1 0
34 B 54ms
25ms Image
text/plain 3.212.118.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.118.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-118-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 4BF1 43 B
353 B 111ms
25ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 47003
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79568ccbb5a20a-YYZ
content-length: 43
expires: Tue, 16 May 2023 06:31:27 GMT

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 9F63 42 B
180 B 70ms
25ms Image
image/gif 2600:1f18:61c0:2204:6305:8510:f60c:aae5
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:61c0:2204:6305:8510:f60c:aae5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9F63
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8.SUQDBYssPdFQAA%261358&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

43 B
632 B

55ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
date: Mon, 15 May 2023 06:31:27 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 21789

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 9F63
Redirect Chain

https://cm.ctnsnet.com/int/cm?exc=19
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=0da1c83e79db4ec9adf8030279a50eb8&expiration=1686724287

43 B
632 B

19ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=0da1c83e79db4ec9adf8030279a50eb8&expiration=1686724287
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:26 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=0da1c83e79db4ec9adf8030279a50eb8&expiration=1686724287
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 9F63
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

54ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 9F63
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

43 B
603 B

29ms
29ms

Image
image/gif

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=ZGHRseRl8.SUQDBYssPdFQAA%261358
dpm.demdex.net/ Frame 9F63 42 B
942 B 255ms
81ms Image
image/gif 52.39.235.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZGHRseRl8.SUQDBYssPdFQAA%261358?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.39.235.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-39-235-222.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

DCS: dcs-prod-usw2-2-v044-07167c779.edge-usw2.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: zlHVmCcETd0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 9F63 43 B
855 B 93ms
30ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 64YPD5S0Y1YHA02E5NM5
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 9F63 43 B
102 B 107ms
26ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 47003
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79568ccbb9a20a-YYZ
content-length: 43
expires: Tue, 16 May 2023 06:31:27 GMT

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame 5538
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672

43 B
632 B

60ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:27 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: c7216bad-81b9-4c42-ac00-d5bb94e5351b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame 5538 0
34 B 23ms
23ms Image
text/plain 3.212.118.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.118.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-118-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame 5538 42 B
180 B 48ms
24ms Image
image/gif 2600:1f18:61c0:2204:6305:8510:f60c:aae5
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:61c0:2204:6305:8510:f60c:aae5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5538
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8.SUQDBYssPdFQAA%261358&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
date: Mon, 15 May 2023 06:31:27 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 22242

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 5538
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=3135ab51-7600-4853-8940-06363dfdc48f&expiration=1715754687

43 B
632 B

18ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=3135ab51-7600-4853-8940-06363dfdc48f&expiration=1715754687
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=3135ab51-7600-4853-8940-06363dfdc48f&expiration=1715754687
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 5538
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

56ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 5538 43 B
855 B 92ms
30ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SEFF8W8X6FXC3B2X59S9
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 5538 43 B
103 B 110ms
32ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 47003
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79568ccbbaa20a-YYZ
content-length: 43
expires: Tue, 16 May 2023 06:31:27 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame BB23
Redirect Chain

https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=1&t=pixel
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=205&external_user_id=emzyze33qpag

43 B
632 B

19ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=205&external_user_id=emzyze33qpag
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:28 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

lws: 222
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
accept-encoding: utf-8
time-ms: 0
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=205&external_user_id=emzyze33qpag
cache-control: no-cache, no-store
content-length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BB23
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8.SUQDBYssPdFQAA%261358&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738

43 B
632 B

44ms
19ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=4f6ca5fc-eeaa-4dcd-9061-5afbc735cf92-tuctb5b5738
date: Mon, 15 May 2023 06:31:27 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 21853

GET
H2

200

ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame BB23
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

43 B
603 B

28ms
28ms

Image
image/gif

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

2600:1f18:4e9:5a01:cb6:2b9:d6d3:59ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame BB23 0
34 B 31ms
22ms Image
text/plain 3.212.118.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.118.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-118-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT

GET
H/1.1

200
OK

crum
dsum.casalemedia.com/ Frame BB23
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672

43 B
632 B

34ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Date: Mon, 15 May 2023 06:31:27 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 30a6b2bf-8a29-4935-b457-79f53ffa1779
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=2829111677345209672
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame BB23
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1

43 B
632 B

42ms
18ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKMOwV55FZ4mCULeJJ6-Zrw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame BB23 43 B
855 B 75ms
31ms Image
image/gif 52.46.155.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZGHRseRl8-SUQDBYssPdFQAABU4AAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.155.104 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: BPM8WE6HZHD1PCGA18FV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame BB23 43 B
103 B 63ms
29ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZGHRseRl8.SUQDBYssPdFQAA%261358
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 47003
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7c79568ccbbda20a-YYZ
content-length: 43
expires: Tue, 16 May 2023 06:31:27 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame AADA 356 KB
120 KB 73ms
73ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:27 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame A31A 0
17 B 369ms
368ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=3~lhogvp2c&chm=1&c=2913416228924394&ctx=2&qqid=CMWO09PZ9v4CFVLV4Qod9ZUKXg&met.6=6.1_CgsYyR8gPSoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
a2.adform.net/csimpr/ Frame F744 35 B
592 B 26ms
17ms Ping
image/gif 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/csimpr/?bn=62821215&csi=x8oYxhDs3DHhYQqHOotJ4_mfelQz63-k3z8hHMXz81EJDwKV3Zer3LgpXl1rJaoa_YJjBBdbd2AZH2mvRbTGVN6vWmW1dlSa0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 404 null
ssl.connextra.com/servlet/ Frame 1FF6 767 B
767 B 323ms
313ms Image
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/null
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9ab81bdf22828344347d35e13aca7150cc9142cbd354a9c4aa4c2c6d3fdb2b6f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-language: en
date: Mon, 15 May 2023 06:31:27 GMT
content-length: 767
content-type: text/html;charset=utf-8

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ Frame 1FF6 12 KB
12 KB 43ms
36ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:900

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c783f924dc83b1990b7d490eade941b7d4676b799702e2fc6c7fe78a739fbe37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ssl.connextra.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 09:53:06 GMT
x-content-type-options: nosniff
age: 592701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12048
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 May 2024 09:53:06 GMT

POST
H3 204 collect
www.google-analytics.com/g/ Frame AD9F 0
17 B 36ms
35ms Ping
text/plain 2607:f8b0:400c:c0c::71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Q29WX7Q7F8&gtm=45je35a0&_p=948170489&cid=1420665221.1684132273&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&sid=1684132281&sct=1&seg=0&dl=https%3A%2F%2Fswiftmoves.blog%2F&dr=https%3A%2F%2Fswiftmoves.blog%2F&dt=&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Q29WX7Q7F8&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c0c::71 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 4D4D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1105e08dfcab6c51b28e31a1ade18e137fa27ae53c269a2662b20b108ae374c6

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3C5C 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 21c59941eeb54a4070f07b20f4fcf22b354f9052caaa68a489d1d203e9639da1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 404 null
ssl.connextra.com/servlet/ Frame A310 767 B
767 B 315ms
313ms Image
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/null
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9ab81bdf22828344347d35e13aca7150cc9142cbd354a9c4aa4c2c6d3fdb2b6f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-language: en
date: Mon, 15 May 2023 06:31:27 GMT
content-length: 767
content-type: text/html;charset=utf-8

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ Frame A310 12 KB
12 KB 50ms
49ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:900

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c783f924dc83b1990b7d490eade941b7d4676b799702e2fc6c7fe78a739fbe37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ssl.connextra.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 09:53:06 GMT
x-content-type-options: nosniff
age: 592701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12048
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 May 2024 09:53:06 GMT

GET
H2 404 null
ssl.connextra.com/servlet/ Frame 6A96 767 B
767 B 314ms
313ms Image
text/html 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/servlet/null
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9ab81bdf22828344347d35e13aca7150cc9142cbd354a9c4aa4c2c6d3fdb2b6f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-language: en
date: Mon, 15 May 2023 06:31:27 GMT
content-length: 767
content-type: text/html;charset=utf-8

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ Frame 6A96 12 KB
12 KB 47ms
45ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:900

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c783f924dc83b1990b7d490eade941b7d4676b799702e2fc6c7fe78a739fbe37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ssl.connextra.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 09:53:06 GMT
x-content-type-options: nosniff
age: 592701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12048
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 May 2024 09:53:06 GMT

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame CD59
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

23ms
23ms

Document
text/html

34.200.84.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.84.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-84-78.compute-1.amazonaws.com
Software: /
Resource Hash: a951a731adc1ad63bd02e805a9ca80b89fb40804d414709920b7f863de9cff06

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-length: 186
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Mon, 15 May 2023 06:31:27 GMT
pragma: no-cache

Redirect headers

content-length: 41
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
location: /um/cs&eq_cc=1

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame 8C94
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

23ms
23ms

Document
text/html

34.200.84.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.84.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-84-78.compute-1.amazonaws.com
Software: /
Resource Hash: a951a731adc1ad63bd02e805a9ca80b89fb40804d414709920b7f863de9cff06

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-length: 186
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Mon, 15 May 2023 06:31:27 GMT
pragma: no-cache

Redirect headers

content-length: 41
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
location: /um/cs&eq_cc=1

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame 7EBE
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

25ms
22ms

Document
text/html

34.200.84.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.84.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-84-78.compute-1.amazonaws.com
Software: /
Resource Hash: a951a731adc1ad63bd02e805a9ca80b89fb40804d414709920b7f863de9cff06

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-length: 186
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Mon, 15 May 2023 06:31:27 GMT
pragma: no-cache

Redirect headers

content-length: 41
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
location: /um/cs&eq_cc=1

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame 6AE9
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

24ms
23ms

Document
text/html

34.200.84.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.84.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-84-78.compute-1.amazonaws.com
Software: /
Resource Hash: a951a731adc1ad63bd02e805a9ca80b89fb40804d414709920b7f863de9cff06

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-length: 186
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Mon, 15 May 2023 06:31:27 GMT
pragma: no-cache

Redirect headers

content-length: 41
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
location: /um/cs&eq_cc=1

GET
DATA 200
OK truncated
/ Frame E5CE 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 50c0c7a4-ee48-4032-8405-3d5e00113bb7 Show response
https://c.bannerflow.net/ Frame 1BA8 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://c.bannerflow.net/50c0c7a4-ee48-4032-8405-3d5e00113bb7
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 668
Content-Type

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame 15F2
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

27ms
24ms

Document
text/html

34.200.84.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fswiftmoves.blog%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.84.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-84-78.compute-1.amazonaws.com
Software: /
Resource Hash: a951a731adc1ad63bd02e805a9ca80b89fb40804d414709920b7f863de9cff06

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-length: 186
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Mon, 15 May 2023 06:31:27 GMT
pragma: no-cache

Redirect headers

content-length: 41
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 06:31:27 GMT
location: /um/cs&eq_cc=1

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 26ms
25ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:27 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: 5c6d2aeb-60fc-330a-a5e9-6b6533f7d7ce

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_026.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 75 KB
76 KB 43ms
42ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_026.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be68170d2365b45d639f5a99d8f5c74081dc2ac4f236d3e5117c2072f53c272f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1125
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HcvxGFhI7ppQwJitaGactrqsSwbKXDLp4orAPBXcDcEKwuku9gpujR0xqq%2BpTiDfIOLvmIYb5HtCbcVfMIzINsEnTvkRscaRAmH9gv0gCZvkgMolgaStPFo8zTzADCAIu%2F4L%2Fx4iKgY6OUjGVGnpAxwg"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79568cca245437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77187

GET
H3 200 audio_026.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 36ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_026.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d85f02b5abfa884454ea8d3f5bf3311a51a26a8403dc7ddfd120a512e39b2fde

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C4IGeYNLAe8qRCK7ZdgtglIAXcfIjNRtozDuPWghXr1m5JR6zh4mQ2E9GQD4r72h7gKBQWw%2FTJVgnAhquZlFjN51IhlmLm5LumxEsPeZwSHs1CGlVZkfVTuK90DRIe9SoG7OzZSdnMRFSTTmwpmEsBAM"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79568cca255437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40711

POST
H2 204 events
bidder.criteo.com/csm/ 0
216 B 25ms
23ms Ping
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:26 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 13 B
294 B 25ms
23ms XHR
application/json 2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?ccpa=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

243fb9953e49b6005f6ae1772f507bb789a8893960a495850afe43fe34030311

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H3 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame A250 12 B
53 B 38ms
37ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame A250 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame A250 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FB3A 603 B
65 B 163ms
161ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=1737933831&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132287&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132286541&bpp=6&bdt=1041&idt=957&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132288&ga_hid=1091088914&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=3046632564&scr_x=0&scr_y=0&eid=31074469%2C44788441%2C44789923%2C31071260%2C21065724&oid=2&pvsid=3765900986654356&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p08kr2kcwg1k&fsb=1&dtd=974

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame 9D7E 0
955 B 53ms
18ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QK3F_BVtwsAAAMA1gAFAQi7o4ejBhD4heHE4KbXgnkYyLrI8MzCwaEnKjYJEyLqBSOBuj8Rvscet3vhpT8ZAAAAIIXr0T8hrXnmVCI7pj8p6MHdWbvtuj8xAAABG7CxPzDjpoINONEYQJg5SAJQ6bOPzgFY_KdrYABozMw_eN38BYABAYoBA1VTRJIFBvBMmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDUxNjUzODYsIDApO3VmKCdpJywgODI3NTUxMiwgMCkFFCxnJywgMjEwNDAyNTgVKQBzARUcODQ1NjUyNDQVFjByJywgNDMyMjY1NzA1BRbwi5ICvQ4hWW9XNXNRaU8tOTRhRU9temo4NEJHQUFnX0tkck1BSTRBRUFBU0pnNVVPT21nZzFZQUdDZ0JXZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJDcWdCQ3JBQkFMa0JzeHozWmE3dHVqX0JBYk1jOTJXdTdib195UUVBQUFBQUFBRHdQOWtCQUFBBQ50OERfZ0FiaU0tUVAxQWFlWVZUNllBZ0NnQWdHMUFnASMEQzkJCNhEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHaUF3NElfb1h6S2hBTEdBSXRBAUPYTG9EQ1U1WlRUSTZOakU1TmVBRHhqLUFCTy1iNGdxSUJQdWI0Z3FRQkFDWUJBR3FCTThIQ1BfXxUCCHdFURUMFF9fX0FSagEHDQEMOEJJUA0LAQEId0VvAQcRAQhBVEQRCxRfX184Qk8yLAAERkEBFhEBBEFVNlgAAFU2LAAAWREoAQEEQVc2WAAAYTYsAAB3ASQRAQRBWDZYAAhnQUgRGwWUAGk6EAAAazoQACBtQUdUeTlVQm86GAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBTAHxDQEIOEJpOhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAARnQS4lAiEANhAAAGs6EAAAbToQAABvOhAAAHE6EAAAczoQAAB1OhAAAHc6EAAAeToQAAAwOhAAADI6EAAANDoQAAA2OhAAADg6EAAALToQAAhnQVQt_AEBIQA2EAAAazoQAABtOhAAAG86EAAAcToQAABzOhAAAHU6EAAAdzoQAAB5OhAAADA6EAAAMjoQAAA0OhAAADY6EAAAODoQAAAtOhAACGdBWAH5DQEhADYQAABrOhAAAG06EAAId1FRoU4JAQhNa0UJCQEBGERZQkFEeEIBCw0BXGlBV3pNSkFGb185VG1BWDh2ZGlIQWFrRg0fFEE4RC14QgFPUEVCS1Jkc193UVVBQUFCb1RndmhQOAkoHFFGa1EyVF9SBSgNAQAyBSgBAfBDRHdQLUFGbDFMd0JZS1poQXI0QmNxaXV3S0NCZ05WVTBTSUJnU1FCZ0dZQmdDaEJ0djVmbXE4ZE84X3FBWUVzZ1lrQ1EBSAkBAEUBjA0BAEcdDABJHQw4dUFZS5oCmQEhbUJidW93OkEHWFB5bmF5QUFLQUF4Ml9sLWFyeDA3ejg2MnkGFFVER1Awaw1nDER3UDE9RABGERgMQUFBRx0YAEcdGABIHRgMSGdBaS5VB_Dedy4u2ALnQ-ACw8tZ6gIYaHR0cHM6Ly9zd2lmdG1vdmVzLmJsb2cvgAMAiAMBkAPpvUGYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQSCAQQBBisAiD6ASgBKAIwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjYxOTXaBAIIAeAEAfAE6bOPzgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAUOcNgFAeAFAfAFx7sy-gUECAAQAIoGgAFTQlRyVzFvITnYREFBa0NCUUVJN2VuZkJoQ2Ruc0VDR002NjBBSWdCaWdBUU91bDBnVkkwcWJTQlZER1AxaW9NSDZXAQBnNVcEQUEBNwBBDuwILEpvQkFnZ0FxQUVBcy4gADxBLi6QBgCYBgCiBg4zMTUzEecYODS4BgDBBgW3LADwP9AGqSXaBhYKEAkRGQEoEAAYAOAGAeoGKHUeBQoUMjYzMTMzErAJARQAaQ4ZChQ1MTI1MjYFFEDyBocBCKP_UxKAAVJ4UzVWVjb6AEA5NlM5Q0JDRF9iQUNHS1hsdAHDQHlnQVFOeVE4UVJJOXZDbUNG_voACfpwgAcBiAcAoAcBugcIKgQxLS0tQAHIB938BdIHDQkJ5AREQAHiCNoHBiGucBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=01b70a54c8cfcb89d122c793af52a4328b383abf&type=pv&jm=1003&px=1070&py=1074&bw=300&bh=250&sf=0.5&sid=8087001251715739968&vd=ct~0|rr~5&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27300707&cid=3&cr=nv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
AN-X-Request-Uuid: 5cdd1758-5326-4e17-8ae0-a8365085611e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D43C 0
0 39ms
38ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuKizPGZXWoT1VEP2T3nA1h3BUwRs-HkK9dHtKC2koz_5QxuldoPY1RINjt_Eqt3Rx5Kxdq0lB_hN9FmUlrRXtXhKfxnNXOZCo_4Mbxsxx2cj7XRIJuQbuovKeMtUKijTaEdP3_0sduynDmOFv0-Eq6R9UozJPjdRkb66_fp2WoSKYFRPEXjj9OBvhdd9y3UKi1ArDSXd-AEo7wKRWXGrQfHQv9gwzsiFP86SpQ6UpuygWaZE6yfU9F6I7VV9GQMteNrzPkLWyngCGbA1KUhqhquHkHwEzSNCc8quF-Cjd81NSZ1WVz87FBEdil3G8Bisy8lMN_-mRTdj0l&sai=AMfl-YS-WRshUQKqpsaHOh4W5A6RdlzAXiV_t3yI85imt_uqc0yl0wU5WTf4Qlao0YZHFxJFayWy8yvjJn3OhfQ2M1SeEeVhemBNHwbMQPLrhXvjY-nHiRPmKQs4Py_7nU8&sig=Cg0ArKJSzBDltUH8UiepEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:27 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D43C 14 KB
11 KB 42ms
42ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

853553d919d8a30f4b7b7b652d50522102da4c78040ad261e9f22ae6e9a5ae85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11076
x-xss-protection: 0

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame EF30 1 B
271 B 126ms
47ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=7d95c3724768367a4d071a3d&pm_pl=1684132283893&pm_td=3680&pid=1000791&en=1.1&callback=__pm_glbl_RleYKpIp4C6VUsatiFCm99ot._gc4&tt=g&v=e3c1265
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:27 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
DATA 200
OK truncated
/ Frame AADA 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2e5504a086ecd67a4427054848839ccb6bfd136b483c7a94b8f5cb38caf85189

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 4D4D 12 B
53 B 37ms
36ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame 4D4D 107 B
122 B 38ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 4D4D 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EAE0 603 B
65 B 142ms
141ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=1740827144&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132287&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132286680&bpp=6&bdt=944&idt=936&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132288&ga_hid=1391705531&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=544152925&scr_x=0&scr_y=0&eid=31071756%2C44788442%2C44792088&oid=2&pvsid=2552196757394378&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.rclg6hp6vl3g&fsb=1&dtd=945

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 3C5C 12 B
53 B 37ms
37ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame 3C5C 107 B
122 B 37ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 3C5C 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 770F 603 B
65 B 155ms
154ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=1742776991&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132287&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132286687&bpp=4&bdt=925&idt=945&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132288&ga_hid=804866930&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=3091236720&scr_x=0&scr_y=0&eid=44785293%2C44788441%2C44790154&oid=2&pvsid=1012378234630347&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.4kg306qik1gx&fsb=1&dtd=957

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0ABB 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 30b774c6-e658-4812-95d6-9bb9bdb2aa0d Show response
https://c.bannerflow.net/ Frame 56A7 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://c.bannerflow.net/30b774c6-e658-4812-95d6-9bb9bdb2aa0d
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 668
Content-Type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 79BB 145 B
1 KB 97ms
97ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

90fa171aea6dcf96f38f09d11f9f061c79574319884b6973e615ad1ee8743636

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
AN-X-Request-Uuid: fd87d5b1-0945-4bcb-ba6d-d2b0111038f9
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F744 0
0 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuaNAeqzAnOIpSnVs7H41CCyjHjOri9_x1cCTEWS5eZc0iz-P6LD90wB-dRZVVlEypN3Dq2HLtCNCEpzvmNGqIZMOSCCmftLKUs16hQWtFl-2nVY7Th_7dibKe1UmrMKTVELzWMhcKbeg9pw2RE_N-9DRCp-bmHezBrsSERNisqp_lADuW9--atswsWW00MRZCd7OFaAp0aij1kDjq1M26g8p8a79nbDms6HttvdL-E92i8dBmPNxhm2glPa4siagLTbZmhJsXlh-3CPGGc9B7x4YEd0FjTi4HDG2BB_W3PmXEBqT-8xoYDJ6fNo1tqjGc13ZPu8IjRZA&sai=AMfl-YQcXhE6CIPIVUibNp57J16MyQ_jngH1R_iYcNjwf7Z95Wfl7bnvoZKSG4PSDAdc1d4hEBGbME8K4G8RQWwjToilFBKV5Uk9ebxO1MffGiYaXpD9EXqe_lsiituQgxI&sig=Cg0ArKJSzIFMNWwiPoS2EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:27 GMT

GET
H2 200 12490839.js Show response
s2.adform.net/Banners/Elements/Files/2045613/12490839/ Frame 9B54 3 KB
1 KB 17ms
17ms Script
application/x-javascript 185.167.164.46
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/Banners/Elements/Files/2045613/12490839/12490839.js?ADFassetID=12490839&bv=258
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.167.164.46 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b69b32669eb90f2eaff4f4065db89bd703b5a3facce732564427a647128dc9e3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
last-modified: Mon, 13 Mar 2023 09:16:51 GMT
server: nginx
x-amz-request-id: tx0000039f42082ad352d9c-00640f417b-32953090-default
etag: W/"1b07b7da2dab65adc7290ed555cfaf5e"
x-cache-status: MISS, HIT, STALE
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 79BB 895 B
1 KB 80ms
34ms XHR
application/json 23.105.12.131
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.131 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 50f1e83f9e0b48d3dca6eef2d003d529e7a79ad2618737c360af431e0b6052fb

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F61E 0
861 B 18ms
17ms Script
text/html 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7620&pub_id=964152&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7620&pub_id=964152

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
AN-X-Request-Uuid: 077d1a45-c29d-4279-8565-92774b51212d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame 8C94 43 B
632 B 19ms
18ms Image
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=9ddf6a1b-06be-4b43-98ea-ce50ae34235f&expiration=1692081087
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame CD59 43 B
632 B 19ms
19ms Image
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=9ddf6a1b-06be-4b43-98ea-ce50ae34235f&expiration=1692081087
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame 6AE9 43 B
632 B 19ms
19ms Image
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=9ddf6a1b-06be-4b43-98ea-ce50ae34235f&expiration=1692081087
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame 7EBE 43 B
632 B 19ms
19ms Image
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=9ddf6a1b-06be-4b43-98ea-ce50ae34235f&expiration=1692081087
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame 15F2 43 B
632 B 30ms
18ms Image
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=9ddf6a1b-06be-4b43-98ea-ce50ae34235f&expiration=1692081087
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame EF30 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame D43C 61 KB
23 KB 44ms
42ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1672
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H2

204

0
prebid.a-mo.net/cchain/ Frame EDD7
Redirect Chain

https://id.a-mx.com/usync?uid=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr_consent=
https://prebid.a-mo.net/cchain/0

0
38 B

25ms
19ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/cchain/0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

date: Mon, 15 May 2023 06:31:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jdPMByhscbatjUuMek96zv1hfhjzpQ1g3Eko8RRke2GsSTOpbhmKmLocDfe5DY3U7vr7zHyOUW4ZA4%2BGmDZfKSYyHn5q4pxqaFk%2BAxR9SLHPCn8AHEpWwhOyzWTRj8LCN0HdEXGMOnX9xQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=UTF-8
location: https://prebid.a-mo.net/cchain/0
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c79568edec6a23b-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2

204

setuid
prebid.a-mo.net/ Frame EDD7
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=8220b2d1-4aec-4d94-9d18-b2fae200417f&gdpr=0&gdpr_consent=&us_privacy=
https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadaptmx%26expires%3D30%26u...
https://x.bidswitch.net/sync?dsp_id=429&user_id=de4b5f83-2dbe-5387-9f53-13f2fb32c240&ssp=adaptmx&expires=30&user_group=1&gdpr=0&gdpr_consent=
https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=

0
113 B

26ms
26ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?bidder=bid_switch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Location: //prebid.a-mo.net/setuid?bidder=bid_switch&uid=0c031c75-0dc5-47ab-a78c-92793a44c6bb&gdpr=0&gdpr_consent=&us_privacy=
Date: Mon, 15 May 2023 06:31:28 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame EDD7
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?gdpr=0&gdpr_consent=&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f
https://prebid.a-mo.net/setuid/yahoo?uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A&gdpr=0

0
112 B

26ms
26ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A&gdpr=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-WeyQxxtE2uGpQbiCSgQF6ke56NH42ySQgLu_Sqw-~A&gdpr=0
date: Mon, 15 May 2023 06:31:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
prebid.a-mo.net/ Frame EDD7
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D8220b2d1-4aec-4d94-9d18-b2fae200417f%26bidder%...
https://prebid.a-mo.net/setuid?A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=smartadserver&uid=4857008915831342889

0
115 B

25ms
24ms

Image
text/plain

147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=smartadserver&uid=4857008915831342889
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid?A=8220b2d1-4aec-4d94-9d18-b2fae200417f&bidder=smartadserver&uid=4857008915831342889
date: Mon, 15 May 2023 06:31:27 GMT
content-length: 0

GET
H/1.1 200
OK setuid
ib.adnxs.com/prebid/ Frame EDD7 43 B
1 KB 30ms
28ms Image
image/gif 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:27 GMT
AN-X-Request-Uuid: bfa3d7f6-4b02-4cc0-bea1-e435245d2c34
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ow.pubmatic.com/ Frame EDD7 86 B
1 KB 31ms
29ms Image
image/png 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-length: 86
content-type: image/png

GET
H2 200 setuid
prebid-server.rubiconproject.com/ Frame EDD7 86 B
616 B 33ms
31ms Image
image/png 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=amx&uid=8220b2d1-4aec-4d94-9d18-b2fae200417f
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://prebid.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Mon, 15 May 2023 06:31:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
expires: 0

GET
DATA 200
OK truncated
/ Frame 896F 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 896F 1 B
271 B 125ms
46ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=e5dee7f10e44a019efb39927&pm_pl=1684132284489&pm_td=3374&pid=1000791&en=1.1&callback=__pm_glbl_cZYhO3K9c149mwORnLbbRUIU._gc4&tt=g&v=e3c1265
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:27 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D43C 17 KB
6 KB 37ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:27 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
574 B 212ms
212ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=5&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A450%2C%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

d02a52933ccfc4c432ea945efab8c180084fdda78ccb515b58fd24a33751188c

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: M6ZCFTHMFEFNV5VS83CH
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: nALE-_96K7hgMJQCF_5_8sPk4S0Pmb8k9IHLpc0pvVX_J64tjiCZAQ==

GET
H2 200 60d0815c37670160b4539414.json Show response
c.bannerflow.net/sfeeds/581701278d987c10bca61aed/ Frame E5CE 22 KB
5 KB 17ms
16ms Fetch
application/json 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/sfeeds/581701278d987c10bca61aed/60d0815c37670160b4539414.json
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/feed.441c69936f1e15d1037a.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 734e3816dfea714aa260368d4a9596bc8bcda52ecaaded4274710b9f932215b7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:21 GMT
server: cloudflare
age: 584
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: public, max-age=600, stale-if-error=28800, stale-while-revalidate=28800
cf-ray: 7c79568f5cfb7151-YUL
request-context: appId=cid-v1:ab2f42fc-6a35-4ceb-b810-86e88366fb0b

GET
H3 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame AADA 12 B
53 B 37ms
36ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AADA 107 B
122 B 39ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AADA 107 B
122 B 33ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 85F3 603 B
65 B 196ms
196ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=1742945858&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132287&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132287171&bpp=9&bdt=759&idt=754&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132288&ga_hid=483700660&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=2567009671&scr_x=0&scr_y=0&eid=42531705%2C44788442%2C44792088&oid=2&pvsid=4110113830907893&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.qsxe77xuprf7&fsb=1&dtd=766

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E104 0
0 37ms
37ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=2927364914404732&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H/1.1 200
OK metric
report2.hb.brainlyads.com/statistics/ Frame 79BB 463 B
751 B 70ms
23ms Image
image/png 54.84.92.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://report2.hb.brainlyads.com/statistics/metric?event=noBid&bidder=appnexus64520d892126d5b60b1c1d8a&source=pbjs&placements=29926568
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.84.92.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-92-154.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 64faef43f59f0d829a290bb25e0b5c24308c0381b590d9717e460a8344912ba3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:28 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Powered-By: Express
ETag: W/"1cf-XHssOe1+WUPy43P3Ckt9sJ3fhf4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 463

GET
H3 200 avjp Show response
outbrain-d.openx.net/v/1.0/ Frame 79BB 106 B
127 B 33ms
33ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://outbrain-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fswiftmoves.blog%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=e1d505a6-6aec-4386-a8a7-8dc90ed71bd6&nocache=1684132287983&sua=%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D&us_privacy=1---&criteoid=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&id5id=ID5*Biwi9bSpv2mcQ_9PQZMYCjkmr06et2l1ISOFmMJIsRpJ2elYAkEw2wEFjI_VPvsqSdqNsIFt1m-DMbKSc_YrdA&lotameid=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&parrableid=null&pubcid=efc6dd67-eb86-4443-a034-9da4b203b609&ttduuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&schain=1.0%2C1!outbrain.com%2C006ca10119b62fceba0024c827780cdc78%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A734%2C%22h%22%3A412%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22maxduration%22%3A60%2C%22minduration%22%3A0%2C%22linearity%22%3A1%2C%22api%22%3A%5B2%5D%2C%22placement%22%3A3%7D%7D%5D%7D&auid=540492000&vwd=734&vht=412&vos=101&aumfs=3380
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1041 42 B
64 B 37ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssIv-eT7SMP0wYVoW0CN2arndXccwco58OKWKmHHkvYibocB7CjO8CGZzi4wwzdSrQFkyr6vu4PAjuvOqpdyvuIXqGcGnOwCDVBIEYpl0LZqr7cWqbR&sig=Cg0ArKJSzOoPcDcWOauAEAE&id=lidar2&mcvt=1198&p=1074,1070,1324,1370&mtos=0,0,1198,1198,1198&tos=0,0,1198,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1526563377&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132283098&rpt=3601&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 9D7E 61 KB
23 KB 37ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 1041 0
17 B 374ms
373ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvq10&chm=1&c=2913416228924394&ctx=2&qqid=CNX62dPZ9v4CFZHm4Qod4w8ASA&met.4=fb.9~lb.6y~ol.2s4~idt.av~dt.-d3&met.3=739.6z~1032.z5~738.2s1~749.2s1_3~736.2uy~735.34b_2~740.3ab_1~113.3oq_1~112.3oq_2~734.3sa_3&met.1=1.lhogvmca~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.90~23.90&met.7=CCIQBBgBIAsoCzBHOD1oDHBHeKwCsAEBuAED~CAIQChgBIAsoCzBVOEpoDXBDeJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIAsoCzBgOFVoDnBAeNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIOkBKOkBMLQCOEto6gFwpgJ4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBIPUJKPUJMJsKOCZo9glwmgp4zAKAASCIAQywAQG4AQM~CC8QBxgBIPcJKPcJMJ0KOCZo9wlwnAp4kAOAAWSIAWuwAQG4AQM~CC8QBxgBIPcJKPcJMJoKOCJo-AlwmQp4kAOAAWSIAWuwAQG4AQM~CAUQBRgBIPwJKPwJMJwLOKABaP8JcJsLeNoCgAEuiAHbBLABAbgBAw~CCIQBBgBIJQcKJQcML0cOClolRxwvRx4rAKwAQG4AQM~CCcQDRgBIJUcKJUcMMQcODBolRxwwxx47FmAAcBXiAH5c7ABAbgBAw~CCgQChgBIPgeKPgeMJ4fOCZo-R5wnR94hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 60d0815c37670160b4539414.json Show response
c.bannerflow.net/sfeeds/581701278d987c10bca61aed/ Frame 0ABB 22 KB
5 KB 23ms
22ms Fetch
application/json 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/sfeeds/581701278d987c10bca61aed/60d0815c37670160b4539414.json
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/feed.441c69936f1e15d1037a.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 734e3816dfea714aa260368d4a9596bc8bcda52ecaaded4274710b9f932215b7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:21 GMT
server: cloudflare
age: 585
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: public, max-age=600, stale-if-error=28800, stale-while-revalidate=28800
cf-ray: 7c7956902d7a7151-YUL
request-context: appId=cid-v1:ab2f42fc-6a35-4ceb-b810-86e88366fb0b

GET
H2

200

Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame 9B54
Redirect Chain

https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js

30 KB
14 KB

540ms
144ms

Script
application/javascript

37.157.5.72
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Server: 37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
last-modified: Wed, 08 Jun 2022 12:02:22 GMT
server: nginx
x-amz-request-id: tx00000a3594564e653314a-0063765fcb-3293868f-default
etag: W/"4731aef0a5114a59b4311776d270e848"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

Redirect headers

location: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js
date: Mon, 15 May 2023 06:31:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
content-type: text/html

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame FD12 61 KB
23 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame E0EE 61 KB
23 KB 37ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame AD9F 0
0 41ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202305090101&jk=2913416228924394&bg=!5uWl5bHNAAYldGN0BXQ7ADkAdvg8WnoB-6yNgILyw-rOupJ8R88FktrumnwReUIVhUSXow2PkH8ouvTW9-_EOUarnAiHTNzeiy8CAAAMsFIAAAADaAEHCgAQIp6Lcs-uEZgWY1bWFZxfxpkCv90uAGJrQlkBKyJXehz4T6KUG8crPhkANyouYcq7o-eHFLfOUnOvd3hLGKaFLmOYRICFIxyqIwoXXfw6eXoeHQTdOktx6-CvkmI67cB_C-CiGPlpF-y40SK7FQJ5OmvnFry3rWsNjR8ZRmM8ZyG5Z9jG-ji0GPw3nYYjJ6_Mc3wyXlnd4lVXdHvhZ-dLzBZNS4qBfDDZLJPIyo54ghDS16Bmqnjf7cG_h8ECOgImQERst2Mjop_MrfSgpefzBMij7eB_VaG6Fy5IK3V5zmw04L_ACkCzHgiWcFUpRNevSuQsg5BG4PPW0ECMUHGbObejmEmx0rvAVemsk7Qfwxszc16Pb6e5xRzRzMONuj_G19tUpwXSxI06Hd3omkJ-Sa1ogaJmAFtn1j9cURXBoqTRf0cGToxhl82FZkUEBJkL1VOX5907TXFGFcm9wXrUAc7DbzeMawQFxymgsExBIgYlyJm9n6vWz-wXmsGZc_4g5J_fksUAOuXFpkAdKaPuGK4yQp12R2gxpfI0QYWzaPOd2JB_UjqP4azvKEyXAp626fq2YOsHTu5YV6fJQ3GhwPkR6tlLz7wWIh-IJvaEMcynh9e_vHnkTTxA_-paQ9x55N52jbqvcLrVHHmaPuki02EN0CgRzqQgFqqEdKKeDBAA_Uqxv8fp4bC9pEEGBhLnoegt4ZHHKyYG4U7N41FWzhQqZ4wn8rwqj0LlChS7lSunIAczMYKvOHvFrpSkN8webfdzf6YN6KnJLETxS7oPgOUCXrKoYYBISo3WW1pSRYr0mLLuUuyaozdDEPSzzq64tYBcEPoiMcwNgv1qotP9L1KKU8WYyl2maWANn4-HiOVXIttsC7fsYwGzVHgQLWTzzMa1ymZsrtMY0QUVdD9jDq4nGatLmCbI2cW0t5Lioz7FZEN0IWNIxdxVvTdQm_MZOZg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F20C 13 KB
5 KB 35ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118238
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 27C0 783 B
535 B 43ms
42ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5c731db5b8bd67879f054c2cc572972d1e7da99bbcf22fa7557ff919cbffe653

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3JMSTaXAB4w0T3Jkaoo84g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-3JMSTaXAB4w0T3Jkaoo84g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
expires: Mon, 15 May 2023 06:31:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame EF30 1 B
271 B 40ms
40ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=7d95c3724768367a4d071a3d&pm_pl=1684132283893&pm_td=4197&pid=1000791&en=1.1&callback=__pm_glbl_RleYKpIp4C6VUsatiFCm99ot._gc5&tt=g&v=e3c1265
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:28 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 9149 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540919
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame E5CE 6 KB
6 KB 17ms
17ms Font
font/woff 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F581700858d987c12245d04b2%2F7b49bac3-4e85-4c34-b3ea-72a1852603f7.woff&t=%20ABCEFGHILNOPRSTUVWY
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75a21fa52dd9362e2d577cdae3081bd7d8d5a851dfe3f8e2dcb404587ad17d61

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Origin: https://c.bannerflow.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2023 10:14:09 GMT
server: cloudflare
age: 8701463
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=7b49bac3-4e85-4c34-b3ea-72a1852603f7-subset.woff
cf-ray: 7c795690cdc27151-YUL
expires: Wed, 24 Jan 2024 10:14:09 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 39ms
39ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 896F 1 B
271 B 45ms
45ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=e5dee7f10e44a019efb39927&pm_pl=1684132284489&pm_td=3699&pid=1000791&en=1.1&callback=__pm_glbl_cZYhO3K9c149mwORnLbbRUIU._gc5&tt=g&v=e3c1265
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:28 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

POST
H3 204 csi
csi.gstatic.com/ Frame D43C 0
17 B 377ms
377ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvq7k&chm=1&c=2913416228924394&ctx=2&qqid=CJa189PZ9v4CFZL24QodjB8Lsw&met.4=fb.c~lb.15y~ol.38c~idt.ew~dt.-92&met.3=739.15z~1032.1ll~738.388~749.388_4~736.39l~735.3h3_1~740.3kd_1~113.3ns_1~112.3ns_1&met.1=1.lhogvmjt~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.17g~23.17g&met.7=CCIQBBgBIA0oDTA2OCloDnA1eKwCsAEBuAED~CAIQChgBIA0oDTA9OC9oDnA5eJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIA4oDjA4OCtoDnAxeNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIJYGKJYGMOEGOEtolgZw1gZ4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBIJ4QKJ4QMMUQOChonhBwxRB4zAKAASCIAQywAQG4AQM~CC8QBxgBIJ8QKJ8QMMYQOCdooBBwxRB4kAOAAWSIAWuwAQG4AQM~CC8QBxgBIJ8QKJ8QMMMQOCRooBBwwhB4kAOAAWSIAWuwAQG4AQM~CAUQBRgBIKQQKKQQMJsROHdopxBwmhF42gKAAS6IAdsEsAEBuAED~CCIQBBgBINwgKNwgMIMhOCdo3CBwgiF4rAKwAQG4AQM~CCcQDRgBINwgKNwgMIghOCxo3SBwhyF48FiAAcRWiAHRcrABAbgBAw~CCgQChgBINEiKNEiMP8iOC5o0yJw_SJ4hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A250 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvCOOiOgJ5JIDdhZ0nht0FeeGcVPtO8aDlbK7U8zrPBaQZxhpUqRKGzYbnpj2QQ7WQJRYZzCBkXxICQKypdsRUbUci5jLTqkq0QAP6dzRodzo4Uy9teLYhaeYvi7T6rAEgnC38ScoQo1EWk756DjD5bI0c0KZvZRaRQ1xbtrIZZG4LpzzSZ6KuSN6Oc9RhBdiNc27MDG3dKPgiaVVxYqi9UaoLrX8SF0OMRDpyarELBm1DfA0J2HvSnLd9W6GfdwLznRChklaXTr4lbgyIW2nn5xV2Umi_vydSj7j0hz7qXIO6WN7Wxv5yzYrtvwmIzKTcbxkfZO_atL4SW&sai=AMfl-YRHAW1hCIzSLYURvNJNIhf8PycZY---QUDXy_vdhUkuamUqgnJPEL5_MncGj8_irVXtwYEpno1O9JZOji-Y4H-BdTy0LVA7iIkBytxSHbNsugFkcGrR_OJzGCh7lxI&sig=Cg0ArKJSzHQeYWoq7wZNEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A250 15 KB
11 KB 43ms
43ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d0dd6610f8a31c1af2af397b8053d40b477a2a2b213b5319154e64ada06b1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11217
x-xss-protection: 0

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 0ABB 6 KB
6 KB 17ms
17ms Font
font/woff 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F581700858d987c12245d04b2%2F7b49bac3-4e85-4c34-b3ea-72a1852603f7.woff&t=%20ABCEFGHILNOPRSTUVWY
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75a21fa52dd9362e2d577cdae3081bd7d8d5a851dfe3f8e2dcb404587ad17d61

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Origin: https://c.bannerflow.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2023 10:14:09 GMT
server: cloudflare
age: 8701463
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=7b49bac3-4e85-4c34-b3ea-72a1852603f7-subset.woff
cf-ray: 7c7956915e0f7151-YUL
expires: Wed, 24 Jan 2024 10:14:09 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 375C 13 KB
5 KB 35ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118238
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EBDE 783 B
535 B 40ms
39ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

276c7a638bf5ebd0c0f4086f2f852d48615e1b635a67ee4919d0f6e3dbd8af98

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wq3qtSs8PZkude8HW2wsWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-wq3qtSs8PZkude8HW2wsWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
expires: Mon, 15 May 2023 06:31:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4D4D 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuAc8pKlLg5nA3EWNOC_6jTr9Q-_I5ukmFa-GgHyMtp4x6OkWfRAMrJzVwuM77GLgRjny7TFsPq_PjM-psdv_bRkYRAe6sNRoqe4_awQuIvJoW2qa_-k1_oUEQoC4ixb4jIAlrFVtqW3urjtsHi6FMtguGxW-c1lgG9K7P3G0AhPgp9OyGFKB2GO0qAg2Y14eG-otzwU5NZQWhgzW4yba_qzkRsJknl30huFTVf9PM8psabvi6wA2Pu2VEDLI1ujprhiU8-7z7jmdha4Q2LZVMZ77D5jSPC84ccns7jlTxYyu2ogpgVq3bqaOtdKOMsy4ZHigT5F5Aaf4pc&sai=AMfl-YR1jTATuvww4ck0cnkUYE11na_OXZGgK6zKSJdtuyPysD7tlW13ksYutBPJ7pnNoAyqqqTW-klQ302otpDzJSDNm_1vjIuGaUxAV2KbWoVH5tjNPFYkmhWSKdjX5_Q&sig=Cg0ArKJSzOkmfU18WgYqEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4D4D 14 KB
11 KB 42ms
42ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0aa78cc58f6cd3172ddea532ec583eaeb8fcb0520f7a47ce7d19204b1dd6797d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11139
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3C5C 0
0 40ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssXCKWFW1s6rMKBHD4VoUKDthLTFUX1TmoOCzvgpUzrq8enQPjDSLfN9UpjwLDemYK7siFm21eKpbcnZxfyuLaTExeT63QD73OmqitBIcMKyIozsWxUQ-h-Plj68ZfbqV3k9z3Bei9AueoTiikSjQbJebHFgXenS3FCMnM70fUjPcxwX7-d5fXizhNvVc2ZwtJw-Ob1MgDpT1BwRl7ekaXTU6kUk_LUjhBZ7J6qDfdRekIG28q5zWB-YN_pzr9ohzWFoc2BjrajQZRY3h4L-WMX7PHMySry-7cWW1WGT0W1gw6jOfTjdqVbkRUzH2OrvOXNOv0zGuSNSppF&sai=AMfl-YQFOfX76HnHe3XTZKZa0aYsF1UUHdMLHQCxBCYap8KO9-NEPWsSNCq5NzvXvB0FoA1snTIEJ8Zr7kLHXdp12hUo3FYkufwZCEmntzguX_lfj_zP2xtOXWKtm6YX4Ck&sig=Cg0ArKJSzNPkLMqP5j3rEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 3C5C 15 KB
11 KB 42ms
42ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

477caa4bd588d5c5d668e1c0bb6cb04a0e7ddea111ce9f9351d311527e828db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11347
x-xss-protection: 0

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame E5CE 4 KB
4 KB 16ms
16ms Font
font/woff 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F581700858d987c12245d04b2%2F42eeb52d-4ab8-44ad-9b90-6a5b55a7192c.woff&t=%20%27ABCDEGIJKLNOPRSTY%C3%8D%C3%96%D8%A5%D8%B6%D9%85%D9%86%E0%A4%82%E0%A4%95%E0%A4%9C%E0%A4%9F%E0%A4%B0%E0%A4%B8%E0%A4%BF%E0%A5%87%E0%A5%8D%E7%99%BB%E9%8C%B2
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ff65fe195636c2056e1bd39cd02944d4c2281b0df5f6689a5c438ac66dc3f73

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Origin: https://c.bannerflow.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Tue, 14 Feb 2023 16:13:12 GMT
server: cloudflare
age: 7740762
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=42eeb52d-4ab8-44ad-9b90-6a5b55a7192c-subset.woff
cf-ray: 7c795691de6a7151-YUL
expires: Wed, 14 Feb 2024 16:13:12 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame A250 61 KB
23 KB 38ms
36ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame F744 0
955 B 19ms
18ms Ping
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fswiftmoves.blog%2F&e=wqT_3QKmDfBMpgYAAAMA1gAFAQi1o4ejBhDYsv_XydH3rRQYyLrI8MzCwaEnKjYJ1njpJjEItD8RhtpnfPzxpD8ZAAAAIK7HIEAhhtpnfPzxpD8p1XgJJNAxAAAAgML18D8w5qaADTjEO0CYOUgCUOblrMwBWMmxS2AAaL-nY3iKpwWAAQGKAQNVU0SSAQEG8EyYAfoBoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNDQ2OTQ0MywgMCk7dWYoJ2knLCA3NzY0OTM4LCAwKQUULGcnLCAxOTQ5OTk0NxUpLHMnLCAyNzk3MzkxMxkWAHIBUxwyODU1MjkzNAUs8IuSAqUEIWltM2hjd2lYelB3WkVPYmxyTXdCR0FBZ3liRkxNQUk0QUVBQVNKZzVVT2FtZ0ExWUFHQ2dCV2dBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQ3FnQkNyQUJBTGtCX3ptMEQwWUl0RF9CQWY4NXRBOUdDTFFfeVFFQUFBQUFBQUR3UDlrQkFBQQUOdDhEX2dBY3IzMlFQMUFYTGxIajZZQWdDZ0FnRzFBZwEjBEM5CQjYREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3R2lBdzRJMkltbkpoQUxHQUl0QQFDwExvRENVNVpUVEk2TmpRNE5lQUR4ai1BQlBqVHpRcUlCSWlqelFtUUJBR1lCQUhCQkEBNQkBCHlRUQkJAQEYTmdFQVBFRQELCQFgQ0lCZFV5a0FYUTlWbVlCWUgyc1lVQnFRVQkfGEFEd1A3RUYBDVA0Tm5UNkRfQkJjM016RXl1M01NX3kuKAAAOQkoCQEIRFpCEXfwQ1BBXzRBV1JQZkFGcTVlbUNmZ0Z3LVdRQW9JR0ExVlRSSWdHQkpBR0FaZ0dBS0VHMl9sLWFyeDA3ei1vQmdTeUJpUUpBCVUBAQBSAQUNAQBaDQgBAQBoAQUJAUBDNEJnby6aApkBIWtoYWVvZzopAihNbXhTeUFBS0FBeBltBDg2MmEBFFVER1AwawlQIQUAMT00AEYRGAxBQUFHHRgARx0YAEgdGBBIZ0FpUREQ9CoBRHdQdy4u2AIA4ALhkTzqAhhodHRwczovL3N3aWZ0bW92ZXMuYmxvZy-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2AOTy9UB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTgzqAQAsgQQCAAQBBj6ASD6ASgAMAA4ArgEAMAEAMgEANIEDjczMjAjTllNMjo2NDg12gQCCAHgBAHwBOblrMwBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAF8-ku-gUECAAQAJAGAJgGAKIGDjc2MjAjTllNMjo2NDc0uAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAJCmAQABgA4AYB8gaHAQjQ9VkSgAFSaFAzRjFvIX_YREFBa0NCUUVJMjREX0NCQzQxcWNDR0tpWm93SWdCeWdBUUt1RXZBUkk5YVNTQ1ZER1AxaktNbjGNBEFBIZ0AZzWdDEFBQUmNGixKb0JBZ2dBcUFFQXMuIADAQS4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB4qnBdIHDQnNzMzMzMwoQBAAGADaBwYIAAXA8NQHAOoHAggA8AeRgAiKCLwBCrcBAAABiB4bKwgUW96Mmv_ZWHNJtuGI74EFdAC6HSvXjOG5NUKdG6fJL8U2wrFkgEAIfvJYWMfHc8lsZGd_mafQWdldmVm4NuGgURtCDfQ7nra0PfNy-HEUH-hSGg7SMT98iCjK4jha6FYD5lp9R9etoYprL0US-EON07swoM8_0bZ02lr3TucMjgv2feQJDNGZK_xk9_ejQ6BUb1OjSR9_vVZ7pMC7CRFn40Dex8bY_nl9kcrYwAGKEAGVCAAAgD-YCAE.&s=587ff98c3ee30b919243ffcd55b4e6084e9e98a2&type=pv&jm=1003&px=495&py=215&bw=250&bh=250&sf=1&sid=8087001251715739968&vd=ct~0|rr~6&sv=232&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=27267942&cid=3&cr=pv&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/232/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:28 GMT
AN-X-Request-Uuid: 165b5f0c-db5e-45c5-8635-1e823f7b8599
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 9D7E 0
17 B 373ms
372ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqb4&chm=1&c=2913416228924394&ctx=2&qqid=CMfwktTZ9v4CFUnm4QodekUF9w&met.4=fb.a~lb.16o~ol.2u9~idt.6f~dt.-hj&met.3=739.16o~736.17k~735.1mq_1~740.1ww~734.28l_2~735.2ic_1~738.2u8~113.34l_1~112.34l_2&met.1=1.lhogvn6k~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.17r~23.17r&met.7=CCIQBBgBIAsoCzAzOChoC3AyeKwCsAEBuAED~CBsQBSAOONIc~CBsQBSAPOMwc~CBsQCiASOBQ~CBsQCiATOBQ~CBsQBiATOBY~CE0QChgBIBQoFDBAOCxoFXA4eNWkA4ABqaIDiAHExgqwAQG4AQM~CCIQBBgBIPwLKPwLMKUMOClo_QtwpAx4rAKwAQG4AQM~CBsQASCWEDgW~CCAQBBgBINcWKNcWMPwWOCVo2BZw-xZ41gKAASqIASqwAQG4AQM~CBsQASCkGjg1~CCgQChgBIPYdKPYdMJ8eOClo-R1wnB54hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A250 17 KB
6 KB 36ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_027.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 95 KB
96 KB 39ms
38ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_027.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba0fb16bd5f58e796790ce418c3f50d95310d713ed87c4c8fcd321482467088d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1125
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ePLWagETqtdZgg6bP9Po6f1lwYYILx04IH5lHAnDKfb85ZTBL3ZzKq%2Fg6X4qGaB%2B8RY7ADXGzy8GtHLsjgGEjPNNTQVRhe%2BKW8BPGuwBnqHnrSCP79l5YmP1DUcn7kQ96BUnGbixjyBy%2B72ftbEsPRB2"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79569218395437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 97293

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 4D4D 61 KB
23 KB 43ms
37ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 3C5C 61 KB
23 KB 41ms
36ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame FD12 0
17 B 374ms
371ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqbv&chm=1&c=2913416228924394&ctx=2&qqid=CMSn6NPZ9v4CFSUdwwodno0H5Q&met.4=fb.8~lb.gc~ol.3nx~idt.eg~dt.-9i&met.3=739.gc~736.pi~735.w9_1~740.18g_1~734.1ny_2~735.1yx_1~738.3nw~113.3ww_1~112.3wv_1&met.1=1.lhogvmf0~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.pm~23.pm&met.7=CCIQBBgBIAkoCTAyOCloCnAxeKwCsAEBuAED~CBsQBSAROPsk~CBsQBSATOKAa~CBsQCiAVODA~CBsQCiAVOC0~CBsQBiAVODk~CE0QChgBIBYoFjBEOC5oF3A6eNWkA4ABqaIDiAHExgqwAQG4AQM~CCIQBBgBIMQEKMQEMO0EOCloxQRw7QR4rAKwAQG4AQM~CBsQASC0CDgb~CCAQBBgBIO8QKO8QMJUROCVo8BBwlBF41gKAASqIASqwAQG4AQM~CBsQASDhEzgT~CCgQChgBIOglKOglMJAmOCdo6SVwjCZ4hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame E0EE 0
17 B 378ms
374ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqbx&chm=1&c=2913416228924394&ctx=2&qqid=COGbgdTZ9v4CFQfZ4QodZJMMMA&met.4=fb.9~lb.1ba~ol.3gl~idt.i9~dt.-5p&met.3=739.1ba~736.1be~735.1ie_1~740.1qp_1~734.2ft_2~735.2rk_1~738.3gk~113.3pb_1~112.3pb_1&met.1=1.lhogvmmn~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.1bi~23.1bi&met.7=CCIQBBgBIAooCjAzOCloC3AyeKwCsAEBuAED~CBsQBSANOPci~CBsQBSAOOMwd~CBsQCiAQOBg~CBsQCiARODY~CBsQBiAROBk~CE0QChgBIBEoETA_OC1oFHA3eNWkA4ABqaIDiAHExgqwAQG4AQM~CCIQBBgBIKINKKINMMwNOCpoow1wzA14rAKwAQG4AQM~CBsQASDxDjgT~CCAQBBgBINsYKNsYMIAZOCVo2xhw_xh41gKAASqIASqwAQG4AQM~CBsQASDLGTgb~CCgQChgBINsjKNsjMIQkOClo3CNwgSR4hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame EF30 1 B
271 B 42ms
42ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=7d95c3724768367a4d071a3d&pm_pl=1684132283893&pm_td=4469&pid=1000791&en=1.1&callback=__pm_glbl_RleYKpIp4C6VUsatiFCm99ot._gc6&tt=g&v=e3c1265
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000791&tt=g&tid=6812&l1=193398&l2=GeniusSports&l3=6834967&l4=3881893&l5=&l6=&utid=15F0D346-D356-B756-186C-BDA544C42A21&creative_type=display&adid=ftdiv6834967&pub_app=&pub_domain=&uid=&cb=9905015&pub_ts=1684132282
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:28 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame AADA 0
0 41ms
39ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstumsaTlG4XDY4wrePhyGk9fQ_lOMFBUht_S-Mr3RqAWWR82k6eI8Be7uNrZMSzSSTd9kh2X7S_8tJk7s3UcAzG2DcA7BSKYT7Z3lFvGwk_8oOvZWJSwrIvvvj021YiQd_8dCfnI4UBkY-YX5MP2FARgpJ2JReMYDvOLDPrh-RBV-q-J2nmvtTtOV4MGnbVldqMijwTtNAaTnr47BaUQsdvouC5jQT2L_sCt5wfhXYBt2eSN1-_QBzn5X9CLDlwABNLdM95f743Hhjzdhd04yvwVz8cZxyQNJNTBFnyF7gDKmwggEX5DuJAeHbzGtm43EDX7IXNxJ4dV9Jl&sai=AMfl-YQ7StxIqhgVpxCFUSDYW4PjCAYjxKosKg3t34QJ9R7Sctjj6AsChWmrilPb59Py6bquGM3hvhPK6w3fXrzonOr84zwqq_Cux2e-0ckFS7ACdaJ529Eh4sYdxOgAY0I&sig=Cg0ArKJSzM2YFqVWIdY7EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AADA 15 KB
11 KB 43ms
42ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

169e1a8cac73a0ddd4770b07cc15b8106db0295d9874a617225bb9a7cc019655

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11347
x-xss-protection: 0

GET
H3 200 audio_027.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 40ms
39ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_027.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84860ab4d9b9483b555ae1ba453c8f35866fd48036238ea92bf71fa51cb7d870

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1125
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ezet%2BcwdQ8%2FaRDmbD0pOGkI%2FGZr%2BHkfEatKmmpcisvMVGc3CPLmo4HPsJkN0CFQPzzJrXIHtPlHrGqPoyjXGZDAbsC2WN6sNKy6Jj3Yutknq8lVklH0FhgzC9HBFflOqLLRxz6jFn5ihnP0XL8DMyny"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79569268815437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40280

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4D4D 17 KB
6 KB 40ms
39ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 3C5C 17 KB
6 KB 39ms
39ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:28 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 0ABB 4 KB
4 KB 16ms
16ms Font
font/woff 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F581700858d987c12245d04b2%2F42eeb52d-4ab8-44ad-9b90-6a5b55a7192c.woff&t=%20%27ABCDEGIJKLNOPRSTY%C3%8D%C3%96%D8%A5%D8%B6%D9%85%D9%86%E0%A4%82%E0%A4%95%E0%A4%9C%E0%A4%9F%E0%A4%B0%E0%A4%B8%E0%A4%BF%E0%A5%87%E0%A5%8D%E7%99%BB%E9%8C%B2
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ff65fe195636c2056e1bd39cd02944d4c2281b0df5f6689a5c438ac66dc3f73

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
Origin: https://c.bannerflow.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Tue, 14 Feb 2023 16:13:12 GMT
server: cloudflare
age: 7740762
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=42eeb52d-4ab8-44ad-9b90-6a5b55a7192c-subset.woff
cf-ray: 7c7956926ecc7151-YUL
expires: Wed, 14 Feb 2024 16:13:12 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
142 B 513ms
513ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=2320137887434351&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132288382&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=ve4_td16_tt15_pd16_la16000_er0.0.0.0_vi0.0.1200.1600_vp0_ts3_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 27C0 0
0 36ms
35ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=4376816124959109&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame AADA 61 KB
23 KB 36ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1673
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 8F52 5 KB
6 KB 17ms
16ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F20cab9ff-0a31-4bdd-aa36-158bf65b11e2.png&w=244&h=207&q=90&f=webp&rt=contain
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b84052c32000c1ff8159402c57186cb9721e6dfa72b0c976e7b48b3fb57a4e8e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 15:35:37 GMT
api-supported-versions: 2.0
server: cloudflare
age: 28192
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c795692ff607151-YUL
content-length: 5628
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 1b32737e-0414-4af3-abea-90f4a9f3357d.svg
c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/ Frame 8F52 22 KB
8 KB 18ms
18ms Image
image/svg+xml 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/1b32737e-0414-4af3-abea-90f4a9f3357d.svg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3c637ee1acefd70ae74cac3b4ca3d82fa3b2b24f0854971763e538726446db0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: r3z+HfOHSNARfFJOY8VEgQ==
age: 6993
x-ms-lease-status: unlocked
last-modified: Tue, 19 Apr 2022 11:37:03 GMT
server: cloudflare
etag: W/"0x8DA21F8ED0C4897"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 3d7e8cdf-401e-0001-51b7-bfb2fa000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7c795692ff627151-YUL

GET
H2 200 60247ad2-a231-4d4d-b281-7cee8fd1d189.svg
c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/ Frame 8F52 3 KB
1 KB 19ms
19ms Image
image/svg+xml 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/60247ad2-a231-4d4d-b281-7cee8fd1d189.svg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 115d3d222e948b73289c8180d4c821ae08feed8d7c3c62d7abff966e1f890bbb

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 7YVF1fdK2DQLVpofOPigCA==
age: 955
x-ms-lease-status: unlocked
last-modified: Wed, 02 Jun 2021 09:28:39 GMT
server: cloudflare
etag: W/"0x8D925A8CE413846"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c8efe8fd-c01e-00a6-7b56-715a38000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7c795692ff637151-YUL

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AADA 17 KB
6 KB 36ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:28 GMT

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 896F 1 B
271 B 42ms
41ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=eKBWmxpsZFbSGfNQEbfVPmIHphtxNTzm-FE7fPshldVXnKDoY03zDEkvF-E0zJOM1uaVvhNw==&pm_ct=e5dee7f10e44a019efb39927&pm_pl=1684132284489&pm_td=4010&pid=1000791&en=1.1&callback=__pm_glbl_cZYhO3K9c149mwORnLbbRUIU._gc6&tt=g&v=e3c1265
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://swiftmoves.blog
Date: Mon, 15 May 2023 06:31:28 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 44E5 14 KB
15 KB 16ms
15ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54434
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c7956934f937151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame A10F 5 KB
6 KB 15ms
15ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F20cab9ff-0a31-4bdd-aa36-158bf65b11e2.png&w=244&h=207&q=90&f=webp&rt=contain
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b84052c32000c1ff8159402c57186cb9721e6dfa72b0c976e7b48b3fb57a4e8e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 15:35:37 GMT
api-supported-versions: 2.0
server: cloudflare
age: 28192
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c795693cfec7151-YUL
content-length: 5628
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 1b32737e-0414-4af3-abea-90f4a9f3357d.svg
c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/ Frame A10F 22 KB
7 KB 17ms
17ms Image
image/svg+xml 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/1b32737e-0414-4af3-abea-90f4a9f3357d.svg
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3c637ee1acefd70ae74cac3b4ca3d82fa3b2b24f0854971763e538726446db0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: r3z+HfOHSNARfFJOY8VEgQ==
age: 6993
x-ms-lease-status: unlocked
last-modified: Tue, 19 Apr 2022 11:37:03 GMT
server: cloudflare
etag: W/"0x8DA21F8ED0C4897"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 3d7e8cdf-401e-0001-51b7-bfb2fa000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7c795693cff07151-YUL

GET
H2 200 60247ad2-a231-4d4d-b281-7cee8fd1d189.svg
c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/ Frame A10F 3 KB
1 KB 17ms
17ms Image
image/svg+xml 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/betway/581701278d987c10bca61aed/images/60247ad2-a231-4d4d-b281-7cee8fd1d189.svg
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.62c08aa132f36f133041.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 115d3d222e948b73289c8180d4c821ae08feed8d7c3c62d7abff966e1f890bbb

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 7YVF1fdK2DQLVpofOPigCA==
age: 955
x-ms-lease-status: unlocked
last-modified: Wed, 02 Jun 2021 09:28:39 GMT
server: cloudflare
etag: W/"0x8D925A8CE413846"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c8efe8fd-c01e-00a6-7b56-715a38000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 7c795693cff27151-YUL

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame F20C 37 KB
14 KB 35ms
34ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540919
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame EBDE 0
0 37ms
36ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=2779369445405892&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrainimg.com/loggerServices/ 4 B
371 B 75ms
18ms Fetch
application/json 64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=c62632dad57dd6a33aa5cac54e8c6521&pvId=c62632dad57dd6a33aa5cac54e8c6521&sid=7473619&pid=6420&idx=0&wId=101&pad=0&org=0&tm=16044&eT=9&cnsnt=1---&wRV=2010301&pVis=0&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=&ccpa=1---&oo=false&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:28 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 9963c225a019f7e51c52be6b104150a4
Content-Length: 4
Expires: 0

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 5855 14 KB
15 KB 16ms
15ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54434
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c79569468527151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D43C 42 B
64 B 37ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstwEElZjKO5bSadL_u_x_QyK2Y6NYtyLLXUq5--NEoC7qOgTAaIBE6Wfp9sdUgJGS10w2nN8czjS2SRFAfArF_lFaG0WKPJYrGuHtjmKpoJevWywYmd&sig=Cg0ArKJSzCR3nFi25fb9EAE&id=lidar2&mcvt=1189&p=1074,1070,1324,1370&mtos=0,0,1189,1189,1189&tos=0,0,1189,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1925621845&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132283369&rpt=4184&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame A250 0
17 B 378ms
378ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqme&chm=1&c=2913416228924394&ctx=2&qqid=CNnl2tTZ9v4CFcbZ4Qod_-0Jhw&met.4=fb.9~lb.175~ol.23c~idt.2r~dt.-l7&met.3=739.175~1032.1ji~738.238~749.238_3~736.24d~735.26l_2~740.27s_1~113.2ff_1~112.2ff_1&met.1=1.lhogvo71~14.0~15.0~16.0~17.0~18.0~19.0~20.0~21.0~22.19n~23.19n&met.7=CCIQBBgBIAooCjA1OCtoDXA1eKwCsAEBuAED~CAIQChgBIAsoCzA9ODNoDnA6eJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIAsoCzA6OC9oDnAxeNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIJYIKJYIMN0IOEdolwhw0Qh4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBINkPKNkPMP8POCZo2g9w_w94zAKAASCIAQywAQG4AQM~CC8QBxgBINsPKNsPMIIQOCdo3A9wghB4kAOAAWSIAWuwAQG4AQM~CC8QBxgBINsPKNsPMP8POCRo3A9w_g94kAOAAWSIAWuwAQG4AQM~CAUQBRgBIOEPKOEPMIcROKcBaOYPcIYReNoCgAEuiAHbBLABAbgBAw~CCIQBBgBIJcVKJcVMMAVOClomBVwvxV4rAKwAQG4AQM~CCcQDRgBIJgVKJgVMMUVOC1omRVwxBV4_VmAAdFXiAGTdLABAbgBAw~CCgQChgBIPAVKPAVMJ0WOC1o8hVwlhZ4hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3126 13 KB
5 KB 45ms
37ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118238
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0926 783 B
535 B 50ms
42ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

81ca2491f9af4fc2faa82116b97d7466beae243e9765773e026253bc47d3b548

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5x8Zc8BFDIRvP9ogZca6ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-5x8Zc8BFDIRvP9ogZca6ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
expires: Mon, 15 May 2023 06:31:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E05D 13 KB
5 KB 44ms
37ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118238
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D7AB 783 B
534 B 53ms
46ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

333acf7c144cccaa4fcb6b46ffa3c937f63e21bd01fc27ec277c03335502fae1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Zniiw1azCYBse9QV2GvwdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-Zniiw1azCYBse9QV2GvwdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
expires: Mon, 15 May 2023 06:31:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H3 204 csi
csi.gstatic.com/ Frame 4D4D 0
17 B 389ms
383ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqmn&chm=1&c=2913416228924394&ctx=2&qqid=CPCk59TZ9v4CFdAbwwodIQwHtA&met.4=fb.9~lb.17f~ol.1y5~idt.1u~dt.-m4&met.3=739.17f~1032.1g7~738.1y1~749.1y1_4~736.1zt~735.21t_1~740.21x~113.293_1~112.292_1&met.1=1.lhogvodl~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.19n~23.19n&met.7=CCIQBBgBIAooCjAzOCpoCnAzeKwCsAEBuAED~CAIQChgBIAooCjA-ODRoC3A3eJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIAooCjA2OCxoC3AueNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBILQHKLQHMPsHOEdotQdw8gd4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBINsOKNsOMIEPOCZo3A5wgA94zAKAASCIAQywAQG4AQM~CC8QBxgBIN0OKN0OMIQPOCdo3Q5wgw94kAOAAWSIAWuwAQG4AQM~CC8QBxgBIN0OKN0OMIAPOCNo3g5w_w54kAOAAWSIAWuwAQG4AQM~CAUQBRgBIOIOKOIOMPMPOJABaOUOcPIPeNoCgAEuiAHbBLABAbgBAw~CCIQBBgBINwTKNwTMIUUOClo3RNwhRR4rAKwAQG4AQM~CCcQDRgBIN0TKN0TMIoUOC1o3hNwiBR4r1mAAYNXiAGpc7ABAbgBAw~CCgQChgBIKgUKKgUMNUUOC1orhRw0xR4hbkBgAHZtgGIAcrqA7ABAbgBAw~CCcQChgBINEUKNEUMPsUOCo
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2736 13 KB
5 KB 45ms
40ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118238
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 1251 783 B
536 B 46ms
42ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f2969032837cdeb35bd6a3f450e64d0f3a8ad658a7301423b831630345c76423

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Lu8ZrkGOA1xeLdQK7UMqHg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-Lu8ZrkGOA1xeLdQK7UMqHg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
expires: Mon, 15 May 2023 06:31:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 44E5 14 KB
15 KB 18ms
16ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54434
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c79569528c47151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame E5CE 0
80 B 52ms
52ms Ping
text/plain 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP5IfqO1AhqZDSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAAxiVTSQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3D15F0D346-D356-B756-186C-BDA544C42A21%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D889302079%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c79569528c67151-YUL
content-length: 0
request-context: appId=cid-v1:1fcf03fc-fba3-4651-852f-a11a7fdec64e

POST
H3 204 csi
csi.gstatic.com/ Frame 3C5C 0
17 B 373ms
372ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqmv&chm=1&c=2913416228924394&ctx=2&qqid=CLns-dTZ9v4CFUENwwod6gUD9w&met.4=fb.8~lb.187~ol.1xj~idt.9k~dt.-ee&met.3=739.188~1032.1fy~738.1xg~749.1xg_3~736.1z3~735.214_1~740.218~113.28m_1~112.28l_2&met.1=1.lhogvoeb~14.0~15.0~16.0~17.0~18.0~19.1~20.1~21.1~22.18x~23.18x&met.7=CCIQBBgBIAkoCTAyOCloCnAyeKwCsAEBuAED~CAIQChgBIAkoCTA5OC9oC3A3eJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIAooCjA2OC1oC3AveNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIKAHKKAHMIMIOGNooQdw7gd4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBINMOKNMOMPkOOCZo1A5w-A54zAKAASCIAQywAQG4AQM~CC8QBxgBINUOKNUOMPsOOCZo1Q5w-g54kAOAAWSIAWuwAQG4AQM~CC8QBxgBINUOKNUOMPgOOCNo1g5w-A54kAOAAWSIAWuwAQG4AQM~CAUQBRgBINsOKNsOMPoPOJ4BaN4OcPgPeNoCgAEuiAHbBLABAbgBAw~CCIQBBgBIMcTKMcTMO8TOChoxxNw7xN4rAKwAQG4AQM~CCcQDRgBIMgTKMgTMPoTODJoyBNw8hN4_1qAAdNYiAG5dbABAbgBAw~CCgQChgBIJEUKJEUML4UOC1omBRwvBR4hbkBgAHZtgGIAcrqA7ABAbgBAw~CCcQChgBILoUKLoUMOYUOCw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 5855 14 KB
15 KB 18ms
18ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54434
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c79569538cf7151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F744 42 B
64 B 37ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst7p3J9MIAg-SovpkUi_-deM3LUWHtfrLuP_71_dMZJRmQfrGy-7ebNEihuUw8FagczMRbD2daK1FO5yPFphm_b2FZgYYGaF7iDnbEK4FcS1ZIju755&sig=Cg0ArKJSzLFrSfD0bXlPEAE&id=lidar2&mcvt=1127&p=215,495,465,745&mtos=1127,1127,1127,1127,1127&tos=1127,0,0,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=2128035842&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132283155&rpt=4540&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 375C 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540919
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame AADA 0
17 B 371ms
370ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvqr1&chm=1&c=2913416228924394&ctx=2&qqid=CMfNk9XZ9v4CFcsSwwodoBAO6Q&met.4=fb.b~lb.wu~ol.1ic~idt.37~dt.-kr&met.3=739.wv~1032.161~738.1i8~749.1i9_3~736.1iw~735.1ls_1~740.1m3_1~113.1up_1~112.1up_1&met.1=1.lhogvowd~14.1~15.0~16.1~17.1~18.1~19.1~20.1~21.1~22.x9~23.x9&met.7=CCIQBBgBIAwoDDA1OCloDXA0eKwCsAEBuAED~CAIQChgBIA0oDTA8OC9oDnA6eJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIA0oDTA2OCloDnAxeNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIP0FKP0FMNYGOFlo_gVwxgZ4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBIO4LKO4LMJQMOCZo7wtwkwx4zAKAASCIAQywAQG4AQM~CC8QBxgBIPALKPALMJcMOCdo8Qtwlwx4kAOAAWSIAWuwAQG4AQM~CC8QBxgBIPALKPALMJMMOCNo8Qtwkgx4kAOAAWSIAWuwAQG4AQM~CAUQBRgBIPcLKPcLML0NOMcBaPkLcL0NeNoCgAEuiAHbBLABAbgBAw~CCIQBBgBIKQPKKQPMM4POCtopg9wzg94rAKwAQG4AQM~CCcQDRgBIKUPKKUPMNIPOC1opw9w0A94_1qAAdNYiAG9dbABAbgBAw~CCgQChgBINUPKNUPMPoPOCZo1g9w-Q94hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 069D 13 KB
5 KB 35ms
34ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118238
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A292 783 B
533 B 46ms
45ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c57a13517fd306d1e712ee617c08d834b3abd196df9eb10d92782b4971f965dc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cMo2QD_CyCNFlJQStqyHBA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-cMo2QD_CyCNFlJQStqyHBA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:28 GMT
expires: Mon, 15 May 2023 06:31:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame 0ABB 0
33 B 60ms
60ms Ping
text/plain 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/625fe2e060223dbab8424f59?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893&container=.creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c.bannerflow.net/scripts/iframe?did=5dc013805badb900016a47c1&preload=off&deeplink=off&a=625fe2e060223dbab8424f59&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Fm5SCbi9pxD_Z5_ceqoCzPwAAACCuxyBA2ef3HqqAsz-alIJuL2nEP0jjFk7jL48FSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAAB7OiUXydgSAAAAAABVU0QAVVNEAKAAWAK_0wAAAAABAQUCAAAAALAABiXzCgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D!xRrfNgj6lN8ZEPv0lLkBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGG4HoXrUbieP2kAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fservedby.flashtalking.com%2Fclick%2F1%2F193398%3B6834967%3B3881893%3B211%3B0%2F%3Fft_impID%3DC756D4B4-7746-044D-FFF9-A78048FB43EB%26gdpr%3D0%26us_privacy%3D!!US_PRIVACY!%26g%3D5613AA407B6DAB%26random%3D476783272%26ft_width%3D160%26ft_height%3D600%26url%3Dhttps%3A%2F%2Fbetway.com%2F%3Fs%3Dbw216804%26a%3DDDR3709386748313959%26utm_medium%3Ddisplay%26utm_source%3DGeniusMedia%26utm_campaign%3D193398%26utm_content%3D6834967%26utm_term%3D3881893
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c79569589067151-YUL
content-length: 0
request-context: appId=cid-v1:1fcf03fc-fba3-4651-852f-a11a7fdec64e

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 5855 14 KB
15 KB 17ms
17ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54434
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c795695f9407151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 114ms
113ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

56cd62615fe8bf152790c9562f47ee3dfdaf7be8f19374d69f9a31486ea98ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:29 GMT
AN-X-Request-Uuid: a6cb8df0-36ef-4fe9-90ed-b4820a55e250
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 549 B
919 B 145ms
95ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: 79ecde8e0daeaacbb2750f1e9b0e2687ac677a211549baf4b7b6dbcf620030c3

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 403

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
410 B 27ms
26ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: 6767ca7226a7e80abffd95761d341887b5cad85238038c4aa603ea972a196d91

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 145ms
144ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 195ms
195ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=182fb5d462f55084&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22amxdt.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22amx*3*8220b2d1-4aec-4d94-9d18-b2fae200417f*df8d05a053203544d26b49db3b030b93%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22xuRgVV9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmMXo1dmw2SXFWRnBKTVoza0VQMkRJZnIzaVJjbllMYVpEeFpYZTdFU0hhODh0SHdGZVc4NEJiSTlkNUMlMkZjbTdS%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=2.4&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:29 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 82ms
82ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 477d0154a34bcb06dac48a887823497bd22799779037417fe55d4e695d9855ca

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 118ms
118ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 83ms
82ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:29 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9149 0
10 B 35ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?_YvObA
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 audio_028.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 34ms
33ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_028.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83ce4980d80c37eb69ac946ecdc04b67a084ee094e0ba236ba841ef4c16eac37

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1125
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BkWCxDfgV3BLdcWqjU2c4bvHVwBclr%2BnKUe67y%2FdmcJZdhqfXJ8f5P1UaT0RXpL%2F4VNqw30JTETShPE7slj65IebzB8USUCCA5Kohfqh5hh3EbcEkLrMfst7G4zHOyEzRfSv9I7vt%2FVFl7tklD5VAHXb"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795696ee135437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40711

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_028.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 107 KB
108 KB 34ms
34ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_028.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa842bcfc610b2d1fe92a3f708b25b8809b858b0c374cd84344d498bfb5643f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1125
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rsD3YA2Ul12GDZLmgooNDCBnl5r2jmMfzwBT3rKXu87fxqFxvos2iG6%2FWnbAO%2BiPI1YzXGtysahfZGO%2BdmMCiOKGCGTgoCHrpI0jNqzTf7Jl8h%2BeOmLXuchv3zRZuEInd%2FyklpwefRt0VsuhTtFfYh5y"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795696ee145437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 109777

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0926 0
0 36ms
35ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=2552196757394378&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 1251 0
0 38ms
37ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=3765900986654356&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D7AB 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=1012378234630347&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H2 200 / Show response
a2.adform.net/Serving/AdMessage/ Frame 9B54 79 B
620 B 19ms
18ms Script
text/javascript 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/Serving/AdMessage/?aid=2045613&tid=11780&tv=1684132289029&icid=7246762434369164995&eid=1587563&rotseqno=2&bnrid=57893923&intid=4387404477288133334&geo=1660,65,124&bn=62821215&gid=0&format=json&callback=adform_com_2jmacawyx5k

Requested by

Host: track.adform.net
URL: https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

ebad416d992ebd9d4c6eaf1084f8574228a3c29dc9c33c3110e1828bd0a4b6b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 189
expires: -1

POST
H2 204 events
bidder.criteo.com/csm/ 0
216 B 24ms
23ms Ping
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:28 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 13 B
294 B 24ms
23ms XHR
application/json 2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?ccpa=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

243fb9953e49b6005f6ae1772f507bb789a8893960a495850afe43fe34030311

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A292 0
0 36ms
36ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=4110113830907893&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 3126 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame E05D 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 2736 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A250 42 B
64 B 39ms
39ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssT5VXMkDxUMivAu3Z_Z12Aq1kgWk5jGyDCHLPhG8rjLv6mxWsw9vnraL6_lrOKvldg4E1B_PhDM0ph6tXsmGdJz4F5gOEwgEQz2Ef-PQ8-FvzusZg_&sig=Cg0ArKJSzKhahxtDnu1WEAE&id=lidar2&mcvt=1058&p=1074,1070,1324,1370&mtos=0,0,1058,1058,1058&tos=0,0,1058,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1442373129&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132285501&rpt=2708&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrainimg.com/loggerServices/ 4 B
371 B 22ms
19ms Fetch
application/json 64.202.112.223
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=ed74607366c018e947d5d6270acd8282&pvId=c62632dad57dd6a33aa5cac54e8c6521&sid=7473619&pid=6420&idx=1001&wId=1515&pad=2&org=0&tm=16734&eT=9&cnsnt=1---&wRV=2010301&pVis=1&lsd=81c43d41-3f25-4c47-b961-3db682ce599a&eIdx=&ccpa=1---&oo=false&ab=0&wl=0
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.223 Chicago, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:29 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: content-range
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 1eea0134035195d474971f6dc4602c61
Content-Length: 4
Expires: 0

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 069D 37 KB
14 KB 39ms
38ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4D4D 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsugn_1D-JRZROBRTe0JPcVvb8anJ56adLcWROsR_WV_R_QGt9IMK4DUDhSD2o737nYXL7ZPjDn7SQbPXrHtGMVkMzncdpopmuWjEFgUlTzxNQ6b3oOi&sig=Cg0ArKJSzLpBPcLEUA4KEAE&id=lidar2&mcvt=1036&p=1074,1070,1324,1370&mtos=0,0,1036,1036,1036&tos=0,0,1036,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=2125634353&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132285737&rpt=2521&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3C5C 42 B
64 B 36ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssawUHHMcE7Q9t_EcDXpYheesV9WbF5QrsC40NohrDLFAW-28iuZ0DyUXnTwaiTUnA2ySnEO0MsCEG3k__gZncQHEblJXTMam6qJ2h1XHZ_JkjkmFTQ&sig=Cg0ArKJSzBaAmdpQkddTEAE&id=lidar2&mcvt=1038&p=1074,1070,1324,1370&mtos=0,0,1038,1038,1038&tos=0,0,1038,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=163791493&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132285763&rpt=2500&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F20C 0
10 B 35ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?05Vi3g
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AADA 42 B
64 B 37ms
37ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvlGtIB-_dBLvx5Ci35arvi4WBh-MH_r3mALl8nqMUJPQjFTaO9FkaRjveiAUpTuccJx3huPYWa7MSsP-6Q5bBI67tUWM0xgtgt_uA3BVEgQH_cbW2Q&sig=Cg0ArKJSzPqQCa-1HE-DEAE&id=lidar2&mcvt=1029&p=1074,1070,1324,1370&mtos=0,0,1029,1029,1029&tos=0,0,1029,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=2671887349&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132286413&rpt=1953&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
a2.adform.net/Serving/AdMessage/ Frame 9B54 78 B
619 B 18ms
18ms Script
text/javascript 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: track.adform.net
URL: https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

f58b0dec8d08531ffc7cc61cf438a00235ff20d47d84e7904323f54cbfc59067

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 188
expires: -1

GET
H3 200 audio_029.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 37ms
36ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_029.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba32a7cfc88a25766e4328241fadec601eb2a5a3bf0dcfe74ce557a338842a44

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1xjU%2Bg9ODB3WB%2FAAlI9iiqFkOXfaFx1etyoTRGA5RmP3lUM%2B5TzjN1Csnh0MZVHU4rc8%2F%2FoIssOZrk%2FrKYDgd0V%2BGM%2FBfawpW4jctnFafMZKnOl52pT9KMbmrnMuuQZRC3FFy3NlSN1GmCodytRpIc8s"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795699a96e5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40758

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_029.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 116 KB
117 KB 34ms
33ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_029.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17ad2ec926020b3deab234cbc8e0f3597e9a6467f2ea1098ea73bbddcb79a9b0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BVGrR6mPetx6I6jOK0xGq433WKmpDs8epiM%2B325KN0bZ1aCXyORJvw%2BqrHtdvcfG41opJmrJriycHdDxp945%2F7vmsVNd%2FVgJd9aKSdtQEGy9sZhsODguxkcco5wonz3AhnPHJrRwJZBGgWZHHiZIdgaY"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c795699c9885437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 119204

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 375C 0
10 B 35ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?JV2f6w
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 PP-logo-on_black.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame A310 5 KB
5 KB 95ms
94ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/PP-logo-on_black.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0ee25041f4984d2f7815cc4f0fc5f9d0b855e49820b8be8e22f8370b484d31ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 29 Jul 2022 10:52:00 GMT
accept-ranges: bytes
etag: W/"4887-1659091920000"
content-length: 4887
content-type: image/png

GET
H2 200 CA_icon.svg
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame A310 3 KB
1 KB 117ms
115ms Image
image/svg+xml 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/CA_icon.svg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e4b8ec317ae97be545c9e2d6383431acd8cf4f0701ef2b23ba7883d6fcc5d1a5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
last-modified: Wed, 26 May 2021 10:54:40 GMT
etag: W/"2800-1622026480000"
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 996

GET
H2 200 bunnys.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame A310 313 KB
314 KB 96ms
95ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/bunnys.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca37b6769e4d1323902b1451ac98b9066f4f5485b5b9f31db556b81603299394

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 03 Feb 2023 12:30:36 GMT
accept-ranges: bytes
etag: W/"320906-1675427436000"
content-length: 320906
content-type: image/png

GET
H2 200 PP-casino_logo_center.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame A310 15 KB
15 KB 322ms
321ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/PP-casino_logo_center.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2eb7f8ef2532607f46c1da6e88d6cacb4345f4b8de5fe4e4e48db9f7ef50067c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 03 Feb 2023 10:21:44 GMT
accept-ranges: bytes
etag: W/"15533-1675419704000"
content-length: 15533
content-type: image/png

GET
H2 200 slot.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame A310 214 KB
215 KB 329ms
328ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/slot.png
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8fbf98f0315741c98c67a48922cbab587e6ea103516e47acf6db16b9b3f69df1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=7903764057768265078&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F8tngRJXSuj8xjXStuCSmPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P3YFx9uIz69tSB0SzhQGQye60WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AZCmxXwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kxaQogiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTYyM0DGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjU2MjM%3D%2Fbn%3D58109%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=7903764057768265078&_cb=1612577226
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Tue, 07 Feb 2023 12:32:32 GMT
accept-ranges: bytes
etag: W/"219633-1675773152000"
content-length: 219633
content-type: image/png

GET
H2 200 PP-logo-on_black.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 6A96 5 KB
5 KB 331ms
330ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/PP-logo-on_black.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0ee25041f4984d2f7815cc4f0fc5f9d0b855e49820b8be8e22f8370b484d31ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 29 Jul 2022 10:52:00 GMT
accept-ranges: bytes
etag: W/"4887-1659091920000"
content-length: 4887
content-type: image/png

GET
H2 200 CA_icon.svg
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 6A96 3 KB
1 KB 319ms
318ms Image
image/svg+xml 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/CA_icon.svg
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e4b8ec317ae97be545c9e2d6383431acd8cf4f0701ef2b23ba7883d6fcc5d1a5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
last-modified: Wed, 26 May 2021 10:54:40 GMT
etag: W/"2800-1622026480000"
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 996

GET
H2 200 bunnys.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 6A96 313 KB
314 KB 332ms
331ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/bunnys.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca37b6769e4d1323902b1451ac98b9066f4f5485b5b9f31db556b81603299394

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 03 Feb 2023 12:30:36 GMT
accept-ranges: bytes
etag: W/"320906-1675427436000"
content-length: 320906
content-type: image/png

GET
H2 200 PP-casino_logo_center.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 6A96 15 KB
15 KB 324ms
323ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/PP-casino_logo_center.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2eb7f8ef2532607f46c1da6e88d6cacb4345f4b8de5fe4e4e48db9f7ef50067c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 03 Feb 2023 10:21:44 GMT
accept-ranges: bytes
etag: W/"15533-1675419704000"
content-length: 15533
content-type: image/png

GET
H2 200 slot.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 6A96 214 KB
215 KB 320ms
319ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/slot.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8fbf98f0315741c98c67a48922cbab587e6ea103516e47acf6db16b9b3f69df1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=6070106940761623787&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P-vMuhAaWj1USB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4AxyYUPgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21kBa4oQiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NTA4MEDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjUwODA%3D%2Fbn%3D89887%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=6070106940761623787&_cb=10830290
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Tue, 07 Feb 2023 12:32:32 GMT
accept-ranges: bytes
etag: W/"219633-1675773152000"
content-length: 219633
content-type: image/png

GET
DATA 200
OK truncated
/ Frame A310 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame 6A96 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 PP-logo-on_black.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 1FF6 5 KB
5 KB 37ms
35ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/PP-logo-on_black.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0ee25041f4984d2f7815cc4f0fc5f9d0b855e49820b8be8e22f8370b484d31ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 29 Jul 2022 10:52:00 GMT
accept-ranges: bytes
etag: W/"4887-1659091920000"
content-length: 4887
content-type: image/png

GET
H2 200 CA_icon.svg
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 1FF6 3 KB
1 KB 100ms
98ms Image
image/svg+xml 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/CA_icon.svg
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e4b8ec317ae97be545c9e2d6383431acd8cf4f0701ef2b23ba7883d6fcc5d1a5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
last-modified: Wed, 26 May 2021 10:54:40 GMT
etag: W/"2800-1622026480000"
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 996

GET
H2 200 bunnys.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 1FF6 313 KB
314 KB 36ms
34ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/bunnys.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca37b6769e4d1323902b1451ac98b9066f4f5485b5b9f31db556b81603299394

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 03 Feb 2023 12:30:36 GMT
accept-ranges: bytes
etag: W/"320906-1675427436000"
content-length: 320906
content-type: image/png

GET
H2 200 PP-casino_logo_center.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 1FF6 15 KB
15 KB 100ms
99ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/PP-casino_logo_center.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2eb7f8ef2532607f46c1da6e88d6cacb4345f4b8de5fe4e4e48db9f7ef50067c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
last-modified: Fri, 03 Feb 2023 10:21:44 GMT
accept-ranges: bytes
etag: W/"15533-1675419704000"
content-length: 15533
content-type: image/png

GET
H2 200 slot.png
ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/ Frame 1FF6 214 KB
215 KB 329ms
328ms Image
image/png 72.247.68.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.connextra.com/resources/PowerPlay/2023/Web_CAS_ACQ_CA_ROC_Casino_Apr2023/slot.png
Requested by: Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.68.185 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-68-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8fbf98f0315741c98c67a48922cbab587e6ea103516e47acf6db16b9b3f69df1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssl.connextra.com/servlet/controller?service=DDM_CAS_ACQ_CA_ROC_CasinoApr2023_300x250&pubhost=swiftmoves.blog&apnauc=8720478740126647032&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEyLqBSOBuj--xx63e-GlPwAAACCF69E_rXnmVCI7pj_owd1Zu-26P_hCmAg2XQV5SB0SzhQGQye70WFkAAAAAGOToAFRDAAAmBwAAAIAAADp2cMZ_NMaAAAAAABVU0QAVVNEACwB-gBM5gAAAAABAQUCAAAAAJ4ALCaACQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21mBbuowiO-94aEOmzj84BGPynayAAKAAx2_l-arx07z86CU5ZTTI6NjE5NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjYxOTU%3D%2Fbn%3D97885%2Fclickenc%3D&client=PowerPlay&dspid=3bc1d7fd2e&placement=DDM_CAS_ACQ_CA_ROC_300x250&bidid=8720478740126647032&_cb=1847144721
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
last-modified: Tue, 07 Feb 2023 12:32:32 GMT
accept-ranges: bytes
etag: W/"219633-1675773152000"
content-length: 219633
content-type: image/png

GET
DATA 200
OK truncated
/ Frame 1FF6 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 / Show response
a2.adform.net/Serving/AdMessage/ Frame 9B54 78 B
619 B 20ms
20ms Script
text/javascript 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: track.adform.net
URL: https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

1ae353028f3cf664ddb7bd15378ac12e5b6af17b7ed1225c48ad53d2bf9d9773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 188
expires: -1

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3126 0
10 B 35ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?qTO53w
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E05D 0
10 B 35ms
35ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?jiK5TA
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 2736 0
10 B 35ms
35ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?FdM-rw
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 audio_030.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 33ms
33ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_030.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c2e7dafb0ca3651ae4f6114463131f4292f48f70b9d6c4f5817e6940add1185

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1123
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nC2ynnx6WG6iE%2FrjhPqQ%2B2iyEEGVzay96h%2FdslmCNfwhgrBwouv2%2BTdMUB7jgV0zysO1OeW87%2F8HMKbhajqd%2FuEDdy2lbm%2Bcv0F%2BxOrr15tRB1wI1D%2FQwgzQU9f%2BiRNSWKkB%2BE%2BfbgDKsLL%2F7qHKNC%2FB"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79569c1c5b5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40730

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 069D 0
10 B 34ms
34ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?jya2Rg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:29 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A31A 0
0 41ms
40ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=2927364914404732&bg=!2tml2Y3NAAYldGN0BXQ7ADkAdvg8WmXzAxRORZqRNSesn91FDbkAy_XIB6Mk14UVw9k8ml7rSNwpl2lXOWsZZTCSE7M6dN2sLokCAAADglIAAAADaAEHmQLPyTifrdOCrKVqQPeO7oWzY4UbLjXMq4rpEgmkw08rHS-UwOSTjTYsbwztewGkdn5k7r2UfkoaInL16OQQubztxiE7FBJC5ltvDXDQ1lGvrKrNrgjOc1SfvOIrzQidVWs2B3mZ5DulKBMGQhVg9c1Qaw2FMnjuALMB4pqUw5spKJ-mAATqqjiWEN8ZYj8SCvoWUFTQB6LUouLRNv5K-vojAF-PZz5BdgCKRRzneW7kwTA7fTO8fwDAqi7ktoM9110KgFmyc-WXffnhCZo4QgKZ76t9f-jOhmuwfWUG2aEasszGL45pxYMceB1tbUcXvm_mNdltMVut-l2Qkj--C_E76IpJnzBckdDqCE8ejUCKh0SNYmRyP1f3F-b_5DdCet0Q_6v6L1jdY1QLovghRQUmmcwJ4RWewOQZaBsXtBSobvCJwLk6BqV7RLEHZVSVf-fdbPwaTSrILH9Ljse2RWzasaxJ4D3EZQuMOUmzS_D_fLhk4YkW4Vf7buoAjsJ1pLi3SWbkoN3BeNq6R6fbzcq4EZyx5DAzAuNSwWMoqOLr7QpID4DQ7VfWJ6nS-ApCHyTgczJX418XhMfKy3t-zs9QIz1O3WtMTe_xP-OPZWydfkAMAqEOhCmZfQ2sZVLREDyV2G9X9cZbu_UEqsar45K09jPVYxkSqKRPzUEI_StMSOtTuz3NB7SOHpfot_bJmjN_AG52cyUpXLG7anVPC_jGuW0bI5eTv_po-mwIub1-LCXuJ2QhwGV6gYbKAhYU2ODTSo6RvXVwR2vvrLk0lMjjNTn036AW4ifNPm5a1ifSQ3dJtoSrFZQ4o7NTDRn2w7cpbfPO07OgIMwphLoVREL9Yo3Pj_D7HoFh9RMQtKT8hNs-InV9ljsHascubD5PbH4OurJtpj64KQ_JKHhJkqobD2Z2p8lhBybYty9mXpaPv7G2ZzF2rN4NxyhI4_ZPtoM
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_030.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 93 KB
94 KB 32ms
32ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_030.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f1a2bf8b8a1b803456d175683bfbc32d6de3ba1eb6a3c3f83a06ecb3533acf1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
cf-cache-status: HIT
last-modified: Mon, 15 May 2023 06:12:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MeJ5QzkXaZhpDG5ppKR8eb0vinI51EoBHoyKzTOtt9YowYUMyGb%2Fy6sl8ssRcWrcGrB8%2BbKAlMo7h3VHONKlqKJnlwoHcNnkazbzBccSJmzBGizsIhXFzs2XB9HXaW2x%2Be549nwcACMNGE2ArDkiK8qA"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 7c79569cfd795437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 95636

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
573 B 196ms
196ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=6&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A240%2C%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

4e9e2cfb10973d31ac2c6b159576a9bba6a48660b74c91ab69edfee17bea7f19

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: 774PMQ3KFPWH396MMCCD
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: n9AynzTLndOqQ3zd-wL0UiJj73jYzTA-Xb46gtYcwjUSYWacqag32g==

GET
H2 200 / Show response
a2.adform.net/Serving/AdMessage/ Frame 9B54 78 B
618 B 19ms
18ms Script
text/javascript 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: track.adform.net
URL: https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8f47c1beca2f655fe188c2754ddf4a339ccc49877944e9b2112041920cdb5f56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 187
expires: -1

GET
H2 200 640ee9c6c56577c34d0ea77e Show response
c.bannerflow.net/a/ Frame 9B54 69 KB
23 KB 98ms
97ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/640ee9c6c56577c34d0ea77e?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fa2.adform.net%2FC%2F%3Fbn%3D62821215%3Badfibeg%3D0%3Bcdata%3DtftV_F5BQ-dP-Q9btp-KMBkgfPGMvFsYhZF8eTZNnJ1IrJmc_5nieB5VTS12_oEjtRXzUs-85g5uj10HEyeiY7zqFv8uzqcuCQ8Cld2Xq9y4KV5dayWqGv2CYwQXW3dgGR9pr0W0xlRosoRludXK-Q2%3B%3BCREFURL%3Dhttps%253a%252f%252fswiftmoves.blog%252f%3BC%3D1&container=creative
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 369f93bfc71ee91a19dd987caff6a4c327303b134072dbebe461f69e3c46c82a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 15 May 2023 06:31:30 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, s-maxage=10
cf-ray: 7c79569dce9c7151-YUL
request-context: appId=cid-v1:1a5f66bd-0229-467a-a946-b3753e659ecb

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 1041 0
0 39ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=4376816124959109&bg=!6Oul67_NAAYldGN0BXQ7ADkAdvg8WtWIrmzFogE9wemAM9ROXxMG2nmCBSEqMRuGNl9TS_bk_Hr49VtphR_axd1SkU1gdoPrdYUCAAACrFIAAAADaAEHmQLEzXTxp4jnXmo5YRW056Jo04r75y49fZOC0vLV3orAKvq7Te8Ezz2MTfsoFjYd8qxyrk9EZ6sqhXpfqQchI6zsA9aSUh655WTCJb7pMLxwdtJ7FLjs5hcUWFYPz8PUafZB2dlpCphCifp7-6ilRmLSwb2cG_K6MIQwTnM24DCvzk55KpIjkWyJeazvBY9z7IhL-lb_hVUK7sEuZe8UElVYbqlHkty6eCo4VITeiVAFbW21KnrJLscZiH5QuBCTxb9J6TfiEDSByk01uRn3ZpIJe-ogcZD7BQKgR9UiXvk69ehWkP2L4DCdIMKwmd3TlgP3OFOJIlb4T405wzo1JPAytbQal45RxgSFi_xOw5E7SY3yrsiOmIQUF9nP3J82_FFB9cqNH9XitaI1N5jZe82bfmM8_SmUnNvgODk4pbl1_U0N2vbzYsfW14Zn8vM3IMfkKWdayXU6nLh7NRxF9HVuW-SfgOz1wB9A_0iWyMQ0laIF5hEMdwT9U2kboYB_oULb6af9o13eEp8Mxqlvxytr_mqnmXy52zCt16HUGcfybZI0eqId3loRMzSjmKUbkZkKe8PZ0WgJCH0izERezM__z8HpIAfWGnICsVsF8nfyj_wLOYlXahF-ugKhq6tcFilHFoOJ72EW34KFcygq1I8HfDPJM6Qkcae2dQ0AZKm2D-6UabWBSTGLHyGTXPMPvLa88i5b0O-_GLOTGCsajHyS-ITUXo1rTma-p1h_4Me_t_Kh_jYHAIWiNUNrE0w7-pqezo5fOdF-26AQ9xSIUODI7rWizPzTZSVewUXv7xuGCGD1I-W4BxkV_VfKggveBpk5kj88DsFCmPeYQyjz9TLxiIU4oE6tvLRb4p5KIkXJw8R_R6F0RbHuJGK2aahA8bPLzFFqJOASt6vlhSgytzC09W5mhZoMYwiDoyp563xEhw_2WsxS
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

POST
H2 200 /
a2.adform.net/serving/unload/ Frame F744 35 B
583 B 20ms
19ms Ping
image/gif 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/serving/unload/?version=15&unload=7246762434369164995@@62821215,4387404477288133334,100|1023|0|0|0|0|0|0|0||33|0|||||1|0|0|Dhkz-VeF4bnxBx_RTJEBJ_LJXReq182Q_blYGSeCeSHrhzgFI7kTX_L_QlhaeLlf0|||11|0|0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H3 200 audio_031.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 185ms
184ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_031.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 095558d93b2805d1b33dd936ab3ca4772e54cd94795bb29d47efdce504280ba1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "0604d415836041c0532e7ae07b1ae72c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QTbhZF25nDiprgimaiPKaZvuX7rNhv0%2FQCNxSTLR69ZFKGhpIg4HugY70truYuy2RBbg6dEhbW66tPXyzi6HPpiYJT1kKsyvfdgCmCrZUKXFTuzx7YZbdghTJ8rbxwWt963wIrhYjjpl89dSI5f9mYdx"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c79569e3f775437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40062

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_031.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 120 KB
120 KB 137ms
136ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_031.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 722f6e4cc631cd71a481889cf980b3a716f3ad58a494933cc936a75292262e28

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c17cd0deb1ecf6b2ea5089ed883efda0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C3yPiNwgVS98FMubHoBAlDamp3qF896ZBZbDUAvGUma27nNzQ7iczuEPaDDhq2p4hIeScmewm5ohOhRbLNQ6JxBqTxMnRqGVoSN8l4rcicNXfrsiGACPzDn49Ht4ZsWflMYogVQQgQbN9IZxGP%2BduwBF"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c79569e5f9e5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 122455

GET
H2 200 widget.39104390a01e91d27733.js Show response
c.bannerflow.net/scripts/ Frame 9B54 20 KB
8 KB 18ms
16ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.39104390a01e91d27733.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/640ee9c6c56577c34d0ea77e?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fa2.adform.net%2FC%2F%3Fbn%3D62821215%3Badfibeg%3D0%3Bcdata%3DtftV_F5BQ-dP-Q9btp-KMBkgfPGMvFsYhZF8eTZNnJ1IrJmc_5nieB5VTS12_oEjtRXzUs-85g5uj10HEyeiY7zqFv8uzqcuCQ8Cld2Xq9y4KV5dayWqGv2CYwQXW3dgGR9pr0W0xlRosoRludXK-Q2%3B%3BCREFURL%3Dhttps%253a%252f%252fswiftmoves.blog%252f%3BC%3D1&container=creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a7adf72f8f565f064dda54867e552b143fc4937d0aa63f0922b6d56f4c4e779

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: O7VtlqMSOJoIdomfX4VHRQ==
age: 6985289
cf-polished: origSize=20108
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 23 Feb 2023 09:08:41 GMT
server: cloudflare
etag: W/"0x8DB157D8F0E7438"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f553edb8-301e-0056-316e-471cc9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79569e7f167151-YUL

GET
H2 200 document.0000007C923CA7.js Show response
c.bannerflow.net/accounts/rootz/5c384d1e07abf6aaa88c66d3/published/3798091/4681764/ Frame 9B54 89 KB
24 KB 19ms
18ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/rootz/5c384d1e07abf6aaa88c66d3/published/3798091/4681764/document.0000007C923CA7.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/640ee9c6c56577c34d0ea77e?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fa2.adform.net%2FC%2F%3Fbn%3D62821215%3Badfibeg%3D0%3Bcdata%3DtftV_F5BQ-dP-Q9btp-KMBkgfPGMvFsYhZF8eTZNnJ1IrJmc_5nieB5VTS12_oEjtRXzUs-85g5uj10HEyeiY7zqFv8uzqcuCQ8Cld2Xq9y4KV5dayWqGv2CYwQXW3dgGR9pr0W0xlRosoRludXK-Q2%3B%3BCREFURL%3Dhttps%253a%252f%252fswiftmoves.blog%252f%3BC%3D1&container=creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83e98cd6f7abd7726c68acf0fea7f0f7a64c82ba278d85959a51df8610507192

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 8CAuEPowkKL+8g1CSCu9hA==
age: 6464966
cf-polished: origSize=92954
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 01 Mar 2023 10:40:21 GMT
server: cloudflare
etag: W/"0x8DB1A415BA76A42"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 78e6ca9b-a01e-0026-612a-4ca53e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79569e7f187151-YUL

GET
H2 200 animated-creative.e50c568fed324f15addf.js Show response
c.bannerflow.net/scripts/ Frame 9B54 156 KB
53 KB 23ms
22ms Script
application/javascript 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.e50c568fed324f15addf.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/640ee9c6c56577c34d0ea77e?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fa2.adform.net%2FC%2F%3Fbn%3D62821215%3Badfibeg%3D0%3Bcdata%3DtftV_F5BQ-dP-Q9btp-KMBkgfPGMvFsYhZF8eTZNnJ1IrJmc_5nieB5VTS12_oEjtRXzUs-85g5uj10HEyeiY7zqFv8uzqcuCQ8Cld2Xq9y4KV5dayWqGv2CYwQXW3dgGR9pr0W0xlRosoRludXK-Q2%3B%3BCREFURL%3Dhttps%253a%252f%252fswiftmoves.blog%252f%3BC%3D1&container=creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c6593751538e1f57cb7143a3d7633a6a95ef64f4af6262994d9f351dae76b7d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: LfCpjr2/LQ/nYMw1ycxj6A==
age: 6896525
cf-polished: origSize=159302
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Thu, 23 Feb 2023 17:08:40 GMT
server: cloudflare
etag: W/"0x8DB15C09CA10DE4"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 580845c5-801e-006c-102e-4806b1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 7c79569e7f197151-YUL

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 39ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 34ms
33ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
142 B 292ms
291ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=2320137887434351&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3D8de2c8ca79e8623e3cb37120a35ebaa2%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132290383&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=ve4_td18_tt17_pd18_la18000_er0.0.0.0_vi0.0.1200.1600_vp0_ts2_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D43C 0
0 38ms
37ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=2779369445405892&bg=!19Sl1IDNAAYldGN0BXQ7ADkAdvg8WivRe-Np_Xylwfea_mNaW8afdO9SATBg9FPbuG0bYSqWVKxIZL-y7P6YYObGr6jnPMx7s-wCAAACZFIAAAADaAEHmQLWWvqCioySpnIzIpIe9hinI0nW69yEMu9BZ6vzULYfpdftJ_c0lBpVlUsDwbGqN4OAlWc7G1doMG0GtuXOZHGgWAfOAm5l__DWpzSNMy6-6rn_JrPI-0wC0a5DuDkgNKhcXYT5MRE0cDxRsTTXwcMba1v7TkD0wbloeHcg24T8vyqXG9u-d5wT3bHmYirQCaO-n4lVD1ee7OZbxxgQnpfHAaxCtDIGaDgstuB-tAUpfgjxz59NESEOL3TCj_d64yuYUWSg2BfaZs2NRW99wb7F2sdMj84xycGZIKT4TaJB8FOSTs7ocKoLKrmHDvMGcGpUirHA124wRVLNXSkQZhnqawFtjlxzdZ-HhAzqRy1prqexivkafGTOTazot38-hRSenlWK5HK0E4difdaL-67Siz1zifmgbSr96-C0akhHgd5i1Q8rlPACk-TbhcJ8KD7EMvN8iX818FPgg5uA-V9ExJnDU2cya8Yjq-Wemrg_RhjC8LX71Q2ZK33o2qAHL2FjSnZknjK1L_o079tu67dnK0P2mIvZ9N2f13WkBaaFk-YMrb2lfEIhDsZrA24_q3uj1giZodtfyMG4Lu3NmALnbya7hqrj7HCDskUMlNPyGycf38wKSUT5VlDPChNe2606sjQ55wjB03t6CmAtVaMmeVGPDuWPFvtEA9NiGd0T07S6aLrIRS1jFyzZVx_W8Eg56m294KlszIdlokr3CGrZ7gfYoZPItvByZROMeZl_oRwlMvuWkyztwsmsAeHJEFNoK0D4yEIbQV5yxql4h8NBLnHy0OfdUfeP28aLHBw2Jp32eHVmH-P9GcnBXe8ah8E4QsZDu3f1eWwVkqLYG_WUdD0WTNam7jR_H1Q_BCJdehTzc19QqGXARlaYSN4IOFiZ2vl3-zoZmdeSUnwV9ityKlPlR4ega09Xl7jV_aMdspvK1Wb6rv4LZEskjw8hjdKXyfdflSrT
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 9B54 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 0e1a5963-2929-4302-994f-15873b3501ac Show response
https://swiftmoves.blog/ Frame D69F 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://swiftmoves.blog/0e1a5963-2929-4302-994f-15873b3501ac
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.e50c568fed324f15addf.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 668
Content-Type

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 9B54 4 KB
4 KB 40ms
17ms Font
font/woff 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F9b56d1b2-d7e6-4ffb-a6a0-87047cea7d2d.woff&t=%20%2B.%2F012589%3AABCGLMNOPRabcdefgilmnoprstvyz
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ccd73ceba6c34274463e2085e1d5e8218cd84a0414509f20a2d5cc5eb22391c0

Request headers

Referer: https://swiftmoves.blog/
Origin: https://swiftmoves.blog
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
cf-cache-status: HIT
last-modified: Fri, 28 Oct 2022 10:56:26 GMT
server: cloudflare
age: 9506408
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=9b56d1b2-d7e6-4ffb-a6a0-87047cea7d2d-subset.woff
cf-ray: 7c7956a02fbf7136-YUL
expires: Sat, 28 Oct 2023 10:56:26 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 9B54 3 KB
3 KB 17ms
17ms Font
font/woff 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F5c384d1e07abf6aaa88c66d3%2F7edd4df8-d81d-4d59-9683-8e26458e6e47.woff&t=%20EGMORT
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d09ac371d5c29d06f61d45f168c4030f7e130d58308380b878540ee38fcbf3ca

Request headers

Referer: https://swiftmoves.blog/
Origin: https://swiftmoves.blog
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
cf-cache-status: HIT
last-modified: Sat, 31 Dec 2022 23:00:03 GMT
server: cloudflare
age: 11604687
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=7edd4df8-d81d-4d59-9683-8e26458e6e47-subset.woff
cf-ray: 7c7956a078027136-YUL
expires: Sun, 31 Dec 2023 23:00:03 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4D4D 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=2552196757394378&bg=!VFelVwPNAAYldGN0BXQ7ADkAdvg8Wu7ZmlEB_EdUPIXkr5th64sz2vaX0k7wICg1hqUaEbwZ1fa8dO5FS9IEhTvWkETd3S1ctikCAAACIFIAAAACaAEHCgACrrGZAsuAtx767L3JeEEGh9OrfxXsRoHCo4A_WUvPHQfS6CoAzvKnRMe5sW-Rl9ldzZNWbN0KnOInR7AeyB-Gza7X9NUSvvvdcBi8JZBRq34oaqxCq6rQf6jw2aWaRU22dFrZ9787vj3DV8s3gbLkf1IBaKRkxZr-IDxcIAVg6jn72D8lYhFaRj5luQoryg5_lAQpSu4S2sCv7vQ_6SRHyFt-OWCaHKs-x9qODFuUE9tXzGQJXu8W6i26AyfEGoskEUyhiX_HLg7CwsgRcBBsqwtwi7tbhGxZvI6Mg-LTnRXtI5cgUh723-tr4Pmga7lsBe-sGfayk4oErs883wLgbnMs-sYFj2IMnWvLJxZo8jWztWPm1XmEi2JAU3DOl2ge2LnZWRfS39uS5Ew4FjcuCMJ6u05BTa1Be6NC0iRZSTyIttKhOElQEMeWMXpQ2Etxnxh8cATjDiPx_sCvRo3pRAZutjQoTs9vXy7tE_yAK2ht97Pmk6M7iyEgV_3ocxzWNAuTQlExgy-BLwxNvNwqGriB2FEtfkPKbr6kEbrOqbxfrR6GV3q_fLfwZrnAF_EKctFDG5EU7H6XnfvIy_sjce2hiaR2jhrFtlRjZQ37NaEkmu9dS6RVFuMOJDDrFGEvAVHOmjJMJoOsAr3xaR80BpkkYIrQre26XiGA28eP2giHOHUfbUwLvmPkeyfMcO6RHHQz58BoLoHPTqI6kMKR314PGQL1in7Ea6jBvP3EZtQ4cI9cT90lsTteqoy2jyiLqv5P1NtpkMdWLp76vsZVdjFIxi7gRKP1iMp5mgNvOrvHDJUkBlO3MRd2ESeSdKqMi2G9zhyjyA0IRuRfIR8g-oIQE-SHtLPsewuhO6EcBAQr-0F94LqJMTbCZOaOP15xEI7Tl7tRKpC-ETfNeDpbq_LslmEYynpenEbsFnJn_jDTCBOgaqjausvhicFHaeJK
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3C5C 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=1012378234630347&bg=!VValVgLNAAYldGN0BXQ7ADkAdvg8WqcZkkeiK_sXf5RdeenwOSipJLzr2aUNmxBhL8UT484cNaSMOHHuaEQuHCtoHhIWy_lHkHkCAAACFFIAAAADaAEHCgB6S4X5dssaKB0sH5oSQTfDqGFAhk2LVlLvWEIO5VQtXpdjen-kitoT18YjYPYDhs8p1RIIu5pBBGu2XmcGoYfaVVgqAPfNXh5QTQDWGFumKwmy3KpXEO-1OiK3xG8vQ8ILE_D0pv3aht_gySoD2iKQFiZ9wyMZ6_h9-puZAt7AVsmwqC7zGHWH2VNBefv-PZVk47gzxdlP-cVjEwPWPuTovjwf-2xM7M-G8UnVB8Rq38j00AzTbec1MwdPo4qbP2q_uY2Owdvf5nLdMo92ofaGoo9-nTyYfnu-_1zLpt4GED52ocPb8sESiWbsF-YXSHcsipbC2SLvBsR35BzbdXjCuLcrNpz8C19eTuFuJPuuw8w9E7bA88OPOjl9W9A6SyoHlR5LEPqvlcf1dtPwc3ABcnxpTm-9yUizWvoqzkHmvP2cCdVf_EvfrA-gFAegFRYENoa5-rsJAlAQoVWHzy150Xaia7tYz3JZ7k3W5f8LDpZjdgIlfnHp4hP3iUk_NvRg0mrBQ7NkWYbLsTZ85RyriUX3ETNtxAwM9gsPwYKJ-Cg_4GmubALMQtp60RxqaMTqk9CwMeScV5izkfXHAqBPEUCu98GVcwgFQOeyxpOPZV_67ve-Oj7jhwsVs-4zzQCT1jtll00WqtHj7qDctuG-jKSGWRuMWfEvjccBam53IgwscyxdAc5yfwB2svMzONqZ01DxmgPuli-M-c5ao09fpxDex5LFlu58YzupMznpPaJk9f3J-U5jABxqRBy_f95fYtbRgmQVaElKn48vcQSVyfRjW5Hovr7zHE5R6bgjQ5ugO8iOObdlwBlP0_CEKh62SUmeh1gJw8hZckOinxMSZLczn3KaeRSDzZor4vk5ce4aksP0xX3HcmaRizTlivSTINCKT2IuuUjU7-PS3UGjnWw5f6IthajQVRGtAhIuVle2EpgdSR_gi1vgIrueAyC-tSd1YF17PQ__nso6le4Qby4E_X0zRLQMRk1GHrC8CCr8BN-4fxJvk8tc3LnCBAHxOMnxZkBDeu7fFoNPKpLVJspZ3_xbxBGamyQvtUylRTAGNDpkf_IpiPn4rY8Pzxs3HJlcXn6vUgQgSnSkpXhv3uLF2mopgiQsDTJhfXmo6PcVCvFm3AkX64SNpg
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A250 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=3765900986654356&bg=!39yl3IjNAAYldGN0BXQ7ADkAdvg8WuHpk6C7QQiObAAAr2DlNSZIe3liNqsJFR2MgnCrIxgBmDD8R-M7fsQaaD5tQkDKdNJR-HkCAAACJlIAAAAEaAEHmQLKjMMjYZdvxOSBjGdKfdkupID_RVhCNnbosnYSaZOMEJhlMhuPdComtBV87gO9NHpVQhqP40sqhajQ7b_Zr-SRpuXyVIA3ByAb8flWCbVG8sGCdT1mHY4XJFEAbOIqkAEP-z7Xwtdav9Vc5qR1NYz16aj-MjVQg6VI4cNc9hurS7xW5MhtKVXVBP7Q2ByOUPHKTY8Vz1f7sOMVS0njFLrpZWUz0Kqo6P3VyWrAUwGqf9OuT6FwG0wqCjhjREcg9li-2haAP4VlEPKlWGcOgthKfWxbmbHTU3K_xlKrvv_XMkc0P3KbXczJDhXJFP3o5GviJlPAr5eINY069Ezzal86_B4w1Fp03aZj8m1HxRaSj4Su7r56ojzmZmBI9nYDNDO2FKO967CnmFj7ENSfO2M9CsjXVypNAvhKfLp9_13FTTXGZ5TdCYsWvieMcTo4mcEm4OLURBSuo4OV-HK9LB64x5f7MrwZtSQWrKKDPMQLExurWwfKiz0wVHltBFetBtB_stObjLl3ioXWqwHtM8K7sWt-5oJdxMVVOgZZqPXsN_QbPgywRQ7dmX5l4ASKwbYo3-TtxAJVWXAPDSU3J6UHC3_MVze5Cjl-1sZmtaUsiXwebiqD6KB_OCN_jaoHXNm0GHKXVGqCDajlxPQ9WmE82Yc2L5Lz6NO7aOEPsXplUjZJk6-noRGoEThe763tPoXMiBQTacSWd4ym2HA1AF4fWfKZ6A3PkNazJM_tbwhS5nb5q7aTxpW9_dGzYgr4PHSjWMVeI4o3hPkKI6pUbGRB6ZToqQISElg5xwyyq6iV0KDVZ1u7_GJuxe_MmYOqffscEmeEYPv18v8VkW6GTeKhcaY6wPfDJNFn7QAsyY-ZRXP1QwRxj0mBnZvfkO5NV7T__58qlAGEw3mXXqFaaSf3tva3UqcI_ThAmQjFRAdC9v1vMjlTCgc-SNhl
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame A88A 7 KB
7 KB 17ms
17ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Frootz%2F5c384d1e07abf6aaa88c66d3%2Fimages%2Fe6b00c2d-4998-4749-8286-f2d892e49ce9.png&w=181&h=150&q=85&f=webp&rt=contain
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee70e2a86471f53741f9fb42ef81bddb4d31609419c8a1f64d9c0ede88ed4fd6

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 00:41:25 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54034
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c7956a0e9357151-YUL
content-length: 7066
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 85ms
84ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

68c50a1585b618a30d86f638292c19e2669ae95b8b819ee582e3429d2ab94b54

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:30 GMT
AN-X-Request-Uuid: c48508aa-f234-43c3-973c-2b03b30b1c49
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK v1 Show response
btlr.sharethrough.com/universal/ 369 B
791 B 86ms
86ms XHR
application/json 18.207.17.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.207.17.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-17-231.compute-1.amazonaws.com
Software: /
Resource Hash: 16989499637738abf4e40594bbac9225c65306747f1c429eafa39345bf5a9f1f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: gzip
x-openrtb-version: 2.5
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 275

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 105 B
410 B 27ms
27ms XHR
application/json 54.146.52.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.146.52.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-52-142.compute-1.amazonaws.com
Software: /
Resource Hash: 745d3f6278242eac379b3246f317b6edcf779c4eba66820154e3ab480bd6dfa1

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
content-type: application/json
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebidvideo Show response
ads.yieldmo.com/exchange/ 0
317 B 80ms
79ms XHR
text/plain 35.172.39.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.yieldmo.com/exchange/prebidvideo
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.39.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-39-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:30 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
211 B 203ms
203ms XHR
text/plain 3.124.231.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=29831&adtype=video&auc=ez-3998%24f28b061c83bc46215f01164d8540fe3cd8050204b2b714ff2ba12ed1f7e5b22b%240%24swiftmoves_blog-preroll-1&w=640&h=480&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36&l=en&dt=1&pid=62295&requestId=198bf061ee0ebf6e&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&eids=%5B%7B%22source%22%3A%22amxdt.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22amx*3*8220b2d1-4aec-4d94-9d18-b2fae200417f*df8d05a053203544d26b49db3b030b93%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22criteo.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22xuRgVV9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmMXo1dmw2SXFWRnBKTVoza0VQMkRJZnIzaVJjbllMYVpEeFpYZTdFU0hhODh0SHdGZVc4NEJiSTlkNUMlMkZjbTdS%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22audigent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22ID5*HxOdqa2WADWFfEATWKynViAZEBKHiNYpOBw6xNt3DkZJ2b88XBGMV-xhM8oNwxl-SdqPJZ2m_KCGxD0hrODSkA%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22crwdcntrl.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22quantcast.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22P0-637578525-1684132272823%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c6513184-5dd8-4f62-9bd9-8388c6e67d8b%22%2C%22atype%22%3A1%7D%5D%7D%5D&bidfloor=0&d=swiftmoves.blog&sp=https%253A%252F%252Fswiftmoves.blog%252F&usp=1---&coppa=false&videoContext=instream
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.231.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-231-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:30 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 135ms
135ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: a1f13d533db8d0f409cd1ee7da81be825aa4c9bcfb577fb367a43e7989ce6ab2

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 156ms
155ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
60 B 91ms
90ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-0-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:30 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 206 Wildz%20Granny%20Dancing%20GIF%20(online-video-cutter.com)%20(1)-89d74aab868947dbbc90ee477867a2bb.mp4
c.bannerflow.net/bf-videos/5c384ca82011d069d42bc437/ Frame 0418 694 KB
696 KB 17ms
17ms Media
video/mp4 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/bf-videos/5c384ca82011d069d42bc437/Wildz%20Granny%20Dancing%20GIF%20(online-video-cutter.com)%20(1)-89d74aab868947dbbc90ee477867a2bb.mp4
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72c78228651829247eb4ef7f644ea69b9d131a8bb882fed729c193f9ba537449

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Range: bytes=0-

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 15 May 2023 06:31:30 GMT
cf-cache-status: HIT
content-md5: 3E1w7rwU4P2TEU1EG5A4Jg==
age: 2538
x-ms-server-encrypted: true
Content-Range: bytes 0-710978/710979
Content-Length: 710979
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-creation-time: Wed, 21 Dec 2022 13:38:24 GMT
last-modified: Wed, 21 Dec 2022 13:38:24 GMT
server: cloudflare
etag: "0x8DAE358A2394B1A"
vary: Accept-Encoding
content-type: video/mp4
access-control-allow-origin: *
x-ms-request-id: d24b17d2-801e-005e-3508-22aab7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-creation-time,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,x-ms-server-encrypted,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2020-06-12
cf-ray: 7c7956a199c57151-YUL

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame AADA 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=4110113830907893&bg=!u7iluOzNAAYldGN0BXQ7ADkAdvg8WrRg_mJ0baoZOCC3vGM96EVOa8G94UNkTqBPzrFFcyaWp-xSxFr47gd2_dUKuDIXfXMPDuoCAAACEVIAAAAEaAEHCgAEodJ9P5kCx2JKJalBrf08OUkV_UUeDAVPaLa0E6QBohknQ4W8DJPe6Kh0X0KtH8yMiEj2AFSXSMu9sHSSXjkAfCljn1z38snvsHgiPSFB56nW63oXFZhWnLwpHZFeaIEH3paIOtQbaf9QUIxDQ-b4mFbT1K104NUC59c00JdAFjm2hy1HKtoPYv4TWQ0AXdqqMDs2z1cOm7WJ-T-bEfUMnIAoDbcXlc4FtfUblNjLNNiVYf8HfN8Su-XgjxlcfYkDEx1djZgf5T9887b7PAttbv75nM-_-VXpl2-ZwCGYkIVpT4IlAICvRjR3C5KlR-89QJazK4J30fWoWz4AxXjMAXm59GSRO4LhgOE_0lu1TO8aKLI6KWa31mJw7TA2ZTUNH5MHpCbSBxcsTwamix3yc_-_H9g_c5q6QBJLhUTyyXz3B50hDoCc6RBGIYociW2GLaazW1JNdptyqKSblmOrnRYyTQHCRWja6HBCBkTK5G7F8QwzNcbEwqlLkuTf-P52ETMzABsiU5SX5-sVjMqwi3d-8RSPcCQtmvpGoKFkmAQKkho-I5oSx3Fe8m6zd_M3nB2gl_fDOK--A9iRPmFhOyWa_yx9zMtziWdUzfxhPRRENCjFH-8_I6LpPCHg3DpQa7rJYxEBOc5RsVpw65R6JIDgJmV-6XH-XY96mxo1hRejAXBNixE_vzc8O4WTIw7RME1q8TPerYGHZeyF_pQTWVtY7wZb4bWVN5PHSn5yc6WeUSZZz1CezCxU0m_skNnLFYS8CI7tmjHSQ8R8PVz-7Nh9OHKylUuU05oAV02_joHq8dWWhIm9i58iYZ5s3fJBVRAxmvRJ2kKTjauEeC4AdsBtESV5GDFJs-wlUHYvUsYVEbYcocFtQyH1sjz3tNs7O1cM15L8jKJYYi4yLAbnSbWOrv649W3oPEvfKDo7Xz9GMsrdINQgYQmCeCiGJA
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame 9B54 0
103 B 63ms
62ms Ping
text/plain 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/640ee9c6c56577c34d0ea77e?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fa2.adform.net%2FC%2F%3Fbn%3D62821215%3Badfibeg%3D0%3Bcdata%3DtftV_F5BQ-dP-Q9btp-KMBkgfPGMvFsYhZF8eTZNnJ1IrJmc_5nieB5VTS12_oEjtRXzUs-85g5uj10HEyeiY7zqFv8uzqcuCQ8Cld2Xq9y4KV5dayWqGv2CYwQXW3dgGR9pr0W0xlRosoRludXK-Q2%3B%3BCREFURL%3Dhttps%253a%252f%252fswiftmoves.blog%252f%3BC%3D1&container=creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c7956a24a567151-YUL
content-length: 0
request-context: appId=cid-v1:1fcf03fc-fba3-4651-852f-a11a7fdec64e

POST
H2 204 events
bidder.criteo.com/csm/ 0
216 B 24ms
23ms Ping
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 13 B
294 B 24ms
24ms XHR
application/json 2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?ccpa=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

243fb9953e49b6005f6ae1772f507bb789a8893960a495850afe43fe34030311

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_032.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 68 KB
68 KB 189ms
188ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_032.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be6dab498c45fd183b8394b9c5c7b276cb119dc85cf18e8610939005c3071a95

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "366df476167161fb7f05d3f6e91f9cc3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EUI%2FU%2F6AJOdqZXzDGcwuhEDth%2Bh4fm7V1x3bE%2BuTwWOg4SwW%2FI3P1mOjeLEFEqPV9HfnkRNilLsylPgRUxCfpvtvFM8sll3wd3MRAbIb4wAhMDjw%2FdmeNTETTy0yI6Ko5LvMQvwv6k3Zf4rA8i5krRic"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956a39ff45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 69502

GET
H3 200 audio_032.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 368ms
368ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_032.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b9bae32fc9216fbcc64e75e133517171496336f76511900e57289cda494ff9d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b889f9635be71398a7835108aa46bb4d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dLciOWO224EJREFLbzQmLcSXu49jbBCbVf3mfblNMYqrJRkU%2BREvRrN3fWBJJWpNr8KB9xKau5esvXH0fy1kUsYwpf8A2vm4V2cW3Yc9rtehelwcElbTeOdKCw32OQtUph8ahgbP5FLl0vfF7OZgCZ0t"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956a39ff55437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40738

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 133 B
575 B 308ms
307ms XHR
text/javascript 108.156.180.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fswiftmoves.blog%2F&pid=AooGIxgyw9CyW&cb=7&ws=1600x1200&v=23.505.1627&t=15000&slots=%5B%7B%22id%22%3A%22instream_desktop_na_Video%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%5D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&schain=1.0%2C1!ezoic.ai%2C144fa446ff6593f92ede4c464f341dd2%2C1%2C%2C%2Cswiftmoves.blog&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22pubcommon%22%3A%22efc6dd67-eb86-4443-a034-9da4b203b609%22%2C%22audigent%22%3A%22060dg9iefi9ld8dfc9glgge7hc6bjaiica7kq6umou60k4koi6q0qqm2si0gweuui%22%2C%22lotame%22%3A%22292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7%22%7D%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.180.227 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

27d877b078f4af14c20699d6203c7f5b09751822773c7ecb0e583882df5654b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f33995c678273fd6a10b1337580b6fa2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CMH68-P2
x-amz-rid: J8TKMZRXVCB2E7ZW8H3V
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 133
x-amz-cf-id: fOr1yxw8lY287P0gUPun283GSHrS3UtljETNFzOD-UShBXYg_qqD1w==

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_033.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 55 KB
55 KB 213ms
212ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_033.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a200b74b071e5609254ce3fd0246fd285787f60f83b6f32622a7ab2bee62cee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "ff412cdc7fb268c51962b3d49a0502a6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zd1VyMnYz5xktZjsnKqASKSkUXrrNMZCKg336cSMlsi27WgyCefZSbqf8vEAdlpaHrvTwD%2FrmLoQcDASUMhGp75tJEzcPV7tnJqiBkZoOJRkYcp1XRFDKOwRn4NNKZSFvBte%2Bi19Jd%2B5vrBS5SgKr12i"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956a8aef95437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 55853

GET
H3 200 audio_033.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 184ms
183ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_033.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17108f1d23035a7ed61a979d0c8a970fcbcef0aadcd32c5312b1f351e79b678b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "1ccb9e3171a99862927b7f4ae110af2a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=52zavdgaGcQ3kRY3qPzFQuGkHis55LgCbPIwIrJD9x%2FAXlJcU0gh9Um54vnFiBUPwasmAmbaptCSeDKyvBZpjQmGK2LOxDQjob971%2B944Gn4eDNtV71ARoSLYWvxR8YddMN4si8iKJAwMSnUP3qkoHWb"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956a9b84c5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40909

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 39ms
38ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 35ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 854C 156 B
142 B 291ms
291ms XHR
text/xml 2607:f8b0:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?correlator=2320137887434351&description_url=https%3A%2F%2Fswiftmoves.blog%2F&env=vp&gdfp_req=1&output=xml_vast4&sz=400x300%7C640x480%7C640x360%7C300x168&unviewed_position_start=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ad_type=video&hl=en&max_ad_duration=240000&min_ad_duration=4500&npa=0&tfcd=0&vad_type=linear&vpmute=1&vpos=preroll&iu=%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1&vid_d=297&vid_t=JBL%20Flip%205%20vs.%20Flip%206%3A%20Is%20the%20New%20Version%20Improved%3F&vpa=auto&cust_params=ap%3D1%26d%3D284837%26eb_br%3D60474211daf1dfd4d90000ea01f56c30%26ft%3D0%26ic%3D1%26iid1%3D182941138103970%26plat%3D1%26t%3D134%26tap%3Dswiftmoves_blog-video-1-182941138103970&sdkv=h.3.572.0&osd=2&frm=0&vis=1&sdr=1&afvsz=450x50%2C468x60%2C480x70&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&us_privacy=1---&sdki=445&ptt=20&adk=975146271&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.572.0&sid=D95BBF13-DEFC-440D-B939-E41645E175B3&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABIXCghydGJob3VzZRix2-zwgTFIAFICCGQSGQoKdWlkYXBpLmNvbRix2-zwgTFIAFICCGQSGQoKcHViY2lkLm9yZxj43OzwgTFIAFICCGoS1gEKDmVzcC5jcml0ZW8uY29tEroBd3BfV19GOW5SaVV5UW1NMVJVNUxNMHB6TW1sM2NrYzBhekUwUnpFelNreFdVRzFUUm1JbE1rWm9iV2h3VldseFRqVTBlWEJhVUVWNk4wUk1RM1ZFWjBaTGEzVlJWWFIxVm5WV1JqVlZlVzFyYUVJMlRUVklOek4xVkhVbE1rSjVibXBLTVZKV1dsZExUMVI0VjB4aVYydHJhSEJEU1VOUlJYRk5WRGh3U0hoeFJ6aEJZVVowWW5OUFNRGIbd7PCBMUgAEj4KBW9wZW54EixleUpwSWpvaVlUa3hhVzFwWjJOQ1NqUlliRU5WZG5sd1JYRnZaejA5SW4wPRjR3ezwgTFIAA..&nel=0&eid=44736293%2C44765701%2C44768717%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&top=https%3A%2F%2Fswiftmoves.blog%2F&loc=https%3A%2F%2Fswiftmoves.blog%2F&dlt=1684132272249&idt=1109&dt=1684132292126&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&scor=4109978926938637&ged=ve4_td20_tt19_pd20_la20000_er0.0.0.0_vi0.0.1200.1600_vp0_ts2_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.572.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c08::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
a2.adform.net/serving/unload/ Frame F744 35 B
592 B 20ms
19ms Ping
image/gif 185.167.164.49
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/serving/unload/?version=15&unload=7246762434369164995@@62821215,4387404477288133334,100|3023|0|0|0|0|0|0|0||98|0|||||1|0|0|Dhkz-VeF4bnxBx_RTJEBJ_LJXReq182Q_blYGSeCeSHrhzgFI7kTX_L_QlhaeLlf0|||01|0|0

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/stoat/626/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 vad.gif
swiftmoves.blog/porpoiseant/ 43 B
138 B 27ms
26ms Image
image/gif 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swiftmoves.blog/porpoiseant/vad.gif?e=%7B%22ad_filled%22%3A0%2C%22error_message%22%3A%22AdError%201009%3A%20The%20VAST%20response%20document%20is%20empty.%22%2C%22url%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22pageview_id%22%3A%22ba088273-417b-4dd5-55f5-4f5fefddc39f%22%2C%22visit_uuid%22%3A%22a1f23fd0-d1c4-40a8-6413-68ddfcab03c2%22%2C%22template_id%22%3A134%2C%22domain_id%22%3A284837%2C%22video_ad_impression_id%22%3A%223a97928d-4f88-4a24-aa6a-1f9909a5c07b%22%2C%22vab_test_id%22%3A%22%22%2C%22vab_test_val%22%3A%22%22%2C%22uuid%22%3A%223a97928d-4f88-4a24-aa6a-1f9909a5c07b%22%2C%22play_cnt%22%3A0%2C%22pause_cnt%22%3A0%2C%22completed%22%3Afalse%2C%22errored%22%3Afalse%2C%22skipped%22%3Afalse%2C%22clicked%22%3Afalse%2C%22viewable%22%3Afalse%2C%22ad_position%22%3A%22start%22%2C%22video_impression_id%22%3A%22025c31b7-8e0e-4911-9a75-84017523ab03%22%2C%22ad_client%22%3A%22Google%20IMA%22%2C%22ad_system%22%3A%22Google%20Ad%20Manager%22%2C%22total_ads%22%3A0%2C%22ad_index%22%3A1%2C%22player_name%22%3A%22ezvideojs%22%2C%22is_outstream%22%3Afalse%2C%22impression_id%22%3A182941138103970%2C%22ad_unit%22%3A%22swiftmoves_blog-video-1%22%2C%22ad_src%22%3A%22https%3A%2F%2Fpubads.g.doubleclick.net%2Fgampad%2Fads%3Fcorrelator%3D82208391445%26description_url%3Dhttps%253A%252F%252Fswiftmoves.blog%252F%26env%3Dvp%26gdfp_req%3D1%26output%3Dvast%26sz%3D400x300%257C640x480%257C640x360%257C300x168%26unviewed_position_start%3D1%26url%3Dhttps%253A%252F%252Fswiftmoves.blog%252F%26ad_type%3Dvideo%26hl%3Den%26impl%3Ds%26max_ad_duration%3D240000%26min_ad_duration%3D4500%26npa%3D0%26tfcd%3D0%26vad_type%3Dlinear%26vpmute%3D1%26vpos%3Dpreroll%26iu%3D%2F1254144%2C22534415887%2Fswiftmoves_blog-video-1%26vid_d%3D297%26vid_t%3DJBL%2BFlip%2B5%2Bvs.%2BFlip%2B6%253A%2BIs%2Bthe%2BNew%2BVersion%2BImproved%253F%26vpa%3Dauto%26cust_params%3Dap%253D1%2526d%253D284837%2526eb_br%253D60474211daf1dfd4d90000ea01f56c30%2526ft%253D0%2526ic%253D1%2526iid1%253D182941138103970%2526plat%253D1%2526t%253D134%2526tap%253Dswiftmoves_blog-video-1-182941138103970%22%2C%22param_gen%22%3A%22DefaultWide%22%2C%22position_gen%22%3A%22Even%22%2C%22vad_type%22%3A%22linear%22%2C%22skippable%22%3Atrue%2C%22min_ad_length%22%3A4500%2C%22max_ad_length%22%3A240000%2C%22ad_type%22%3A%22video%22%2C%22allowed_ad_sizes%22%3A%22400x300%7C640x480%7C640x360%7C300x168%22%2C%22t_pageview_time%22%3A1684132272%2C%22bidders%22%3A%22%5B10087%2C11309%2C11325%2C11315%2C11331%2C10015%2C10050%2C10061%2C11324%5D%22%2C%22received_bidders%22%3A%22%5B%5D%22%2C%22video_position_id%22%3A3998%2C%22auction_retry_count%22%3A6%2C%22fallback_type%22%3A%22linear%22%2C%22bid_floor_gen%22%3A%22defaultVideoAdBidFloor%22%2C%22multiplier%22%3A3%2C%22winning_bid_floor%22%3A0%2C%22max_hb_bid%22%3A0%2C%22bid_floor_type%22%3A0%7D
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4c55:e23f:afb4:7f32:3aa4:fbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
content-encoding: br
vary: Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 14 May 2023 06:31:32 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_034.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 158ms
158ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_034.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c3bbc461c053bad1575098121c8e25b0c8de61d6c03ac3482e37a074e16ddf1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "7fd7b0205e256baec63aae776e6915cd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2k4kuRnMKqueEd4ojszjnQiIRL09mdrG4A%2B1uZELqeB23hjdpiuYDD3jCja1Y6ixUbCHv0JfKvpEZUz5cVGGFzzzOAyGaGPPpC3b9IRnKadgjh%2FV0h%2F%2BB048KscKooGkKM0VTkG97ubT%2FbXCtUUO%2BTeu"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956adbd765437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40547

GET
H3 200 audio_034.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 129ms
129ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_034.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8078b54d1a5669aeeb1f2f5c6148ea6ae24d99ee9f3bbfc47b9ed40dabaf36e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "025204a9e60a5542d7576634c3282adf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N2wJBXxg%2FEn0sVQgoJiZRTt2OaHM0sHO2gqYdXF0CqHPJN%2FkLYbImKCA9AZrXHzQP4xvSZWcc3a3Bpm1j7h0KFuickcKsXxpKwZQCxL4npKFna4YigaWz%2Be8%2BaBa6GEa%2FLOLsF9ajEBqgyKNeEfVzuZz"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956aebebf5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40489

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 26ms
26ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:33 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: 4f1c4e14-978b-d18c-f87d-7e18a5c5a326

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 27ms
26ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: c0dfe5b9a08c2d0be40159b290804010508b738007b0f9c3685c7a6d078bc40e

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:33 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
312 B 82ms
82ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=135&profileId=185&av=33&wv=4.42.1&bundle=3L-yN19nRiUyQmM1RU5LM0pzMml3ckc0azE0RzNsRkJETTYlMkY2aVB6RE9MbU9ueGpHY2RKT1VpTElJN0hKVDBIY3JpQU15c0F3N3p4WmtGcGhhNjN1ZlNoYnplYSUyQnY5eGF2SjBZWFAyN3hEU0tuVGwxYU1wTG5TQndpODRuVWlDNUZYejNrM3g2aUp6SkRFbGdia3llJTJCNFQwRWlFQSUzRCUzRA&cb=30552876954

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/pbice/3.025/pbice.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 15 May 2023 06:31:33 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 events
bidder.criteo.com/csm/ 0
216 B 24ms
23ms Ping
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:33 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 13 B
303 B 24ms
24ms XHR
application/json 2620:100:a001::1d
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?ccpa=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::1d , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

243fb9953e49b6005f6ae1772f507bb789a8893960a495850afe43fe34030311

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

POST
H2 200 shba.htm Show response
rt3020.infolinks.com/action/ 0
65 B 96ms
96ms XHR
text/plain 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3020.infolinks.com/action/shba.htm
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/pbice/3.025/pbice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:33 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 7c7956b4bdda542b-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_035.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 33 KB
34 KB 111ms
111ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_035.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76f3f2c5d2bb6777333c7fb914600dc7fc719b3887c8dc6bccbcf7a031bfc881

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "222b83920b2cbe307b66374f571cc24d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F9cYz4%2FPQ66b73lgJSj9CkpOzCSaCwuqrzEegv5bbDDw%2FmvwHntEMQcSonnS41kMKawHjYf0%2BPgZcSNbCD9YkbPO6Cf%2FCVBrLTCyDQv2%2Fv4s9QeFLHW0zcpmKwGt1e8D9pSjWdJ9I7bqn7bUDZTpQlwr"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956b59fe95437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 33899

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 27ms
27ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:34 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: f4939942-5a5a-f294-9959-e80639fe1b4d

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 79BB 145 B
1 KB 110ms
109ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3f5404a6553c60bfb205cf71884b2c6fd00d44dd1e19ccf8236c9d0101c5a63

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:34 GMT
AN-X-Request-Uuid: 5e80f712-5310-447a-a8f4-f0570c97d9be
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 28ms
27ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: 4c910dbc503f5b5ef2af34c45692423973a0cd701d11113fe3cc345341fbb677

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:34 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 79BB 930 B
1 KB 90ms
89ms XHR
application/json 23.105.12.131
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.131 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 839990896e6f910cd614abe522cdaca443175a54a2d84a5e10ff30d7ede8236f

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:33 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK metric
report2.hb.brainlyads.com/statistics/ Frame 79BB 463 B
751 B 23ms
23ms Image
image/png 54.84.92.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://report2.hb.brainlyads.com/statistics/metric?event=noBid&bidder=appnexus64520d892126d5b60b1c1d8a&source=pbjs&placements=29926568
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.84.92.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-92-154.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 64faef43f59f0d829a290bb25e0b5c24308c0381b590d9717e460a8344912ba3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Mon, 15 May 2023 06:31:34 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Powered-By: Express
ETag: W/"1cf-XHssOe1+WUPy43P3Ckt9sJ3fhf4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 463

GET
H3 200 avjp Show response
outbrain-d.openx.net/v/1.0/ Frame 79BB 106 B
127 B 27ms
27ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://outbrain-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fswiftmoves.blog%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=30b27fcc-1598-4341-a833-35da8fc03adc&nocache=1684132294527&sua=%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D&us_privacy=1---&criteoid=H3idtF9KQ2k2TVZVTWxSY1NwaSUyRkpXRVQybmV3QWNSYjdmaDlQVyUyRlR4N2NSblJ3TEhSeSUyRmNSVWdLJTJCbTN0OSUyQiUyRnZWNVFmcFAlMkZXaUttMFh0RU0lMkJJajlQeDdzRFElM0QlM0Q&id5id=ID5*Biwi9bSpv2mcQ_9PQZMYCjkmr06et2l1ISOFmMJIsRpJ2elYAkEw2wEFjI_VPvsqSdqNsIFt1m-DMbKSc_YrdA&lotameid=292164644cc96ae165a390ac1e8116d53938e3ccd67d0d50a23aec205fe51ed7&parrableid=null&pubcid=efc6dd67-eb86-4443-a034-9da4b203b609&ttduuid=cb640652-5013-46a4-8cfe-1b84d3b7b490&schain=1.0%2C1!outbrain.com%2C006ca10119b62fceba0024c827780cdc78%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A734%2C%22h%22%3A412%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%5D%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22maxduration%22%3A60%2C%22minduration%22%3A0%2C%22linearity%22%3A1%2C%22api%22%3A%5B2%5D%2C%22placement%22%3A3%7D%7D%5D%7D&auid=540492000&vwd=734&vht=412&vos=101&aumfs=2870
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:34 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://swiftmoves.blog
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 audio_035.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 152ms
151ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_035.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 376756e009f297b9109e01e1ecf2f7c1ba0bb4b9cf9337ce59897b8c9b564fa3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "ce33f03d66f43d4b50013bf2999224e6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zofje7E8A%2FsTUvVHsmp%2FKLcJTUwxUzg0zg%2BwCUhXOqm295eafJRK%2FTJmUiXTrT%2BlhQRDRkBVeaOM2cVWR9DrB4s21gm%2B1uH%2FmCEH7SqQFC3g2UrXb4KNTLD1ys%2Fg4dBcwwTw26wSF7VSEWIbNrE12iAJ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956b9ad165437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40428

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_036.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 77 KB
77 KB 163ms
162ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_036.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d53dcbb9535324e7e7cf62981fb88a7be69a0f33ebf33a494be6ed1169dc6a1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b045e4c5c21b8b45a8108019fa22d4bc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fyavy8kjC2shaXpvtkhsRxx8SPZGc2pdz%2B2oGJP45m2Z8v8EvFXSccYwsORR7FdharRs%2FodMlMfQpm0k76eh2qznRh%2BeGl%2B02N2DNLX3MiLuhIOSE6xM%2F71rhPYQpgXCjFxA51219eFcEi%2BJSw8T0oVz"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956ba3dd45437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 78727

GET
H2 200 getads.htm Show response
rt3020.infolinks.com/action/ 4 KB
3 KB 363ms
363ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3020.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A2%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A1%2C%22as%22%3A%22728*90%22%2C%22sdata%22%3A%22design%22%2C%22scs%22%3A%22kFvoejX3ix%22%7D%5D&rid=ba622a9b-91a5-4145-ab13-69205b3d8460&jsv=1855.073-3.027&sr=1600X1200&rts=1684132294767&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=113.0.5672.92&dv=p&ce=t&purl=https%3A%2F%2Fswiftmoves.blog%2F&tzo=-0000&c=c&strg=true&pitc=95~XTkRJfq2EqQn-Yg2yO-bQmG4be_yfC3v&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=pF_1rQg9Xyo5uCBzRXl-RppzQ_EXBH37U4gpkjOEpFv7N4jAOrcK9dZGx2vA_VJNAz966-KdskcQVu7WTnE9SAGaARL7tsIsx80v6apB9t0BxrxB6lQQ7tFBa4JancZgTSh8uD0HzwZdfB_EUzrvNjVEveYYpu-H99mfRRRH56A&rsk=78&rcs=nUeUQrG5bnRquI0LQZwtHQ&cuid=37dfd06d-bc8e-458e-a86c-7ccdd516632e&_iiq_pcid=fa678900-5f04-4c44-a283-1707447ba265&_pubcid=efc6dd67-eb86-4443-a034-9da4b203b609&ique=&hbnr=true
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2856d0105dd45a4e7da8172efc812d40330435ce39f7cac00e902617dbd37a0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-CA
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7c7956ba5c58cab4-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame 9B54 0
56 B 51ms
51ms Ping
text/plain 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/640ee9c6c56577c34d0ea77e?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1njpJjEItD-G2md8_PGkPwAAACCuxyBAhtpnfPzxpD_VeOkmMQi0P1jZ_5qM3lsUSB0SzhQGQye10WFkAAAAAGYToAHEHQAAmBwAAAIAAADmMosZydgSAAAAAABVU0QAVVNEAPoA-gC_0wAAAAABAQUCAAAAALAAGyi9tQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521khaeogiXzPwZEOblrMwBGMmxSyAAKAAx2_l-arx07z86CU5ZTTI6NjQ4NUDGP0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DNzMyMCNOWU0yOjY0ODU%3D%2Fbn%3D86922%2Fclickenc%3Dhttps%3A%2F%2Fa2.adform.net%2FC%2F%3Fbn%3D62821215%3Badfibeg%3D0%3Bcdata%3DtftV_F5BQ-dP-Q9btp-KMBkgfPGMvFsYhZF8eTZNnJ1IrJmc_5nieB5VTS12_oEjtRXzUs-85g5uj10HEyeiY7zqFv8uzqcuCQ8Cld2Xq9y4KV5dayWqGv2CYwQXW3dgGR9pr0W0xlRosoRludXK-Q2%3B%3BCREFURL%3Dhttps%253a%252f%252fswiftmoves.blog%252f%3BC%3D1&container=creative
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 15 May 2023 06:31:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7c7956bae8bf7151-YUL
content-length: 0
request-context: appId=cid-v1:1fcf03fc-fba3-4651-852f-a11a7fdec64e

GET
H3 200 audio_036.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 207ms
207ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_036.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 145cf188c7760b7e378fbbf576f68a849a7cee58992122f231fbccf6d0e18db5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "043e0c659a52435bd28809dfafa61d91"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eEVt8BXrWdizdgvpazcC8jhYOqsH5vQGvuFe4mYgMMbBYYyv3P0NBy2BL8mHHp3h%2BpnUFA713dvXEXdxcrmOip3qbYeCgbBDEPUpuSjMpUTBfwKX%2Fi7Z0a0sem%2FgdRrgFpSga5VSRKoOFoTi345LNCy3"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956bb3f1c5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40820

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 8208 0
0

GET
H2 200 adview.htm
rt3020.infolinks.com/action/ 0
118 B 108ms
106ms Image
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rt3020.infolinks.com/action/adview.htm?rid=ba622a9b-91a5-4145-ab13-69205b3d8460&bdc=2&midx=0&emd=MTQ3fjE4MjE&rts=1684132295140&prod_t=d&jsv=1855.073-3.027&skin=sidebar&theme=nologo&sdata=design&scs=kFvoejX3ix&rsd=pF_1rQg9Xyo5uCBzRXl-RppzQ_EXBH37U4gpkjOEpFv7N4jAOrcK9dZGx2vA_VJNAz966-KdskcQVu7WTnE9SAGaARL7tsIsx80v6apB9t0BxrxB6lQQ7tFBa4JancZgTSh8uD0HzwZdfB_EUzrvNjVEveYYpu-H99mfRRRH56A&rsk=78&rcs=nUeUQrG5bnRquI0LQZwtHQ
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7c7956bcedf5cab4-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C6E9 136 KB
46 KB 46ms
46ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: blank
URL: about:blank

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0fce8abd20042bc7c89ae0cc2334e4c72c473bf2a1fe15afc7550ee96863618a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47449
x-xss-protection: 0
server: cafe
etag: 13538840926483890889
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:35 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame C6E9 356 KB
120 KB 59ms
58ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:35 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230510/r20190131/ Frame 894B 10 KB
4 KB 36ms
35ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230510/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 1291
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:10:04 GMT
etag: 15057649708203361565
expires: Mon, 29 May 2023 06:10:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 csi
csi.gstatic.com/ Frame A31A 0
17 B 502ms
502ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=4~lhogvpij&chm=1&c=2913416228924394&ctx=2&qqid=CMWO09PZ9v4CFVLV4Qod9ZUKXg&met.6=6.1_CgsYu2EgXyoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:35 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 44E5 14 KB
15 KB 18ms
18ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54441
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c7956be4ab37151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame C6E9 107 B
122 B 38ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame C6E9 107 B
122 B 45ms
44ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3308 76 KB
28 KB 268ms
268ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6373315980741255&output=html&h=90&slotname=2794737922&adk=1445061518&adf=2751418257&pi=t.ma~as.2794737922&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132295282&bpp=5&bdt=89&idt=142&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=1728588458.1684132295&ga_sid=1684132295&ga_hid=27586016&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=527778732&scr_x=0&scr_y=0&eid=31074468%2C42531706%2C44772269%2C44788441%2C44792089&oid=2&pvsid=2430542116998174&tmod=1721598138&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1zfnkpyy6qqj&fsb=1&dtd=148

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ca5ffe0154923247eefd1ad3a33de64e49d8abf862c6dbd7bc1214c3d48e0f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 28603
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 44E5 14 KB
15 KB 18ms
17ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54441
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c7956be9af97151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 5855 14 KB
15 KB 16ms
16ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54441
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c7956bedb197151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 5855 14 KB
15 KB 17ms
17ms Image
image/webp 2606:4700::6812:ae65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fbetway%2F581701278d987c10bca61aed%2Fimages%2F119daa71-23a5-4d0b-9056-cf7c51b9a4fe.png&w=264&h=297&q=90&f=webp&rt=contain
Requested by: Host:
URL: widget-98aaed36-ac66-47da-acbf-dfdda07b2b9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:ae65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf6b67ffa8903f3dad489b154d7eb7c1088ac34c6711bf0aac67e80870ec092c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
cf-cache-status: HIT
last-modified: Sun, 14 May 2023 13:05:59 GMT
api-supported-versions: 2.0
server: cloudflare
age: 54441
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 7c7956befb287151-YUL
content-length: 14820
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H3 200 css
fonts.googleapis.com/ Frame 3308 4 KB
655 B 171ms
170ms Stylesheet
text/css 2607:f8b0:400c:c32::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6373315980741255&output=html&h=90&slotname=2794737922&adk=1445061518&adf=2751418257&pi=t.ma~as.2794737922&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132295282&bpp=5&bdt=89&idt=142&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=1728588458.1684132295&ga_sid=1684132295&ga_hid=27586016&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=527778732&scr_x=0&scr_y=0&eid=31074468%2C42531706%2C44772269%2C44788441%2C44792089&oid=2&pvsid=2430542116998174&tmod=1721598138&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1zfnkpyy6qqj&fsb=1&dtd=148

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c32::5f Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 04:37:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 06:31:35 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 3308 2 KB
766 B 35ms
34ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 19:13:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40682
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 28 May 2023 19:13:33 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/ Frame 3308 22 KB
9 KB 155ms
154ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a4645a1aa31745840e1e5dee4a2788e78c1d09b094f4705a64ddda88d8bd235

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:03:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8754
x-xss-protection: 0
server: cafe
etag: 1905752258753453817
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 04:03:06 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 3308 3 KB
1 KB 155ms
153ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:54:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5799
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 04:54:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 3308 19 KB
8 KB 155ms
154ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 02:43:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13673
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 May 2023 02:43:42 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3308 169 KB
52 KB 155ms
154ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:35 GMT

GET
H3 200 9d5f24412120a376f470376f2f2984aa.js Show response
www.gstatic.com/mysidia/ Frame 3308 32 KB
13 KB 158ms
157ms Script
text/javascript 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9d5f24412120a376f470376f2f2984aa.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cb71f31c08ff900d8bc1a5bc75ee0a966a2bc61561e8974e445ef0941d9ff55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 04:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13623
x-xss-protection: 0
last-modified: Tue, 09 May 2023 14:00:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 13 Aug 2023 04:44:31 GMT

GET
H3 200 audio_037.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 158ms
157ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_037.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f860bc5f00e91defde7491510a6bcd88e1cb5e780905a24cce3f7bf768ae2e9d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "f5028935c537dca0381d6827956c98bd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wNslc50rpPfM7oj%2Bi0%2BidYs4gfCWIsB9Nl8LGkyWqRNS4b6SLfaUhuJVO2SXWQY%2BviYxySLA0Fo9hnRIOqvl4j9F%2BkhjnP%2F6KrBkkUyQMPBe0hsfQxkqzs8woOcxfh8zlGHStcWNXBllC%2Blh7NNZYlWI"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956c05cdd5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40658

GET
H3 200 6592766407814317453
tpc.googlesyndication.com/simgad/7672221289243978642/ Frame 3308 24 KB
24 KB 191ms
190ms Image
image/jpeg 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7672221289243978642/6592766407814317453

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7beba5b25ae349937f5671a4a7e62fb3e84d24e1e59c35a6766ec4e83758b351

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:35 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24137
x-xss-protection: 0
last-modified: Wed, 12 Oct 2022 15:49:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 14 May 2024 06:31:35 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/2791640469479960439/ Frame 3308 3 KB
3 KB 167ms
167ms Image
image/jpeg 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2791640469479960439/14763004658117789537?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd8ee53574b954a4199933ad5a9eb75baf16daf364a3cd9664cb63cd61572f22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 01:17:05 GMT
x-content-type-options: nosniff
age: 105270
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3353
x-xss-protection: 0
last-modified: Thu, 30 Jun 2022 12:16:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 13 May 2024 01:17:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8FD1 1 KB
643 B 35ms
35ms Document
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 45973
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 14 May 2023 17:45:22 GMT
etag: 48472445140208031
expires: Mon, 15 May 2023 17:45:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3308 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 68c97220d47d6a6d07b3b55cb5127acc47ce1fa7a951eb2a543ed4cec617d66a

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3308 15 KB
16 KB 35ms
35ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 20:49:58 GMT
x-content-type-options: nosniff
age: 553297
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 May 2024 20:49:58 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3308 15 KB
15 KB 40ms
40ms Font
font/woff2 2607:f8b0:400c:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c01::5e Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 08 May 2023 08:04:40 GMT
x-content-type-options: nosniff
age: 599215
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 May 2024 08:04:40 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame 8FD1 43 B
694 B 104ms
104ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEHv-oGdGBXChqPwSLq3d1VA&google_cver=1&google_push=ATf1kGO0oYoxnbOXFsB5md8cPeV1-Q9B-uJjXqK_237Opo0anHL7bKF_7e_rL2ycabaMPvYA2oCqh0qJHvo_miOmLX0fhGYu1eqt&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGO0oYoxnbOXFsB5md8cPeV1-Q9B-uJjXqK_237Opo0anHL7bKF_7e_rL2ycabaMPvYA2oCqh0qJHvo_miOmLX0fhGYu1eqt%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6373315980741255&output=html&h=90&slotname=2794737922&adk=1445061518&adf=2751418257&pi=t.ma~as.2794737922&w=728&rdp=false&format=728x90&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132295282&bpp=5&bdt=89&idt=142&shv=r20230510&mjsv=m202305090101&ptt=9&saldr=aa&correlator=5765839120568&frm=23&ife=1&pv=2&ga_vid=1728588458.1684132295&ga_sid=1684132295&ga_hid=27586016&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=527778732&scr_x=0&scr_y=0&eid=31074468%2C42531706%2C44772269%2C44788441%2C44792089&oid=2&pvsid=2430542116998174&tmod=1721598138&uas=0&nvt=1&loc=https%3A%2F%2Fswiftmoves.blog%2F&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1zfnkpyy6qqj&fsb=1&dtd=148
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7c7956c1eb44715a-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8FD1
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEN008R61LFF-5wYEJtE5SsQ&google_cver=1&google_push=ATf1kGM5nrU2Lf33UnPv_MelnCR_9SKbdqSC9j0OgKjv17tKzveHbN972X2WDcGNHaC6ZcnlXhZ83nSkBOAYMh8Zeq8LIyeamWk2
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ATf1kGM5nrU2Lf33UnPv_MelnCR_9SKbdqSC9j0OgKjv17tKzveHbN972X2WDcGNHaC6ZcnlXhZ83nSkBOAYMh8Zeq8LIyeamWk2&google_hm=ZyfX_ygdgkerNqFwfa8j5Q==

170 B
188 B

39ms
38ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ATf1kGM5nrU2Lf33UnPv_MelnCR_9SKbdqSC9j0OgKjv17tKzveHbN972X2WDcGNHaC6ZcnlXhZ83nSkBOAYMh8Zeq8LIyeamWk2&google_hm=ZyfX_ygdgkerNqFwfa8j5Q==

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:35 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ATf1kGM5nrU2Lf33UnPv_MelnCR_9SKbdqSC9j0OgKjv17tKzveHbN972X2WDcGNHaC6ZcnlXhZ83nSkBOAYMh8Zeq8LIyeamWk2&google_hm=ZyfX_ygdgkerNqFwfa8j5Q==
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8FD1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHR-Yapps6-Yd6fNakSUlNQ&google_cver=1&google_push=ATf1kGNA2Bsw5e37f9XJIIwh-FOe51MRTN5IADXPN1yuOE489mBV16_Dfhd64Zw4tcvOBL--2PDoEhVlnrWrd5G...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=fxwlYUubUiBvJ8uiP7oHl5U4mbc&google_push=ATf1kGNA2Bsw5e37f9XJIIwh-FOe51MRTN5IADXPN1yuOE489mBV16_Dfhd64Zw4tcvOBL--2PDoEhVlnrWrd5...

170 B
188 B

42ms
42ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=fxwlYUubUiBvJ8uiP7oHl5U4mbc&google_push=ATf1kGNA2Bsw5e37f9XJIIwh-FOe51MRTN5IADXPN1yuOE489mBV16_Dfhd64Zw4tcvOBL--2PDoEhVlnrWrd5G1CgLxtC287hhc

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=fxwlYUubUiBvJ8uiP7oHl5U4mbc&google_push=ATf1kGNA2Bsw5e37f9XJIIwh-FOe51MRTN5IADXPN1yuOE489mBV16_Dfhd64Zw4tcvOBL--2PDoEhVlnrWrd5G1CgLxtC287hhc
Date: Mon, 15 May 2023 06:31:36 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET pub
cs.chocolateplatform.com/ Frame 8FD1 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8FD1
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEOcr1WBD6QkN-NjRic-Gt-U&google_cver=1&google_push=ATf1kGMceBvYQ7bSwKY9Tey2ddKe2MjMPWfG5clGp3TXqvv1OU07yi0tqfA4DUDZwpRKrYv1moTBSBbgHSsBgcDdj9W9OUNtO0hh
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ATf1kGMceBvYQ7bSwKY9Tey2ddKe2MjMPWfG5clGp3TXqvv1OU07yi0tqfA4DUDZwpRKrYv1moTBSBbgHSsBgcDdj9W9OUNtO0hh&google_hm=07b2c5acae74184aaff...

170 B
188 B

41ms
41ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ATf1kGMceBvYQ7bSwKY9Tey2ddKe2MjMPWfG5clGp3TXqvv1OU07yi0tqfA4DUDZwpRKrYv1moTBSBbgHSsBgcDdj9W9OUNtO0hh&google_hm=07b2c5acae74184aaff92126b46f2136

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ATf1kGMceBvYQ7bSwKY9Tey2ddKe2MjMPWfG5clGp3TXqvv1OU07yi0tqfA4DUDZwpRKrYv1moTBSBbgHSsBgcDdj9W9OUNtO0hh&google_hm=07b2c5acae74184aaff92126b46f2136
date: Mon, 15 May 2023 06:31:36 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8FD1
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEB8L_5l_AJVHx-jhphFEDJ8&google_cver=1&google_push=ATf1kGN1CGb4kQ3sFKgiftHEbc1B0yhTd08a91HU6W0aTsr1atHzSq43gSb-Gt7fIc7eXE5_9-A_2r1vM3liEAo...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Uas1MQB2U0iJQAY2Pf3Ejw&google_push=ATf1kGN1CGb4kQ3sFKgiftHEbc1B0yhTd08a91HU6W0aTsr1atHzSq43gSb-Gt7fIc7eXE5_9-A_2r1vM3liEAo5Kvy5ExhqVFRZ

170 B
188 B

47ms
44ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Uas1MQB2U0iJQAY2Pf3Ejw&google_push=ATf1kGN1CGb4kQ3sFKgiftHEbc1B0yhTd08a91HU6W0aTsr1atHzSq43gSb-Gt7fIc7eXE5_9-A_2r1vM3liEAo5Kvy5ExhqVFRZ

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Uas1MQB2U0iJQAY2Pf3Ejw&google_push=ATf1kGN1CGb4kQ3sFKgiftHEbc1B0yhTd08a91HU6W0aTsr1atHzSq43gSb-Gt7fIc7eXE5_9-A_2r1vM3liEAo5Kvy5ExhqVFRZ
Date: Mon, 15 May 2023 06:31:36 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8FD1
Redirect Chain

https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEM96UpDct_uMMA1SRS2DgE&google_cver=1&google_push=ATf1kGOHjEqtO0Ko4hWe6EYyj82vBEgkcrkBIAZfpPXbfRt3GJVwsdYyrldiJJzqe1LaCjU6YlUa8qFaVszwxo-RY...
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MTc5NzZlMjk3MDI1YjAwYg&google_push=ATf1kGOHjEqtO0Ko4hWe6EYyj82vBEgkcrkBIAZfpPXbfRt3GJVwsdYyrldiJJzqe1LaCjU6YlUa8qFaVszwxo-RYCB-mIG2...

170 B
188 B

40ms
39ms

Image
image/png

74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MTc5NzZlMjk3MDI1YjAwYg&google_push=ATf1kGOHjEqtO0Ko4hWe6EYyj82vBEgkcrkBIAZfpPXbfRt3GJVwsdYyrldiJJzqe1LaCjU6YlUa8qFaVszwxo-RYCB-mIG2rB8MIg

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 15 May 2023 06:31:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
location: https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=MTc5NzZlMjk3MDI1YjAwYg&google_push=ATf1kGOHjEqtO0Ko4hWe6EYyj82vBEgkcrkBIAZfpPXbfRt3GJVwsdYyrldiJJzqe1LaCjU6YlUa8qFaVszwxo-RYCB-mIG2rB8MIg
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8FD1 0
12 B 39ms
36ms Image
text/html 74.125.134.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KVnFzOJ5_HsxHLaB60Z3nbI6rP1_e6cMHy6j6VOetUkM_1nbWktUG_7faZN9uxIbSDs6R_yAk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.134.154 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C6E9 14 KB
11 KB 43ms
43ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a5bc3b77bbd87454516354e788122412ecc748bf9125a39099eb5e62ece545b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11155
x-xss-protection: 0

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 1801 37 KB
14 KB 37ms
36ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540927
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_037.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 97 KB
98 KB 93ms
93ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_037.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd07863c11366e559974e2c7f31048cd4533e8a4fc4bfb2f5e8bce9f6055676f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b3d63d75bdfb01e768619c6820dd17db"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2BU%2BzgoCKdTcyXc%2FZ0PYIvnLhFgRDpeKSKw8BLeACNKtXNd4Dmv4Ax5WTcpiQBuxSzziQEzOcwPc%2BrAYE5w3y1dQWh8Ms1nJj6wxRkFZrIwcn6nx9U5a3ERi9kb6hF3Fw9pBjXKlx9YiPbijbP3PdXaK"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956c258485437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 99522

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C6E9 17 KB
6 KB 44ms
44ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:36 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame A31A 0
17 B 375ms
374ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=5~lhogvvtl&chm=1&c=2913416228924394&ctx=2&qqid=CMWO09PZ9v4CFVLV4Qod9ZUKXg&met.6=6.1_CgsY5mcgQCoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame CA52 13 KB
5 KB 36ms
35ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118246
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F46D 783 B
535 B 40ms
39ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fbbdb970ed3838d8b9c76855b9317e2740a6154d461f01b11b8a1e6b92f4e1db

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-n5amk3p6YlQwDT3DJ7ocLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-n5amk3p6YlQwDT3DJ7ocLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:36 GMT
expires: Mon, 15 May 2023 06:31:36 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 dcl.htm Show response
rt3020.infolinks.com/action/ 0
60 B 105ms
105ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3020.infolinks.com/action/dcl.htm?rid=ba622a9b-91a5-4145-ab13-69205b3d8460&prod_t=d&sdata=design&bdc=2&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1855.073-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:36 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 7c7956c3699ecab4-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F46D 0
0 36ms
36ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=2430542116998174&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame CA52 37 KB
14 KB 38ms
37ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540927
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame CA52 0
12 B 36ms
35ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?YMYPCA
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:36 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_038.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 35 KB
35 KB 196ms
196ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_038.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50cc9918419e3e8fb5108b5def2a837c869f332bb45206c6e452c3c222a313ce

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "ac6ccd1b3d0d86de2128506fc50a67ab"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U7L%2BNcP%2FD1j%2FUkAahfPMX9OHXKmV8hJuCmaD1HBko%2FADxYUuUV0X89DVa3na8092WLB8tohBnCGxSYnjRBK1V4iKR7%2BU9exCV5i6KlQicNjBdlb7vn03X8GPOemL%2FU7H3%2Ftmls35keppjNobyFYvEbZz"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956c77e6b5437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35394

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3308 42 B
64 B 44ms
44ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssz5LLFtMfZabW70q7MUq27EUDyxFR7Ew2ZuTMYT2HnF0C1tG_xIszkqKtOKAezAJ2FhlDZGmxsKgtVnYAZgLvHhyyrFEifhAhwUnoLpNpRJojKdqIeqcp-lu7WhXwIPw4gnWhtMoSc_xy6GTeFMCKUAcRi0IMZdg&sai=AMfl-YQj5XRk3LNzQHR5DLvK0AMeTNab-o3fnwB67YzjCFR83qdDLRaf2JDycKqCWQEUBWHK3DjP4u7DIVQ8cW3yXC4_SsjxXaPOmdg&sig=Cg0ArKJSzIKiE7LvC8LwEAE&cid=CAQSKQBygQiDNmncy6ht3pWc9SQWPuS8BDBPpa0Tezl6zIEJuzSxDziS3rGSGAE&id=lidar2&mcvt=1011&p=0,0,90,728&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&v=20230510&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1445061518&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132295432&rpt=589&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 audio_038.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 170ms
169ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_038.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8241ce7fc7e5e175ec928258d5e43c6fe2325bf0c9abe1f9c30de04c5d41b68b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "58c9a4fbe135a3df6f06d4ee5479f936"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fUM9U6ovNGvC2BPt5GqTgQf6GIVeQXlYwtnQCMAXeeAYPnCXEg3xpmvgkhN2qIo9LLzs1z7USarA5R3HY%2B1iO5jsdCxjmk8uQOxjhVyxG60CIdFB6%2FLfNVZpt7sm5x2XGkxSrN5Jt1p3L6XGN405HhE%2F"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956c8cfd95437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40418

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C6E9 0
0 39ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=2430542116998174&bg=!SEulSx_NAAYldGN0BXQ7ADkAdvg8WmC_Bzy1BqXk4eVMwNBjNr-S7vx8versWi98rULSOf8KkM6VJFx7EamF3lzQtTsvCTCehlQCAAAAxFIAAAADaAEHmQK8hQCkltB2oD1e7rMsOD502BSdm7Hnxek56autbGlGzXhrDc9hAFYc_Q-UsPyOErd-rdrZPQgEmjfVae7ujlDZULzOTcr3eB8pz8-r9Kk1bGxaLn3Cpnjamaiqt5Czju7vpUGYM9jOX2g-hWWjtNHsJAxYi0Zgvy-AFCeygARxhROwMao_cRi7s_cu44eJd-GdZZJJ2r1OUebTeXak_7wHQy20YoI7PWsPbDmfEFQe9Rr-1OwT52kopYHZOjrTG6UR5yGYBE7ySX6SaXNB8p78mwWi0AKgOnmkGE3KzyJFdDWHthOVL8H_pchGgbgjbdetfzWwCSXmaJFilaS6Nbeypgh2Eg76K_n2Om--q5zPvEe2ej6admwrF2YpHwHLLbj5liyhsZm4EWgM_O0yroWLOfeTvXLoEgN9LRIj60TfB0ygqkzZftogzswWOX2sarmCaV2L_PnuVQ1PxqLeNtuuD2PQajCJHr1Aj58bH3h_1zpaMNIqv-LkmLHkyjPlN--gdKaI7GcFt42_zb_kjw1P9StV6K3RPdDpo1owlj1Jn-mgHkTB8sQW7WnaYKLuLDyyRXKkGixEXNV44kMmomuQGgAmrInxyocmUH1DpqBowuDVfZG1IVZrCRYNTVPH0qadgAGCOzd0nmk1suCuZjBiqU6-rfODKPYZLCdxM_jp0IOy9cGyXWVAM6OlY9lshXTFYIObiRJz4etFhmxGJUA7jzmAjLGjlpu_VbSsFs05SZVpSNApuF4sUG7LUlpUzSSYlS4qRcPX_qxBfmD-WKrzLbIr64ZstXthhMI881Wgv9XDTXBV_ZJom9O3H6B4jHShku87sY2pRXgbNo65tNBqJ-MGmjscXK_vuXonKHFWdQCg7JJWAloECJMrJXyEa5m8rCNKeUbZEHeVl14Mq8-tehZufsc0UkHH3XUCsQ
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_039.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 23 KB
23 KB 162ms
161ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_039.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb2f30529e822520cc66c9abc3621ad3edeb98fec1c3d2ce28a51260578ac259

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "0b6969a82d34233fa63c3486e73b10b7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GKTLVnwIvJ7NK%2FaQdUoqi0LwGDHWNIuWbub%2BnSW3GCl%2BjMEkW3LtYsw762t5hyP8QnxYP%2F%2FxRgZ2G8WyF%2BmFcGfGu7cH3fwt7piQrVSgE4fRe1H%2FkIXfUgi43nrDDM7s%2BinMdt6%2F6o2BfjEN1NJouaKy"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956cc9c705437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23362

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 96ms
27ms Preflight
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://swiftmoves.blog
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://swiftmoves.blog
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 15 May 2023 06:31:37 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AD9F 12 KB
7 KB 141ms
140ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e7f32322ed547ebe33ad130aab5985ebc88e8e14642783199fd044b2590f4afe

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:37 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5ec2985f-8b52-4fdd-b5eb-0ef59acd32c1
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 353 B
388 B 98ms
97ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=24022&site_id=409990&zone_id=2299318&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=5f418e7f-3488-487b-84f1-f76a1d50a69f&l_pb_bid_id=233ebd14f5b9983b&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250_desktop&slots=1&rand=0.11630420655347828
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9dd748927f9324acb22b175a0171b8a298eba0ad189483adc7e6f64da3032c59

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:37 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 353
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AD9F 95 B
625 B 133ms
86ms XHR
application/json 23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.31.0
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.68 Charlotte, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 3941b223175f846603f7fcd175386e36d37157adec49a7f1efde9c7a4d668770

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 15 May 2023 06:31:37 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://swiftmoves.blog
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 99

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AD9F 353 B
411 B 91ms
91ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=476778&zone_id=2832544&size_id=15&us_privacy=1---&rp_schain=1.0,1!saambaa.com,72000509,1,,,&rf=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.page=https%3A%2F%2Fswiftmoves.blog%2F&tg_i.domain=swiftmoves.blog&tg_i.pbadslot=%2F65889844%2Fron02_300x250_desktop&tk_flint=pbjs_lite_v7.31.0&x_source.tid=5f418e7f-3488-487b-84f1-f76a1d50a69f&l_pb_bid_id=237e05e1ca6fc156&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F65889844%2Fron02_300x250_desktop&slots=1&rand=0.08430386640656029
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 6a6abfb5d2fa0a6e3d7bdf410d3fcacd5317bda8b71789ae6845a615e33adf33

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:37 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 353
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame AD9F 38 B
503 B 53ms
52ms XHR
application/json 104.18.24.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=692500
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 699329e1d80a0ae2c9a858b1be93f32d01d857665e417bb18ba2030eb53bc611

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:37 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MuDvby1vH0lAZ0roWoVjiVrIcU5OWLtvcRM1O1hVHsOkcMOX82BURP%2Bqx861hmlecUaJg1YgOkAhkBQHKucqTlusd6iNZshUcvImMqa7vmjmPIBsPRKBF%2BiZwCf%2F3iNHxd8Azap7"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c7956cd7d8ea210-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38
expires: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ Frame AD9F 0
177 B 223ms
222ms XHR
text/plain 147.28.129.37
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.28.129.37 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:37 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 199
server: envoy
vary: origin, Accept-Encoding

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame AD9F 0
163 B 84ms
28ms XHR
text/plain 199.127.204.163
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.163 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://swiftmoves.blog
pragma: no-cache
date: Mon, 15 May 2023 06:31:37 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame AD9F 266 B
2 KB 148ms
80ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%222452f224c784e6bc%22%3A%22c070e8c2da6737a72de3%7C300x250%7Cgpid%3D%2F65889844%2Fron02_300x250_desktop%2Cc%3Dd%2C%22%7D&ref=https%3A%2F%2Fswiftmoves.blog%2F&s=329789c1-4acf-40c4-ade5-dfaa84d111b3&pv=f07e261e-4afc-48c5-ae3e-5da0c2ed011a&vp=mobile&lib_name=prebid&lib_v=7.31.0&us=5&fpd=%7B%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fswiftmoves.blog%2F%22%2C%22domain%22%3A%22swiftmoves.blog%22%2C%22publisher%22%3A%7B%22domain%22%3A%22swiftmoves.blog%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F113.0.5672.92%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22saambaa.com%22%2C%22sid%22%3A%2272000509%22%2C%22hp%22%3A1%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

bfbf89734290aa14cd3b3bd716d2832f43a7bd088e8cf650c530d6a4fa431937

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 06:31:37 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-61
Content-Type: application/json
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://swiftmoves.blog
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Length: 243
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame AD9F 578 B
455 B 95ms
94ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU533H8Y
Requested by: Host: saambaa.com
URL: https://saambaa.com/assets/js/saambaa_prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 163fbeefd94847a264436c8093b0bc77b2ca044d714377d5ea9885f2ccc627bf

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:37 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 06:31:37 GMT

GET
H3 200 audio_039.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 100ms
99ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_039.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d91a643ae704a0099625b38c644e7ef9817459442a83350b86794bf8d202339

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "5bacb966b2efd446d3e0715e2b611ff3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AZ3aL5sSTx6gkUBOoA1g2tEjgfd0ryyKt%2FPZq4807MYBpn2u4xgih9E8%2BJtUKF5ZS6pZVTKrsCimncrxQdKZ0gCAVF1ysR2a6hq%2BdzzzRDt4QMbA%2FZ2gFCbMf8sk9Rfm6jiRZxznfiNJ0b5vu%2FIRTLVw"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956cdce595437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40536

POST
H3 204 csi
csi.gstatic.com/ Frame AD9F 0
17 B 375ms
374ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=4~lhogvo6x&c=2913416228924394&e=31072019%2C31074536%2C31074542%2C31061691%2C31061693&ctx=1&met.9=5_167.3fm~6_167.3fp~9.0~3_200.3ke~7_200.0~4_178.3m5~5_178.3m7~6_178.3m9~4_189.3mv~5_189.3mx~6_189.3mz~4_200.44t~5_200.44z~6_200.452&met.3=774.3fp~653.3fp_9~801.3fz~801.3fz~844.3fz~844.3fz~710.3fz~825.3fz~355.3fz~825.3fz~54.3fz~598.3fz~708.3fz~598.3fz~708.3fz~647.3fz~965.3fz~783.3j5~598.3k2~947.3k2~947.3k3~947.3k3~573.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~649.3k3~947.3k3~573.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~54.3k3~598.3k3~598.3k3~649.3k3~947.3k4~11.3k4_1~725.3k5~894.3k5~1132.3k8_6~808.3kf~808.3kf~646.3m5~800.3m5~800.3m5~800.3m5~800.3m5~800.3m5~774.3m9~653.3ma_9~801.3mj~801.3mj~844.3mj~844.3mj~710.3mj~825.3mj~355.3mj~825.3mj~54.3mj~598.3mj~708.3mj~598.3mj~708.3mj~647.3mj~965.3mj~646.3mv~800.3mv~800.3mv~800.3mv~800.3mv~800.3mv~774.3mz~653.3mz_8~801.3n8~801.3n8~844.3n8~844.3n8~710.3n8~825.3n8~355.3n8~825.3n8~54.3n8~598.3n8~708.3n8~598.3n8~708.3n8~647.3n9~965.3n9~783.3qc~783.3qd~680.419~680.419~680.419~680.419~680.419~680.419~824.419~824.419~680.41a~680.41a~680.41a~54.429~715.429~646.44t~800.44u~800.44u~800.44u~800.44u~800.44u~774.452~653.452_b~801.45e~801.45e~844.45e~844.45e~710.45e~825.45e~355.45e~825.45e~54.45e~598.45e~708.45e~598.45e~708.45e~647.45f~965.45f~680.4aj~680.4aj~680.4aj~680.4aj~680.4aj~680.4aw~680.4ax~680.4ax~680.4ax~680.4ax~783.4g3~54.4kf~715.4kf~680.4mw~680.4mw~824.4mw~824.4mw~680.4mx~680.4mx~680.4mx~680.4mx~680.4mx~680.4mx~680.4mx~680.4mx~54.4r8~715.4r8~54.4r8~715.4r8~680.57j~680.57j~680.57j~680.57j~824.57j~824.57j~680.57k~680.57k~680.57k~680.57k~680.57k~680.57k~680.5an~680.5an~680.5ao~680.5ao~680.5ao~680.5ao~680.5ao~680.5ao~680.5ao~680.5ao~680.5d3~680.5d3~680.5d3~680.5d3~680.5d3~680.5d3~680.5d3~680.5d3~680.5d3~680.5d3~680.5d4~680.5d4~680.5d4~680.5d4~680.5d4~680.5d4~680.5d4~680.5d4~680.5d4~680.5d4~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d5~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d6~680.5d7~680.5d7~54.5dh~715.5dh~680.5lc~680.5lc~680.5ld~680.5ld~680.5ld~680.5ld~680.5ld~824.5ld~824.5ld~680.5ld~680.5ld~680.5ld~680.5ls~680.5ls~680.5ls~680.5ls~680.5ls~680.5ls~680.5ls~680.5ls~680.5ls~680.5ls~680.5me~680.5me~680.5me~680.5me~680.5me~680.5me~680.5me~680.5me~824.5me~824.5me~680.5mf~680.5mf~680.5mh~680.5mh~680.5mh~680.5mh~680.5mh~680.5mi~680.5mi~680.5mi~680.5mi~824.5mi~824.5mi~680.5mi~680.5om~680.5om~680.5on~680.5on~680.5on~680.5on~680.5on~680.5on~680.5on~680.5on~824.5on~824.5on~680.65x~680.65x~680.65x~680.65x~680.65x~680.65x~680.65x~680.65x~680.65x~680.65x~680.76u~680.76v~680.76v~680.76v~680.76v~680.76v~680.76v~680.76v~680.76v~680.76v~680.7id~680.7id~680.7id~680.7id~680.7id~680.7id~680.7id~680.7id~680.7id~680.7id~680.8jp~680.8jp~680.8jp~680.8jp~680.8jp~680.8jp~680.8jp~680.8jp~680.8jp~680.8jp~680.8s0~680.8s0~680.8s0~680.8s0~680.8s0~680.8s0~680.8s0~680.8s0~680.8s0~680.8s0~680.bhk~680.bhk~680.bhl~680.bhl~680.bhl~680.bhl~680.bhl~680.bhl~680.bhl~680.bhl~680.bhm~680.bhm~680.bhm~680.bhm~680.bhm~680.bhm~680.bhm~680.bhm~680.bhm~680.bhm~680.bk8~680.bk8~680.bk8~680.bk8~680.bk8~680.bk8~680.bk8~680.bk8~680.bk8~680.bk8~54.cxv~54.cxv~598.cxv~598.cxv~947.cxw~947.cxw~573.cxw~54.cxw~598.cxw~54.cxw~54.cxw~598.cxw~54.cxx~598.cxx~54.cxx~598.cxx~54.cxx~598.cxx~54.cxx~598.cxx~54.cxx~598.cxx~54.cxx~598.cxx~54.cxx~598.cxx~54.cxx~598.cxx~783.cz2~783.cz2~783.cz2~783.cz3~783.cz3~783.cz3~783.cz4~783.cz4~783.cz4~783.cz4~598.d4f~947.d4f~947.d4g~947.d4g~573.d4g~54.d4g~598.d4g~649.d4g~54.d4h~598.d4h~649.d4h~54.d4h~598.d4h~54.d4h~598.d4h&met.10=1_189.IJohEAAIABiAmHUoAA~1_167.IIkjEKinAgj4yQQYgJh1KAE~1_10.IIUkEAAIABgAKAA~1_200.IOQkEAAIABiAmHUoAA~1_178.IOQkEKinAgj4yQQYgJh1KAE~1_189.INslEKinAgj4yQQYgJh1KAE~1_200.ILwqEKinAgj4yQQYgJh1KAE~1_200.IKSDARAACAAYgJh1KAA~1_134.IKSDARAACAAYgJh1KAA~1_101.IKSDARAACAAYgJh1KAA~1_189.IKSDARAACAAYgJh1KAA~1_156.IKSDARAACAAYgJh1KAA~1_178.IKSDARAACAAYgJh1KAA~1_145.IKSDARAACAAYgJh1KAA~1_167.IKSDARAACAAYgJh1KAA~1_112.IKSDARAACAAYgJh1KAA&met.7=CC8QBxgBIOUcKOUcMI0dOCho5hxwjB14kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIOYcKOYcMIodOCRo5xxwiB14kAOAAWSIAWuwAQG4AQPAAZv_iccH~CA8QDRgBIO0cKO0cMLogOM0DaO4ccLkgeKNZgAH3VogB0soBsAEBuAEDwAG_3prrBg~CBsQDSCmHThEwAGs8MCpAQ~CBsQDSCnHThQwAHa4YadAQ~CBsQDSCnHTiYAcABwpKj2gI~CBsQDSCoHThcwAG9m-mVBw~CBsQDSCpHThfwAHbu8__Cw~CBsQDSCqHTg6wAH7oYnCDw~CBsQDSCrHTh1wAHbu8__Cw~CBsQDSCrHTifAcAB6fz9qQw~CBsQDSCsHTjrAcAB5IOfqA0~CBsQBiDfIDgawAHFgdy5Cg~CBsQBiDfIDgVwAGrgvSJDw~CA8QDRgBILkeKLkeMJMiONkDaLoecJEieKRZgAH4VogBzsoBsAEBuAEDwAG_3prrBg~CA8QDRgBIOogKOogMMkiON8BaOsgcMgieLJZgAGGV4gBycoBsAEBuAEDwAG_3prrBg~CBsQARgBIOAiKOAiMOMlOIMDwAGkoPylBw~CA8QDRgBII4kKI4kMOwlON4BaI8kcOsleK5ZgAGCV4gBysoBsAEBuAEDwAG_3prrBg~CBsQBiCJJTgzwAHG8bLnDQ~CBsQBiCJJTjhBMABlKiGxAU~CBsQBiCJJTjPBMABgcPZpws~CBsQBiCJJTjRBMABlvOAtgU~CBsQBiCJJTjdBMABx5Dt5AU~CBsQBSD7JDiNDcABkJHz4Q0~CBsQBSCAJTj_DcABnKjkmQQ~CBsQBSCEJTidDsABndDmmQk~CBsQBSD-JDiAD8ABkJHz4Q0~CBsQBSD-JDiAD8ABkJHz4Q0~CBsQBSD_JDj_DsABkJHz4Q0~CBsQBSCDJTibEMABkJHz4Q0~CBsQBSD3JDjfEcAB5tvzBQ~CBsQBSD6JDjdEcAB5tvzBQ~CBsQBSCBJTjUEcAB5tvzBQ~CBsQBSCHJTjQEcAB5tvzBQ~CBsQBSD4JDjdEsAB5tvzBQ~CBsQBSD6JDjQEsABi_rKrg4~CBsQBSD8JDjmEsABi_rKrg4~CBsQBSCFJTjSEsABi_rKrg4~CBsQBSCGJTjcEsABi_rKrg4~CBwQBhgBINQ2KNQ2MIA3OCvAAaHZ1rIJ~CBsQBSCIJTi5E8ABi_rKrg4~CBsQDSCLgwE4NsABrPDAqQE~CBsQDSCJgwE4XMAB27vP_ws~CBsQDSCIgwE4ZMAB27vP_ws~CBsQDSCQgwE4YMABvZvplQc~CBsQDSCHgwE4jgHAAen8_akM~CBsQDSCIgwE4hwHAAcKSo9oC~CBsQDSCOgwE4lgHAAdrhhp0B~CBsQDSCNgwE4tQHAAfuhicIP&qqid.8=CPCk59TZ9v4CFdAbwwodIQwHtA&qqid.9=CLns-dTZ9v4CFUENwwod6gUD9w&qqid.10=CMfNk9XZ9v4CFcsSwwodoBAO6Q
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:38 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame AD9F 107 B
122 B 38ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AD9F 107 B
122 B 35ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AD9F 26 KB
11 KB 236ms
236ms XHR
text/plain 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2913416228924394&correlator=4142867387780268&eid=31072019%2C31074536%2C31074542%2C31068825%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fifs&iu_parts=65889844%2Cron02_300x250_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=11&adks=1517229526&sfv=1-0-40&ris=16&rcs=1&prev_scp=hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_adid%3D24975df47d18daa8%26hb_bidder%3Doftmedia%26hb_format_oftmedia%3Dbanner%26hb_size_oftmedia%3D300x250%26hb_pb_oftmedia%3D0.00%26hb_adid_oftmedia%3D24975df47d18daa8%26hb_bidder_oftmedia%3Doftmedia&eri=1&cust_params=domain%3Dswiftmoves.blog&sc=1&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&abxe=1&dt=1684132298067&lmt=1684132298&dlt=1684132281049&idt=862&adxs=1070&adys=1074&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=7fu6yum5029c&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fswiftmoves.blog%2F&ref=https%3A%2F%2Fswiftmoves.blog%2F&top=https%3A%2F%2Fswiftmoves.blog%2F&rumc=2913416228924394&rume=1&frm=23&vis=1&psz=300x250&msz=300x250&fws=384&ohw=0&ea=0&psts=ABHeCvjGTGM6VQtYDJOhfQLdy3ZH4muBoYecKZxHXIzyJoTILnYjYewBtHT2YaJ0yiswIqM6zeV_69hf0ndAFJ-se25a2wrs%2CABHeCvhG8nTnBGknJ-nmKLuXW9BKI1v5_S83-OE_I-v5zUpeBCSivbFvSC-KzdJK4AXDHTYvjrlQ00cuh1OP6Z7bHOIwkheJgkfuPk0%2CABHeCvhbNkjF3LrpFe-1wYs2ZaV8cktmPxfZRoe1aLV2GL3csnJ7Ora7co1wQ7kJ3r41n06jCxvAnMM3oohhUnrQ961wLK0d%2CABHeCvhS0pJYIgbubKkj3-a_Cp-VEfAkkOL1Z2DZBJ53L_6ydz4tTnkNI72GHfBuQu9Ih4cO6cy3ZZb-wuhoGDHNim5Sh6uUjKhH-F8%2CABHeCvisP77ipA7kXsDpaR8U3StI_MWtCArY0tV7tp74qcY_Xz5scK-Q821i4X621ohLnZs-1rlYzRobuceRpzaoHCbK_qKQTd_nSks%2CABHeCviPh82bWNYfdJhtl8mytIEyAI7bI80ui9yHxwRexPlsnnNKXmEC0b5zLXXVmguKJ_rI8GbNlfYovWUJEFKWnbhoF94S%2CABHeCvjerhFxy3RQTyTn72H9i5Ys0O76FjW_VdHdfO2-UDzRAudxjmIcAUBVknguF_B-6jtFJEbZx87G5rgc-GPPKFwAaTUd%2CABHeCvjNng-0dqP1VnZUg843ObToI3geUE-asPaR2LVjTz4zEnr4KrcscG83reWwyUF-krpXShE04TVO3nl_GI9BdZmTpad1%2CABHeCvjK1CkE2lNHlpuU8W-uk3VXajmwkJuI5mR-cTeYsOsMDGAj8LFV66vTWWQz7NTZPEw76G9YnsnBOD54OITu4Z-8eLGd&ga_vid=1420665221.1684132273&ga_sid=1684132283&ga_hid=948170489&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjb3ezwgTFIAFICCGoSWgoNY3J3ZGNudHJsLm5ldBJAMjkyMTY0NjQ0Y2M5NmFlMTY1YTM5MGFjMWU4MTE2ZDUzOTM4ZTNjY2Q2N2QwZDUwYTIzYWVjMjA1ZmU1MWVkNxiM3ezwgTFIABLCAQoIcnRiaG91c2USrAFEblUvZTIyanpwNzZXM0pXNmdoaUNvTUlsdy9Rc2UzZHpZdzQrWUdMeWRnT3ZocXlFSmcwR2k3blpSV0lVZDdhby9MR0c0Sk85UGRaQWNaNGxSZ0FlWFFQU3IrSk43T1N3TXFCbmZYakdHYzlPSGdNUkNRKyt3a0ZrMWwxMU1GdVp3VWJYWXkvYk1TRUhvTHZPMWJrbElTeUZGekZCYjd0dUFCOWd6QzlIems9GOXi7PCBMUgAEhkKCnVpZGFwaS5jb20Ysdvs8IExSABSAghkEhkKCnB1YmNpZC5vcmcY-Nzs8IExSABSAghqEtYBCg5lc3AuY3JpdGVvLmNvbRK6AXdwX1dfRjluUmlVeVFtTTFSVTVMTTBwek1tbDNja2MwYXpFMFJ6RXpTa3hXVUcxVFJtSWxNa1pvYldod1ZXbHhUalUwZVhCYVVFVjZOMFJNUTNWRVowWkxhM1ZSVlhSMVZuVldSalZWZVcxcmFFSTJUVFZJTnpOMVZIVWxNa0o1Ym1wS01WSldXbGRMVDFSNFYweGlWMnRyYUhCRFNVTlJSWEZOVkRod1NIaHhSemhCWVVaMFluTlBTURiG3ezwgTFIABI-CgVvcGVueBIsZXlKcElqb2lZVGt4YVcxcFoyTkNTalJZYkVOVmRubHdSWEZ2WnowOUluMD0Y0d3s8IExSAA.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d81c0604616bfa092e85f50de0923cf3165106d6fb492c6fdd0fa429cfa41e80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11239
x-xss-protection: 0
google-lineitem-id: 6298503960
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432760692
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET activeview
pagead2.googlesyndication.com/pcs/ Frame A31A 0
0

POST csi
csi.gstatic.com/ Frame A31A 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 66D3 0
0 41ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv7nPV79ruO3wyfp0KhybUKwoivjzf5S_ut91sVSI7PGi_a3louylhaupx4MXmX0xqqS4g6CKcKudAxJDwrm9VHPnn4XblKMB2xG-09Y30Wdg8Y6A3m5hVag5l2K4ZXy0Ok3PvTpUA-uki8VD7faacFbZhJtjQwPlUkBRsDHXlilAfvPowOYA4v_DWOY_2-sHz63OtzNxn9BgCUkEm_WiccNDM3k6WMHk_42bqGRpheNVMJiEqTX4lAMxIS9jxLabNAlhLGp89QUQGEJUrRraYjm43w7orcp_e03Wv2Dx3jgzZqJAK_zGWwmWXRFtwX8Am8yg7GAdR7&sai=AMfl-YT-0cXIpJkxizOqsHDOqtSzdj66c-3dq3vbHqCeVHmUHDOxcIk6I6fFBV0vf7-9diTps4t28nqvLpQXaozNSHamevBmnMPu1q9mNrHhsFcATiG-GIqZ06j7quIKlSw&sig=Cg0ArKJSzHQCKToew2_TEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 66D3 91 KB
32 KB 45ms
43ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32d2331823d74f39deb9fe3d75787313c5d589f6488cc779df621a449a8d473d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32492
x-xss-protection: 0
server: cafe
etag: 11602229206464650544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:38 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 66D3 169 KB
52 KB 37ms
36ms Script
text/javascript 2607:f8b0:400c:c11::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:38 GMT

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/ Frame 66D3 356 KB
120 KB 60ms
60ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9772d773ec6626061fdaa5e621c25d867337404b23afa672534901ea01be4a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122652
x-xss-protection: 0
server: cafe
etag: 7540503530294456644
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 May 2023 06:31:38 GMT

GET
DATA 200
OK truncated
/ Frame 66D3 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a078c316b3146b187a5e4d02dac04fa4731b90146880815e052a2949779c2cdb

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 66D3 12 B
53 B 37ms
37ms Script
text/javascript 2607:f8b0:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=swiftmoves.blog&callback=_gfp_s_&client=ca-pub-6552175488733768&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c0a::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ Frame 66D3 107 B
122 B 38ms
37ms Script
application/javascript 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 66D3 107 B
122 B 35ms
34ms Script
application/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=swiftmoves.blog

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AF5D 603 B
65 B 126ms
125ms Document
text/html 2607:f8b0:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6552175488733768&output=html&h=250&slotname=ron02_300x250_desktop_house&adk=2514721436&adf=1742773268&pi=t.ma~as.ron02_300x250_deskt_&w=300&lmt=1684132298&url=https%3A%2F%2Fswiftmoves.blog%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1684132298401&bpp=4&bdt=74&idt=93&shv=r20230510&mjsv=m202305090101&ptt=5&saldr=sa&cookie=ID%3Dc3d5bdea959cb6c0-22c84b79f67f0072%3AT%3D1684132273%3ART%3D1684132283%3AS%3DALNI_MbK2SejmO-dS6y1nVruiuMVrhspsg&gpic=UID%3D000009f300a8a01a%3AT%3D1684132273%3ART%3D1684132273%3AS%3DALNI_MbzPskvuCiIqiF72fbyJ5QAlGyc4A&correlator=5765839120568&frm=23&ife=4&pv=1&ga_vid=1420665221.1684132273&ga_sid=1684132299&ga_hid=1945705526&ga_fc=1&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1070&ady=1074&biw=1600&bih=1200&isw=300&ish=250&ifk=928272217&scr_x=0&scr_y=0&eid=44788442%2C44789779&oid=2&pvsid=3831047940934118&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.jqufm3rc7lhu&fsb=1&dtd=102

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c06::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 66D3 0
0 40ms
40ms Fetch
image/gif 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuoBJdV3FeS8NS3Cu0sjaP6wgQ7X1hf61a6GOfnXivj7_ydz2FHGl4vt9EFYodPEvX2eAmxxVG0MIHKaXFmonOGr_PCu1iXnIAkssyYNfDGpOFhR68L6mkgOpkhrL_KhKiyBldPARoKuvDI3pA_StFtOtWhk4o-EdqC4_XkQe993VnR0MMYmE1Cyl7Rsg1g0qkm6MZHnunEtt4r2LKCYRyuhHx8Y563cJr2NBZQXpWiksUy5SsuvAhVM89-r34GyShruQkYES0Y12D3NgeV6QMoMsmRVOKdXsThlRnp7UTPacISpMuUPYGOvSlj-nP-u7m0dp6VkWL-VQI&sai=AMfl-YQiPgNKha6OR49HpTGWMiws3S4nVw1t3s6t1o2apTCJ4vZ91bjLsLjX5f1BaFmzgnPCqjFR3aKKI9IoJH2EDPkoSOdytFCL22Qu7akb3PESSC-ijzsileAo4ph_Sv8&sig=Cg0ArKJSzIqcv6Kl3l8QEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 06:31:38 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 66D3 15 KB
11 KB 44ms
43ms XHR
application/json 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b1a3c31e81e90346fe43455c8afa1c78e3a11a71b0c1aff6ed673e052fa083a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11252
x-xss-protection: 0

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 66D3 61 KB
23 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c12::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: swiftmoves.blog
URL: https://swiftmoves.blog/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c12::9c Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34787464e140d5204aaa1d5582db39538f3cdb2ff72e17daa2b88bdc739b0d81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1683
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23385
x-xss-protection: 0
server: cafe
etag: 3962869941991229512
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 07:03:35 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 66D3 17 KB
6 KB 36ms
36ms Script
text/javascript 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305090101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 06:31:38 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 66D3 0
17 B 370ms
369ms Ping
image/gif 2404:6800:4002:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lhogvye5&chm=1&c=2913416228924394&ctx=2&qqid=CMn3iNvZ9v4CFUENwwod6gUD9w&met.4=fb.a~lb.2n~ol.8s~idt.gp~dt.-79&met.3=739.2n~1032.4n~738.8m~749.8m_6~736.8z~740.96_1~735.97_1~113.av_1~112.au_1&met.1=1.lhogvy3c~14.0~15.0~16.0~17.0~18.0~19.1~20.1~21.1~22.36~23.36&met.7=CCIQBBgBIAsoCzA0OCloDHA0eKwCsAEBuAED~CAIQChgBIAsoCzA6OC9oDXA4eJiAAoAB7P0BiAHV2AWwAQG4AQM~CE0QChgBIAwoDDA1OCpoDXAxeNWkA4ABqaIDiAHExgqwAQG4AQM~CAMQChgBIE0oTTCPAThCaE5wigF4yMAHgAGcvgeIAaWhFrABAbgBAw~CBsQChgBIKsBKKsBMNEBOCZoqwFw0AF4zAKAASCIAQywAQG4AQM~CC8QBxgBIKwBKKwBMNMBOCdorQFw0wF4kAOAAWSIAWuwAQG4AQM~CC8QBxgBIK0BKK0BMNEBOCRorQFw0AF4kAOAAWSIAWuwAQG4AQM~CAUQBRgBILIBKLIBMLICOIABaLMBcLECeNoCgAEuiAHbBLABAbgBAw~CCIQBBgBILwCKLwCMOUCOClovQJw5AJ4rAKwAQG4AQM~CCcQDRgBIL0CKL0CMOkCOC1ovQJw6QJ4oFqAAfRXiAG5dLABAbgBAw~CCgQChgBIMoCKMoCMPACOCZoywJw7gJ4hbkBgAHZtgGIAcrqA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4002:81c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:38 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6EB7 13 KB
5 KB 37ms
36ms Document
text/html 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 118248
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 13 May 2023 21:40:50 GMT
expires: Sun, 12 May 2024 21:40:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C6F5 783 B
535 B 41ms
40ms Document
text/html 2607:f8b0:400c:c36::67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c36::67 Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

bf6f3f3250f3dffe24f91557ab8bc2b965d50ecdd2ebb4e8ff6f1cc680c4563f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AoYL8TIT34MRMHPVhiCi8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swiftmoves.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-AoYL8TIT34MRMHPVhiCi8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 06:31:38 GMT
expires: Mon, 15 May 2023 06:31:38 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C6F5 0
0 38ms
37ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=3831047940934118&rc=
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 6EB7 37 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 00:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540929
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 May 2024 00:16:09 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6EB7 0
12 B 64ms
64ms Image
text/plain 2607:f8b0:400c:c11::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?NAw8Nw
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c11::84 Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:39 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_040.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 80 KB
80 KB 200ms
200ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_040.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42e58aa5f875c3b534824489d8619c4080db1e2440c007e764fe5302d7d9f554

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "db8ea1921d9162dbdb96e12849454743"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q2X2PNq5owaeuVOedxNy9s8TDAB7xN1SD5fSNOn9AvVVkQ7rNWIVRb8hQxRhDKldKCLIiYe2GmQ8GN02Xp4UBZsNr2XVZ0lGUAf4L8lauDvk0VBRg7%2BIC8%2BZj3GxGotYXd3YFY0XrxIortSSSxb2yUdO"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956d51f735437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 81649

GET
H3 200 audio_040.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 39 KB
40 KB 137ms
136ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_040.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb241ebd2fd5f983d0208cb84c4e0dac253eda86199254e0481b698d68f214ec

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c595d2abf9b5ae7adc299a00fa7cf4eb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZAPmuwhcWWyeQjm8XA9s6Sivwc%2FNhGGvr7%2B2Ktirmk9b3B7sK2qHZZX3QiFQQff1OWQDC7fb7DntYt%2B77lxxjgpLaS0noe7NnG6MqKuyLoDHH2m2tNmg3au32IByxLjXdscZU7YrHxHnmQvlZGZhKiGc"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956d56fd95437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40410

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 27ms
26ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:39 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: c27aa3d3-92b3-f70c-d7f9-a613467b90fe

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 66D3 0
0 38ms
38ms Image
text/html 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=3831047940934118&bg=!AwClAFTNAAYldGN0BXQ7ADkAdvg8WkvEagxMbA4NR8XQHMOVz0rmBOOLrGUNIL-TSwAfz1SzsqiJAd98b7iMDGJ00sqMaBD0pnACAAAAj1IAAAAEaAEHCgClkmeL5YOWfiIrnxa0tT8tIVdltVYQy15xeBK2HDNeXxycTTa38uhtn17n-2WlsBDpHxm_gCeWJy-9pXu6OSXteJrNy0hvPr1Fsmm4rdqqQdib05qJMfm48Tk-ZWYoIdN4QqiQZeLphLnSUd-VpVDia2rk5kF3mp5d55hpC9kUN0-z6T7inMzNiO4VtGbrmJ92MzE7fgS6RjBDZzmcd4hI1Dg7fvwSmQLLDA_EnIZ7eG0odpC1f9CAhJJA1hToe2_rbj7sCuEF4X_3644XgOYJI9pcFnASNUFqAJh_aF3h4BT7Mc4MDVpEp-Dx8YEOFCfiedQ0Dw2FDzBF7UbhD7AtEKAA1hGmTsMlQxdYg38o58uN1dZfc58tfH4UGZOGQk_1OHlS0jJytL1Heb1gZkXWFjVUY4rFuBtY6N4uakRpMiI0AjPewDG5PvJF3TcFpUYwMaygDuKA_bK7FzN_GAWEeyxPV-7Xwr8yowmdpoGa6IDQreCzb7gWnW34CHOSIDGR_HVqS86I3gqIxzpHRpH0HKRsZHGcr4BmEzKUnm6byxFB7XEV5ugVc_zK_G4fKLeX_yf2cmXQvQuOWEaDVT-C6DbhEnRFDKSj3ro2_yG5Akr9ocvhhfkO7wAqwb45GUiuP0pbeKzgngN-rCnBSJWub4KavSDNrLuRMTPC3L6Z_ZQGC8BxGHRNdhAj5Ow7kWOqNFv9SMTRc63BKF15Gq2ZXGgAreCYLRETYn-K7p6BaToQk97XQYUoMwEx0Y3LSpiNRrZEFH_UqHKBu5JCdNX7MqszszC3rAivJD_jwJ1FkzVeD1DJ5zqzHNJ9U8aqXWyz4y5UzJcgdJSyNMFpvL8QLhpfGFx7Lxh0Cbcd4_UR9IHm_MzLWcfjJhusKcFSIFMMG8J-PHTRp2XElFTn2TRAeO7abEooHgKLgO0s5r9P-mbOHDQpliNwXFJt9TPNZ-oEtUXhwc66fJyh47mkq8dfH25USIAVHfGnfNRa97BIvn8DO_DTmOnJYxhuJmopjq-qbvrhvMzLCgteKqx07HFKRPSyJ20YoF6UF_NdmkT1UTx7r4SKzXQkOELDRkcJ4iacl04j9fVN0uk0hyvNANaFsJUKvK9115Onbr5OI2A5bmXPFO6L30kc5Q46AovJm8zVqwfG2qywjK12VMC9akjkpW34EQ
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 66D3 42 B
64 B 37ms
36ms Fetch
image/gif 2607:f8b0:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsujgNV8DotEYhRKk7oCnAJIQ2b66GuBcaquOA9b-zvUIbBRKfRM58JWVYoYKLatH5RRK795yFDBBr7P5Z2wx7EisBxexB75x2bfMdEwodpSMeGaZ8g_&sig=Cg0ArKJSzNJ13Mc_vz54EAE&id=lidar2&mcvt=1001&p=1074,1070,1324,1370&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&v=20230510&bin=7&avms=nio&bs=1600,1200&mc=0.5&vu=1&app=0&itpl=19&adk=1517229526&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684132298328&rpt=310&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400c:c00::9b Charleston, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 79BB 208 B
425 B 32ms
32ms XHR
application/json 35.169.170.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.170.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-170-239.compute-1.amazonaws.com
Software: /
Resource Hash: d659b02a29e25c0807497f72e47fbe301f0788602a31559102f672692a71dbed

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:39 GMT
content-encoding: gzip
x-prebid: pbs-java/1.118.0
content-type: application/json
access-control-allow-origin: https://swiftmoves.blog
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 190
expires: 0

GET
H3 200 audio_041.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 40 KB
40 KB 252ms
252ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/audio_041.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a936b69f963ab48c851979d56a6b7abffdfe88fd09e6c8549a91c77798c286d8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "ac6c5ca48b052412e2e9afd1da509b73"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SU872s4IJEdoidFN%2F1c4HSQ%2BWREVzivLovj7cS7W%2F29Ro5eruYOUQAdQAUfcJEzyor7kqgpbeTBodMDZOyXUJll0R3ByZnF128SZkYXdoQcnkd3AcHDhMpD5Wv46tXcMuJ4s71dH5OvtVtPwyEgwDvnZ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956da0cf25437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 40865

GET
H3 200 t1660268611_03_640x360p_30Hz_800Kbps_041.m4s Show response
streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/ 99 KB
100 KB 140ms
139ms XHR
application/octet-stream 2606:4700:3031::ac43:d4fd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.humix.com/contents/ulLnJckpJPgushqs/1681584557/t1660268611_03_640x360p_30Hz_800Kbps_041.m4s
Requested by: Host: swiftmoves.blog
URL: https://swiftmoves.blog/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-8y28-58y2b-131y2f-137y33-4y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=139&sj=x04x02x06x07x1dx0bx0dx17x1bx20x21x24x23x25x26x27x28x2bx2fx33x3ax3bx5dx61x68&abt=PrebidHighAdxFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:d4fd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37c9a387169b7c58b1f9b9b7c5b94cad984c16bb260ee66679b63ad84c40d348

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://swiftmoves.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 06:31:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "beab81cc3745d47a5a789af2243438c9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J9gm9TrLfyd2BJ%2FqSYGlvPEq4o7Hi%2FqS7bPi%2FLc8NJYMZM4uaWj6MNwJSVeFc9XYv5nnkw9O5yDHAxRb6mecMeBRHSH0si1nY37dB2ehrnDZwlznqw0e%2B8JKhwb52z%2FOTPiEpuaMpaTIevxHVtmYje8x"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 7c7956da0cf35437-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 101790

POST
H2 204 prebid Show response
prebid.ad.smaato.net/oapi/ Frame 79BB 0
254 B 27ms
26ms XHR
text/plain 54.211.179.123
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.ad.smaato.net/oapi/prebid
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.211.179.123 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-179-123.compute-1.amazonaws.com
Software: SOMA /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://swiftmoves.blog
date: Mon, 15 May 2023 06:31:40 GMT
access-control-expose-headers: X-SMT-DivId,X-SMT-SessionId,X-SMT-ADTYPE,X-SMT-Impression-Measurement,X-SMT-MESSAGE,X-SMT-Expires
access-control-allow-credentials: true
server: SOMA
x-smt-sessionid: 28111de4-80b6-8953-3e9c-a1431ab8257d

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 79BB 968 B
1 KB 100ms
99ms XHR
application/json 23.105.12.131
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.131 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: ec4665f57756b8dfef745e10fdaf19bd71b3a4d594fba5fbe27d90d35209417a

Request headers

Referer: https://swiftmoves.blog/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 06:31:40 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://swiftmoves.blog
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 79BB 145 B
1 KB 109ms
108ms XHR
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/1.0.802/prebid/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS