www.websleuths.com Open in urlscan Pro
104.21.49.31 Public Scan

Software

cafe /

Resource Hash

3036d383495323334b1311f11b28f2e62457de02bdc5a4ea9b96c6d43598cfb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.websleuths.com/
Origin: https://www.websleuths.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49504
x-xss-protection: 0
server: cafe
etag: 17671493129505048321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 16 Dec 2022 19:12:50 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 243ms
97ms Script
text/javascript 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f10.1e100.net

Software

sffe /

Resource Hash

e4fc6dedab5e13fa9350b36a3936cce18bf68d6e58c048b02806ed9e42bbe0b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27543
x-xss-protection: 0
server: sffe
etag: "1423 / 843 of 1000 / last-modified: 1670587517"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 16 Dec 2022 19:12:50 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 423 KB
127 KB 227ms
104ms Script
application/javascript 172.64.203.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=adpone,adtelligent,adyoulike,appnexus,criteo,emx_digital,medianet,nobid,onetag,openx,pubmatic,pulsepoint,rubicon,sharethrough,smartadserver,yahoossp,yieldmo&cb=195-0-50
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.203.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4278836d797d11d9f28b382e86c04e7377d4e30f64165673b925bb78b8f9ff01

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 16 Dec 2022 19:12:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZwZE%2Fjk9KZrP%2FXxLLh6BNCpOX%2BCJuNykPSc%2B%2BLcDrFrLSUpM75qO5oxJ4Fhmg7aHBTgp%2BAh%2FD01JWTIK0K0%2BEIgybzM39vBZx7S9l71%2Bf01EAw8gXSYT7kJ30TKkUCY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 77a9bb9c7a28b77c-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 fads.js Show response
www.websleuths.com/porpoiseant/ 8 KB
3 KB 66ms
66ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/porpoiseant/fads.js?gcb=195-0&cb=6
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f08bda7e60fadca736bd7ed81684d6dd9bd11951aada10c84e66cbeac3c52197

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 21:35:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6039441
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fe%2FQFbNvn%2FDBf2iloU8eg%2BtiWdgvygmmljHnfv%2FsZ%2Fu03k4RuY7Ophk9V2VP%2BF2Z6xvbUBqed5GsbTNpKYJQve0VjH2UrCJ%2FyR5%2BdxcqqjQOsgb%2FaaEYJ4fmddz%2BG58g4pkzsOQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bb9ba962b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 banger.js Show response
www.websleuths.com/porpoiseant/ 52 KB
14 KB 50ms
48ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/porpoiseant/banger.js?cb=195-0&bv=169&v=68&PageSpeed=off
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e5d13f0d227bec1531dc07f0af50ab486a3a9cc8595e3bc05ec2359536fb7aa

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 15 Dec 2022 22:19:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 75184
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oEanpFkbyCX30L0T3kROIUJeKfcGSN6J%2FUTHFQpM2AF%2F1naRjsgvkGuk%2BXsDxgeqch96IHR3%2Ftg39LumHKsF89owzo2xulHH3%2B%2F2ywUBlKIFYPgJ86%2FuqVv1a8VMscL5I%2BIddUA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bb9fff45b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
75 KB 249ms
131ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VN28FK7QFE

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

04b48bb0cec4a23ce0535e35a9af3fb0c13f4b25c88fa9ade5c94a5605229786

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76897
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 16 Dec 2022 19:12:51 GMT

GET
H3 200 fa-regular-400.woff2
www.websleuths.com/forums/styles/fonts/fa/ 165 KB
166 KB 44ms
41ms Font
application/x-font-woff2 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/styles/fonts/fa/fa-regular-400.woff2?_v=5.15.3
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4de49631fe60b17010f7cda29a6236ca6ad6102ea204e5c31d2c1e79ee276938

Request headers

Referer: https://www.websleuths.com/forums/
Origin: https://www.websleuths.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 16658633
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/x-font-woff2
access-control-allow-origin: https://www.websleuths.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HPis%2BLwWUF3swlX4NDLUta6lhevnvOy0ZSFn9fKrc1EfA6s3vZ6KJ652X7dJZNy2UHJXlTCiW2syV0jSl8%2B2nIHE0nprT2Y0MypHhGQGOsbDgun8HHAbasm9PnTaVsHmctnDHx8%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
cf-ray: 77a9bb9bd991b4f9-OSL
expires: Tue, 06 Jun 2023 23:48:57 GMT

GET
H3 200 fa-solid-900.woff2
www.websleuths.com/forums/styles/fonts/fa/ 134 KB
134 KB 55ms
52ms Font
application/x-font-woff2 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/styles/fonts/fa/fa-solid-900.woff2?_v=5.15.3
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 943efdb4b38963df0653d778f233b55db3e19f44794e4ff944e33b8849dcdb3c

Request headers

Referer: https://www.websleuths.com/forums/
Origin: https://www.websleuths.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 16925056
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/x-font-woff2
access-control-allow-origin: https://www.websleuths.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=89MK43kYyg3qGBXO%2BZd8q61VoOBJKeBvRp5G7QpZcfQK1lhndbUccXUY2%2FGvQMb03wrqPtDnjf3MZfsVCD6W6ctyceVmAb97jj6mjbbTfHEzeJTsPeDcx5MYzTlg5SgkqGgGSzY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
cf-ray: 77a9bb9bd992b4f9-OSL
expires: Sat, 03 Jun 2023 21:48:33 GMT

GET
H3 200 fa-brands-400.woff2
www.websleuths.com/forums/styles/fonts/fa/ 75 KB
76 KB 139ms
137ms Font
application/x-font-woff2 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/styles/fonts/fa/fa-brands-400.woff2?_v=5.15.3
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2497d559960ba9e1c68f41674e8bc980d3b229155e068bc7f42f157f81c4388

Request headers

Referer: https://www.websleuths.com/forums/
Origin: https://www.websleuths.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 3360253
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 02 Nov 2022 19:36:03 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/x-font-woff2
access-control-allow-origin: https://www.websleuths.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JOvP51KVE%2BJno%2BeTMb4vFgZ2xJsCOSrV55HJYbLWd7mC0SZT66QFrMBJtiF5AT%2Fez1MhXH8k3DiC3EDnHjrUI%2B9Kte4siYHNpQ%2FKKd4mNoLR2qpQkn8JdI%2BrV9kNdfKlaNKBBgM%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding,User-Agent,Origin
cf-ray: 77a9bb9bd993b4f9-OSL
expires: Tue, 07 Nov 2023 21:48:37 GMT

GET
H3 200 css.php
www.websleuths.com/forums/ 389 KB
64 KB 584ms
581ms Stylesheet
text/css 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.websleuths.com/forums/css.php?css=public%3Anormalize.css%2Cpublic%3Afa.css%2Cpublic%3Acore.less%2Cpublic%3Aapp.less&s=4&l=1&d=1667220051&k=eccaf5c7aba861deaa2acfcb9d6cf85ab8266f88

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83f56b358e7d1964122f5f2e09f699886215445edb83a3ac6ce6fe9a1df52d20

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-sol: pub_site
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hKiuRBwEOY%2FV29uTqLNo6g6t8ndEOkgkNJ9oNowwy2SSCga3ed3yJ2s0qkqKkAGP%2BoNMzbHKy%2BitWN%2FcyAx4YheoVd5%2BuW%2F3FfxBBpL7E%2BfAhIMz5FmY3pjNqvkPp%2F5wvj9q4Rw%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000, max-age=1, private, must-revalidate
cf-ray: 77a9bb9bd994b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:50 GMT

GET
H3 200 css.php
www.websleuths.com/forums/ 11 KB
3 KB 440ms
437ms Stylesheet
text/css 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.websleuths.com/forums/css.php?css=public%3Anode_list.less%2Cpublic%3Anotices.less%2Cpublic%3Aextra.less&s=4&l=1&d=1667220051&k=5b26746966f0490616b7209e9313f13b38dba70d

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3372c6027f8696210658d11ac2ebfac6976be77131598b54a7d76f69e4c91fab

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-sol: pub_site
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5AIY8ad9YPt%2BwXLwtQ9GkX674f5aAUBEdlvtUIAYrPRK2sQ4QKK7ya1h3VpKOuslCdmiOirMiDVy1bqVROqZu71xLA1wHglf0MybEl92txbVRa37C14dKwsHLdqdgh1Q7g3VGe8%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=31536000, max-age=1, private, must-revalidate
cf-ray: 77a9bb9bd995b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:50 GMT

GET
H3 200 preamble.min.js Show response
www.websleuths.com/forums/js/xf/ 3 KB
2 KB 388ms
385ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/js/xf/preamble.min.js?_v=aef9e5bd
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8f0d5e29e4408e8ecdccee5e73a185566774f71c7f440cc50ad5c647b127ce3

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TX5VphL6UmAhxa5WEnCu3omS4GzQZKBlNZAjJjm0uVxzYwhh1n6md0JfReXFyV8xE62ieotyQ6MXddJbxgcd7QhhrCqBXCUwMLzn3N%2BC2QZcjDrDCFrzW3JMXTKaoJdeuNL2aGc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, private
cf-ray: 77a9bb9bd997b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:50 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 112 KB
44 KB 181ms
64ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-7620263-1

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

380a84ed7f573c0bd7f274789c9077f74029b490ccc93fc58c5036c12878b0a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 44671
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 16 Dec 2022 19:12:51 GMT

GET
H3 200 cookieconsent.min.js Show response
www.websleuths.com/ezoic/ 4 KB
2 KB 147ms
145ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/ezoic/cookieconsent.min.js
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 16658634
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
etag: W/"11a4-5e0698f2f8f80-gzip"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lslf66CKJ%2Fhb%2BDYFIAtRLH%2FEjL67Oh%2BdGaNGVhmGBvnRZ4YqmZYAJlApJHdV3vWnDnJ47Kr4nkT34LCX3tjRgHlvVLnso4h4nXrKWjR0WAx0bjbjSloG31OpVn0dpuH9cGg27Gc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bb9bd99ab4f9-OSL
expires: Tue, 06 Jun 2023 23:48:56 GMT

GET
H3 200 wslogo.jpg
www.websleuths.com/forums/ 16 KB
17 KB 45ms
44ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/wslogo.jpg
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3631ef5eb1a9c8c8e7d184bb6e772e6941102017c3f754fb2edb5750e98bca14

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 16925057
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DVKSPXEddr2prtYf2qKduNhHrf%2FOn3hX5cuX2Td8NHsAb2BZ1%2FoRczgfVmRfFrfyQ3LyXr6LJqxHxXaXNcBNKQ3CTfiQHmWLcqjzpRZQPJt%2BR8akfar30G%2BosKByM%2FceIl%2FNhYc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bb9fff47b4f9-OSL
expires: Sat, 03 Jun 2023 21:48:34 GMT

GET
H3 200 subnow1.gif
www.websleuths.com/forums/videos/ 7 KB
7 KB 42ms
41ms Image
image/gif 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/videos/subnow1.gif
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76e6fcc318b4b824350199d08bc2cde6a51bc7e2b5e92381e0daf6ba24ee75a4

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 16658633
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rLU0%2B4%2Be5Cm3tGVXaY7CToxE75F87uL7DJxqVhqwGc80n9KBd5g47ti30mceiT0l9rhrAF3vfNvMggKGhDvV5BDbcOo71DV5LPvPSZq9fBCARZS3oMLYSJ7MzXULJM99Cdwzkbc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bb9fff48b4f9-OSL
expires: Tue, 06 Jun 2023 23:48:57 GMT

GET
H3 200 oopsmissed1.gif
www.websleuths.com/forums/videos/ 7 KB
8 KB 44ms
42ms Image
image/gif 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/videos/oopsmissed1.gif
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c9c728090eb0dd812ae4cd306d81315f64bf3e84f0d92f62f07788eb212a552

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 16653318
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f8WmVPcQ%2Bg7hBzhQsOtST2WDjCYRNZIubJbG%2FMS7uWmBJ6OtgClOGCELq6akmE1eQtheUYjpOJOFmfKBVsNTinLvfDzJcsA86yOiaDcMuZLH0A7apYQFaezHdQrxBlHa9Fbms%2Fg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bb9fff49b4f9-OSL
expires: Wed, 07 Jun 2023 01:17:33 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 175ms
56ms Script
text/javascript 142.250.186.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 14:38:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 275635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Dec 2023 14:38:56 GMT

GET
H3 200 vendor-compiled.js Show response
www.websleuths.com/forums/js/vendor/ 43 KB
13 KB 482ms
481ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/js/vendor/vendor-compiled.js?_v=aef9e5bd
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3507ca14c84cbffccd872e634a84d93f50882c817e66ffdf2643a7ed884a205e

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eExqvjEcxiJexTDBbfbTiLjMG0RExtP1eu0CTNsibG76anukVcO%2BBrT8UfSGKkV3qitBv1Gu7vAXyzaXm4uXi4QqpkOu3A7eU2fiiVH7K1IJsTAShS7%2BW2vqr2gmCBm%2BWx26nms%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, private
cf-ray: 77a9bb9fbef7b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:51 GMT

GET
H3 200 core-compiled.js Show response
www.websleuths.com/forums/js/xf/ 207 KB
61 KB 621ms
620ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/js/xf/core-compiled.js?_v=aef9e5bd
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f80c38460fd41d1adf2d7f4699ad6836f73cb5e21c021322596d05c2bddcd1aa

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j1yOQp67zUSVbPAlNLoHU9zqgvWZ3Wpxyb9i4%2FRPTwOf4mYzkrPRo1DSZU45q0CYA72y4MHza99oAvfQDjvJ0bxzCvRSjEvPCqKfqaR6Fw0fXQSjo3SkhJWkE5ThzvAeJYrG0v0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, private
cf-ray: 77a9bb9fff40b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:51 GMT

GET
H3 200 notice.min.js Show response
www.websleuths.com/forums/js/xf/ 3 KB
2 KB 377ms
375ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/forums/js/xf/notice.min.js?_v=aef9e5bd
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfe3ecad86362036bfbf2e0d2bc27a6a593cb0fff32a97a5b1b5f81b409a3bb6

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TCcGw3TnssqAOcZV1kBi0uMZPYcbmxg211AOVFtFa1%2B2duFutJjRnufQnAOYAuqgVxFAwrDN0pM9PRFUQXbtF4gvPSIad8dsn6AFdIIx0Pw4%2BF74NMAfHD4B4QG8RjfGmxjOZAc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, private
cf-ray: 77a9bb9fff44b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:51 GMT

GET
H3 200 augusta.js Show response
www.websleuths.com/detroitchicago/ 2 KB
1 KB 44ms
43ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/augusta.js?cb=24
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcc0b6437eeec474b65774198371749c6e3f11c12b0bc14f3a971714d0d0e52b

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 26 Aug 2022 02:42:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 9736242
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gGWmR6rrI8D4n98RCKsfJivzIWZRxG9PDmp884auimrMJNoE%2FKa8Rbv7%2ByuBIpzvPQM9d%2BowraLKvRVQiD%2FivJ5fafMcmbaSckdrcb6G%2FgN6ba%2B9fNtuLs3y9RX3gcXF2XJZvfo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bb9fff4bb4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 178 KB
45 KB 189ms
62ms Script
application/javascript 13.32.28.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/tardisrocinante/austin.js?cb=15
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.28.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-28-197.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 20b9cd2a5e2125ece15cc0d11ae35586a1e9eb4bc90226eb3df789adf191be61

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 18:26:22 GMT
content-encoding: gzip
via: 1.1 ec85113c6ed859938b3fcfa19bc035f8.cloudfront.net (CloudFront), 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
last-modified: Thu, 15 Dec 2022 17:02:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-C2
age: 2790
x-amz-server-side-encryption: AES256
etag: W/"9678e76b6e6295571547f8fe5df68b88"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: iK29DdHjxoRjSA6cg_WgKB9yO29smbt8lD3Y9Qln9KgcTBzne9qrKA==

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221207/r20190131/ Frame 39D0 10 KB
5 KB 174ms
55ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221207/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

age: 35900
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 09:14:31 GMT
etag: 10353107486223812946
expires: Fri, 30 Dec 2022 09:14:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cmbv2.js Show response
www.websleuths.com/detroitchicago/ 47 KB
14 KB 46ms
45ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f5a51a1e354546f50799cc9c47f22ce2127d09fc87c38b3e89d56c70c4a0fde

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 16 Dec 2022 17:17:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6947
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vm85%2F4btXtKXApfc%2BkLXgEOsiTJOTs69bY5Qh03oA9GNzEF6dRUn9Vwcr3WyxeugZvQxDw1FSIH3TivjvaAfxgf7ykG1K5rVl8TFguMB6wit0akXlj454N7o5WfPSi6BVa%2FIYDo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bb9fff4cb4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 44078.jpg
www.websleuths.com/forums/data/avatars/s/44/ 2 KB
2 KB 41ms
40ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/44/44078.jpg?1644130272
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81f270b00f2b6fdd301dfdaa80ed82a6323e7f93b38d327967385f355b1f74e4

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 16639336
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
server: cloudflare
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bKIt5w%2Bx79oexs3QlnSL9pqe25EAVevrZbGWo9E8wlHwzo4iDOJkcwtq%2FJS5eFuYemVkJtMZWUCExWazkNHHWrXjYVSjpKcXPuDAy%2F8EMLTAt%2FnmNjOXFLLWDBKofFL8dCBhZk8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba02f84b4f9-OSL
expires: Wed, 07 Jun 2023 05:10:35 GMT

GET
H3 200 51188.jpg
www.websleuths.com/forums/data/avatars/s/51/ 1 KB
2 KB 47ms
46ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/51/51188.jpg?1526986506
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65f04d7775d6cc50363c72f95bf5ad012eba19a6870562e6a863a3469f44b97e

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 11013034
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Wed, 03 Aug 2022 21:41:46 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4nwSxdAR663FCbS6D938z6YTF42K%2FPaVEtkcgIZ3fZG05wIiUzsyCsVOyY6CAqqOzO77xW65yy5Cyo5D3fqjYzCxCfaoyCVSj0amtgjp1H4RidK2oknlY6WAYILibMUceg8lV%2FE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba02f88b4f9-OSL
expires: Fri, 11 Aug 2023 08:02:17 GMT

GET
H3 200 53282.jpg
www.websleuths.com/forums/data/avatars/s/53/ 2 KB
2 KB 41ms
41ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/53/53282.jpg?1527795608
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1112b9d2eaf6b8451a466b5e4e5f439b29d750642282568c305f699c2c497be8

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 247047
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LIizP%2BC4lFJhvErq9jdLDHwhrdUoN1g0pySmTNTG77DCnObgK3Wjzj2ASAxaauw7dc%2BwB9rSTBrPSfjaJdwMEDWwo9%2FH36vW0v01K9DwaGQZyYlkmQr2zhoqJKaR4RDK9A48lkA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba02f89b4f9-OSL
expires: Wed, 13 Dec 2023 22:35:24 GMT

GET
H3 200 pubads_impl_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
129 KB 189ms
63ms Script
text/javascript 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 12 Dec 2022 16:16:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 356159
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131905
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 12 Dec 2023 16:16:52 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 184 B
125 B 222ms
96ms XHR
application/json 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-99-86-3-236.fra6.r.cloudfront.net

Software

cafe /

Resource Hash

6f5e0502b0e07f0ece1f61516ed25960c442463f6cff36ff592203319bc5f4e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0
expires: Fri, 16 Dec 2022 19:12:51 GMT

GET
H3 200 imp.gif Show response
www.websleuths.com/detroitchicago/ 43 B
559 B 109ms
109ms XHR
image/gif 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A3%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A101%2C%22ad_location_ids%22%3A%226%2C5%2C0%2C31%2C30%2C22%2C21%2C700%2C36%2C37%2C4%2C701%2C702%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A11%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A3%2C%22city%22%3A%22Stockholm%22%2C%22country%22%3A%22SE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A11%2C%22domain_id%22%3A347469%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A23%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221006%2C1100%2C1103%2C1104%2C1105%2C1117%2C1118%2C1119%2C1120%2C1121%2C1122%2C1123%2C1124%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%229a59808f-8e13-4150-6653-ec12f237dabb%22%2C%22position_selection_id%22%3A46%2C%22postal_code%22%3A%22164%2074%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A265615%2C%22response_time_orig%22%3A815%2C%22serverid%22%3A%223.121.112.196%3A30071%22%2C%22state%22%3A%22AB%22%2C%22sub_page_ad_positions%22%3A%221006%2C1100%2C1103%2C1104%2C1105%2C1117%2C1118%2C1119%2C1120%2C1121%2C1122%2C1123%2C1124%22%2C%22t_epoch%22%3A1671217969%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.websleuths.com%2Fforums%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A3282%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WwQpabXqdOx769mI7ylUuhKPcHwfj0DJlTvHzxbM%2BH0ZaVQ%2FJciOR1MQ%2FILwNvx6sYs0GMT5WJSJTwdpz3Pb5AkBWy5reg99m9zFHimXU%2BG75lL5Rn8UMt73XXUyTMs3k9vLKpU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 77a9bba06ff1b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 15 Dec 2022 19:12:51 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 25 KB
10 KB 161ms
50ms Script
application/javascript 91.228.74.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.228.74.206 , United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d854082be0173c977aad8f65cdb9b88fd005f3dd3f34f894ab9fdba5a283780f

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: gzip
etag: "StHfV9prSwQMxjKWocWEFw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 23 Dec 2022 19:12:51 GMT

GET
H3 200 cmbdv2.js Show response
www.websleuths.com/detroitchicago/ 45 KB
12 KB 46ms
46ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/cmbdv2.js?gcb=195-0&cb=03-8y0c-6y19-5y5f-22y63-28&cmbcb=117&sj=x03x0cx19x5fx63&abt=DelayAdXForPrebid
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec6286b832929816edab611dbface79161c453bda001da786519099dd3cea5dd

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 16 Dec 2022 17:17:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6946
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tnezYqjDDgf0WhbZ0KMoO%2Fk9mVYNVhcK5ty3rSKgH1FvcStAwUCSrPsbhQf%2FRwtOnXb%2FowQopHe2mpGYDK7LlpkkjpPiW%2FE07qdEuyJFwOB3fwptangKWmbtMNqvXD9hEzIk2Tw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bba06ff3b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 520.jpg
www.websleuths.com/forums/data/avatars/s/0/ 2 KB
3 KB 42ms
41ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/0/520.jpg?1664454430
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2bce4a1ec4e57a5052d36cb1a9fe2d75a1e922290ca9004087f7f6edfe6a8a06

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 6754453
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 29 Sep 2022 12:27:10 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r9R24NOQ7KGRBG5ZdhvV7SLVFuzjrKxa87arQ4YBORwnC%2FEgywHzUQ9%2BMgmwikdr5ESSco%2FVsdTRqpX60M9ZAnAFX%2BsDItsMAjZHwKY9YdKkotqgPSbmugx1lj20XMYxMz%2FAe60%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba07800b4f9-OSL
expires: Fri, 29 Sep 2023 14:58:38 GMT

GET
H3 200 249296.jpg
www.websleuths.com/forums/data/avatars/s/249/ 2 KB
2 KB 45ms
43ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/249/249296.jpg?1622406428
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14c91edfafb589a012e24435e668f8a837f7b639e4373228c8896f682943a62c

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 77821
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RMRA4z%2Fd%2B803Z1uQ2LQRSw5dvlpWHDCzjR5RmowYJbhmQ6J34jt6E6p4EwrH%2BDgWFBggQLvTLUM5EmHvJGAyVs3sEYB97U8DiFWl%2B%2FF6L1frYFlnrRuIwPhRBEMr3me%2FY5dPlqk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba07803b4f9-OSL
expires: Fri, 15 Dec 2023 21:35:50 GMT

GET
H3 200 314796.jpg
www.websleuths.com/forums/data/avatars/s/314/ 6 KB
7 KB 44ms
42ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/314/314796.jpg?1670825182
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e534804c11dafcd2c63205980f8983459aebd8909cce89cb06df3d748b329e25

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 26505
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Mon, 12 Dec 2022 06:06:23 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7BloZ6DmBSpCT6TxqF8FDXCCYPSnz5vMg6%2FcmM95qc%2FC%2FNRvVzPojRicBNznNI6qNtbfQS3QETJiXtrXoZ7j%2FNuDUcLlEae2hm6BJ4PTRRfabjtz9F2M5c9xE0oLer5X5jMrKs8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba07806b4f9-OSL
expires: Sat, 16 Dec 2023 11:51:06 GMT

GET
H3 200 87573.jpg
www.websleuths.com/forums/data/avatars/s/87/ 1 KB
2 KB 43ms
42ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/87/87573.jpg?1526986584
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d255f53cf698ab7c0e4db66e309d2bd31edd40d35f8c9444d65e0303857d4e7

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 2164276
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 11 Nov 2022 00:12:25 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2r2XLJso5%2F8yGPhtXQBm5P5Cdfkfq%2FxVtMaxGshv2c2OHQue7m3oLKwrtWMrhm9vrEu%2FW%2BYUe82FofUsntmJ5L7Y9ecbTF5%2FnAXEufJaP2NQEzWGoczVrpkk801VkALR1w71Fe0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba07807b4f9-OSL
expires: Tue, 21 Nov 2023 18:01:35 GMT

GET
H3 200 280372.jpg
www.websleuths.com/forums/data/avatars/s/280/ 1 KB
2 KB 44ms
42ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/280/280372.jpg?1611409348
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf3d29d5535fdfe68af32f69ab392edd30faaf061ea1482d06b3a3e528e3cb07

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 344813
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1096
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nPJbTQ8grxG1mDjfQRVyr3d6N1qYwRWYP1CgN%2F4RKouNR94eL%2BivtmbvsgK%2F6eTKdjC0oIvTRPXLUFYTej70j%2B%2FB3KQKKDObqCK%2FC0f4P2KsyuWm3pDrIwpJgjYvvhvMP10gxvg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 77a9bba07808b4f9-OSL
expires: Tue, 12 Dec 2023 19:25:58 GMT

GET
H3 200 237729.jpg
www.websleuths.com/forums/data/avatars/s/237/ 2 KB
2 KB 46ms
44ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/237/237729.jpg?1670936827
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36819a10f13de35754e25a35c95f4fe4154fd9cba5a573159d63faee65f7fd5c

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 80696
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Tue, 13 Dec 2022 13:07:07 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e310VbTdlRfg5ASQDsSK%2BjTfqZ8WYrv%2FTySbd00jFQ6et5juF%2FVT2nSU2oAWvJTF%2FK%2Bscvr%2Bs95r%2F%2FFrvdYd16vfsocBSFO1SLtTdQao3k5%2FNa21T2dDNiXujgHAkHseqX6bU4w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0780ab4f9-OSL
expires: Fri, 15 Dec 2023 20:47:55 GMT

GET
H3 200 161047.jpg
www.websleuths.com/forums/data/avatars/s/161/ 1 KB
2 KB 44ms
43ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/161/161047.jpg?1637654504
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a00f3ed5a637445e711c3a2b761b9d9904aad5eedf9d4e5119a444da11d7b7d5

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 118382
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hCcKgwde8ciO%2Fj7gSv9W94PgCjSvyL%2FZKhCAigDiLeh4iIGZlZe2to6q%2F%2Bl0VQuJjm5rwgfs2nL0aTvCzEst0%2FDxrurezcdxMaVFzXYr1VY1brJbD8U3jG5KPyAiV30qWM16Zg0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0780db4f9-OSL
expires: Fri, 15 Dec 2023 10:19:49 GMT

GET
H3 200 / Show response
basher.ezodn.com/ 738 B
945 B 108ms
56ms XHR
application/json 172.64.203.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://basher.ezodn.com/?did=347469&bf=34&dc=1254144
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/porpoiseant/banger.js?cb=195-0&bv=169&v=68&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.203.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 382ed07d622073b98e29aee302ee57716a922331d29bc7f0a14660aaf86e63b3

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
X-PINGBACK: pingpong
Content-Type: application/json

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
access-control-max-age: 86400
vary: Origin, Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.websleuths.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z08RSjubDeJb3bm3WU3m5Vkxxl7geQ7G%2BdDeplU1PBpBS3pp0I2KuZO8rpM9Ovh9DiQpkryn74ncjIuPHZhPVL4QBp3wJcPiNjqyUvMNz08eVI%2FRyw8N6GLBCW%2Fd1nRqAq%2FQ"}],"group":"cf-nel","max_age":604800}
content-type: application/json
cache-control: public, max-age=84400
cf-ray: 77a9bba1f9670e74-AMS
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H2 200 /
basher.ezodn.com/ Frame 0
0 173ms
58ms Preflight
application/json 172.64.203.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://basher.ezodn.com/?did=347469&bf=34&dc=1254144
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.203.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-pingback
Access-Control-Request-Method: GET
Origin: https://www.websleuths.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-pingback
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.websleuths.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray: 77a9bba14e1728a1-AMS
content-length: 0
content-type: application/json
date: Fri, 16 Dec 2022 19:12:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bvx29wZxqGPXUwo18h6jwH0c6XJ%2BSoekxA8j0nRna3T%2BkW7bhugq9IqxzkUBlsDOo7M6G1%2BDjZVcAlb%2FyIMgUtSwXiKYvyM9nBYnwk3j%2FsQ0r74XWFNWNIVvfBKmbV%2F%2B9fN1"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Accept-Encoding

GET
H3 200 161261.jpg
www.websleuths.com/forums/data/avatars/s/161/ 1 KB
2 KB 41ms
40ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/161/161261.jpg?1619140684
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 928b75d9f336405acc895042f18b89aed84ee6a3abbb56042410add75d1305e0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 1292
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UeIEN6%2Fp3QWME15cdZ98zdyPj3CxOhAfk58mXam5gLevtk%2BBA4TCOc4y34Ge56T1KsBIo5EWsFjlXFU6kdK8X0ABcKy2vBvQBvDl9Qedqg%2F%2FnooAIjyMHYDcJ7rfpdPKHrhxMS4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba09849b4f9-OSL
expires: Sat, 16 Dec 2023 18:51:19 GMT

GET
H3 200 249119.jpg
www.websleuths.com/forums/data/avatars/s/249/ 1 KB
2 KB 43ms
40ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/249/249119.jpg?1571838543
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da9e653a89be4e6087afccc4d3ff5377ae0c125fad9d9a44af3df84d39f5456f

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 1227
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=02nBq62ShZUEaF4BFyJuIDRH7JHFwdLG%2FxTyxSb0BLKYHLqodOFFbjoTGbC7C1QiNkXwN1nW5Tc%2FuwsplBLiA6Vry7oD%2Fk7Y%2BGpHyc8U2DgQhqpxptJdiQuLwwGu33CJNjXYcCU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba09852b4f9-OSL
expires: Sat, 16 Dec 2023 18:52:24 GMT

GET
H3 200 91422.jpg
www.websleuths.com/forums/data/avatars/s/91/ 1 KB
2 KB 44ms
42ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/91/91422.jpg?1526986591
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06757ab4a53b961efbea7e612b36465a84bf7ac0abf5b48202846803028929f9

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 2769381
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1367
response: 200
last-modified: Fri, 11 Nov 2022 00:12:25 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5288BlNrCjLecvLu8THYiv2QgfUv97EGdNaRmBs4eliY%2BZhSExMjYgErqWGxdcuAykXb9wyBEC2dCXNDw9Rzif0gqX9xzcwqhFoEhDtzRczeIIVJgk5izH%2BKDSeIle1bS%2BYQgII%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 77a9bba09853b4f9-OSL
expires: Tue, 14 Nov 2023 17:56:30 GMT

GET
H3 200 nmash.js
www.websleuths.com/porpoiseant/ 23 KB
7 KB 139ms
139ms Other
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/porpoiseant/nmash.js?v=169
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb2d713bc6a3a28fba4e4248e55a5f1069616e67772359b42d42d3d4c4df3461

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 16 Dec 2022 18:41:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XpbD4Vbzyuu5g0%2BFKK%2FQcuKkuf6k5yZuwiMxhuQhOm%2B5SbnIM9GrrZomTNK4fHp1mzOc7MBPe78wrEC9nyOwUF5tZImWfqvpXpeCrlLmOxuSTAgFMwN%2Fa%2FrrkPrLD7E%2Fy%2Fc1%2FZ0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=14400
x-robots-tag: noindex
cf-ray: 77a9bba0a859b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 119760.jpg
www.websleuths.com/forums/data/avatars/s/119/ 2 KB
2 KB 386ms
384ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/119/119760.jpg?1633250258
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc879729e1ec31fe66099a3864c4c11e0f01ceed3b749b322977b9726e076f20

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBqDVpkXADrVyUwDHQpZnh8r3X60nteFo8qa9pVj7p2DNW3ymVxSTU1iqExQrLoJ4O4bneWTmBgyZsQxxzQvTscAuFg3eiTaMCqF7L6a0V7LCSg9bbLeGp6FzXbqFk%2BOxpnFWzU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0b869b4f9-OSL
expires: Sat, 16 Dec 2023 19:12:51 GMT

GET
H3 200 201974.jpg
www.websleuths.com/forums/data/avatars/s/201/ 2 KB
2 KB 45ms
44ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/201/201974.jpg?1527447239
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b50d6af5e108fe967bb68f74a58f60a19c3e46a5a24d0565791f30b558d186f7

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 271247
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KT97ViHxbAzPlWta0pNdPlIRh9A4igary7wSUDILxg5GBf6rfB%2BHUnHEnuogWHvIqmKeGt8xplB%2BD2P%2BM%2BM1L56%2BhuJhZi3BkZ7GxwxBhft3gJYEkQ2xUEaUSs7E48GUNsm3Z%2Fk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0b86ab4f9-OSL
expires: Wed, 13 Dec 2023 15:52:04 GMT

GET
H3 200 227268.jpg
www.websleuths.com/forums/data/avatars/s/227/ 2 KB
2 KB 42ms
41ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/227/227268.jpg?1640292212
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f3a2d96079b05b7db9bb483cc7ac495f3654f417e3e8d9c35fcc2202c37edb8

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 545792
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VDD%2BRH6WUS69wuivqLdFSfFiWnlRAplbilKdyzN8HhdUuNEc%2B35T9E35PQKVBu0w2s0KZuEOf3PaPXMiMLIPXprIE0yEFunyb1Hlqo94WHvpYh41Rv4%2F1XBWeU132zHTrs4mnyE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0b86cb4f9-OSL
expires: Sun, 10 Dec 2023 11:36:19 GMT

GET
H3 200 101036.jpg
www.websleuths.com/forums/data/avatars/s/101/ 1 KB
2 KB 43ms
42ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/101/101036.jpg?1563799438
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2857356a7321abb29b180dad58531fd3be3747bfb15bb568b6416cacf24ac457

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 71644
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1322
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SkikHOoULBTwKL2qBaZHxkDtjBihKLTSKKzd%2FdfTPSDUvix%2FvmPo47YTELIaIccc9xnJNKT2wXQvCKhTfAxtu3w5Ms4kP4j3SDqk0cpc8TQ1jhkD%2Fyg33NiZH%2BXv%2B6%2BPl0VKq8M%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 77a9bba0b86db4f9-OSL
expires: Fri, 15 Dec 2023 23:18:47 GMT

GET
H3 200 96616.jpg
www.websleuths.com/forums/data/avatars/s/96/ 2 KB
2 KB 44ms
43ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/96/96616.jpg?1526986605
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88325a857d4ef90ce961dca6db1c88397ad12bd437c425cff958c41fbf3da563

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 775178
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bomfgbbKV4575O1UoKdez4EFvdPp7tQFBLZUCe3z4FWa%2Fuz7snOivCAjROuDOrNnMlPJBJGYoAilMVbx9LiQejQLFEiloEfxp%2F6pdDf5dutzh%2FY06OCSkNmtxTjOxCTyRcv1a9w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0e8c3b4f9-OSL
expires: Thu, 07 Dec 2023 19:53:13 GMT

GET
H3 200 309670.jpg
www.websleuths.com/forums/data/avatars/s/309/ 2 KB
2 KB 44ms
44ms Image
image/jpeg 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.websleuths.com/forums/data/avatars/s/309/309670.jpg?1661910054
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afdc9bcf7119d83e734149de02ce77f49ea9ec7d224290e73800e1384a666538

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 1292
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
response: 200
last-modified: Fri, 16 Dec 2022 16:32:44 GMT
server: cloudflare
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xq40fAQaCi93bPPBlks4KqCwAtjBkoQ7y8%2BElv5de0%2B7%2FiyUHdhvJBIImjadIsKrrSI2q9WT3t5uQuVn7gmHbuhACKWsnHOrJBLcY5WcfMpkVUJhNaHAB4SkluFCd6EEw8pSqa0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 77a9bba0e8c5b4f9-OSL
expires: Sat, 16 Dec 2023 18:51:19 GMT

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 198ms
52ms Image
image/png 143.204.215.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-111.fra53.r.cloudfront.net
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Sun, 11 Dec 2022 05:26:38 GMT
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
x-sol: middleton
display: staticcontent_sol
x-amz-cf-pop: FRA53-C1
age: 481573
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
last-modified: Thu, 01 Dec 2022 00:14:50 GMT
server: Apache/2.4.39 (Ubuntu)
etag: "49d-5d9576f862e00"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-id: Zos2-2XK3TqkKjRQVYSmfYf4uMgtDR9k0ld4Xg0rMybrvSYDUx6E_A==
expires: Sun, 18 Dec 2022 05:26:38 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 825 B
1 KB 57ms
57ms XHR
application/json 13.32.28.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.websleuths.com&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.28.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-28-197.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 8a22eb57594c8ae9cda85eea283246ef0acf4e1ebee49ce2cabff2969c9e5951

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 17:09:49 GMT
via: 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C2
age: 7381
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 825
x-amz-cf-id: 0A6VHVGoyQRjy653nGG6bNNOekII-f_ohSIblZaRyaWAA5XK_zY6iA==

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 23 B
463 B 223ms
94ms XHR
text/javascript 99.86.3.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&pid=wWdyG5cQDzgpJ&cb=0&ws=1600x1200&v=22.1212.1511&t=2000&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-medrectangle-2-0%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-medrectangle-2%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-box-1-0%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-box-1%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-banner-2-0%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-banner-2%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-medrectangle-4-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-medrectangle-4%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-medrectangle-3-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-medrectangle-3%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-large-mobile-banner-1-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-large-mobile-banner-1%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-large-leaderboard-2-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-large-leaderboard-2%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-leader-1-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-leader-1%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-medrectangle-1-0%22%2C%22s%22%3A%5B%22250x250%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-medrectangle-1%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-large-mobile-banner-2-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-large-mobile-banner-2%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-websleuths_com-leader-2-0%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C1001550%2Fwebsleuths_com-leader-2%22%7D%5D&schain=1.0%2C1!ezoic.ai%2C286dd941480077fbe230a4f56387440a%2C1%2C%2C%2Cwww.websleuths.com&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.3.236 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA6-C1
x-amz-rid: 0CMZ4918C7DY0ES6F1AD
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: SahOX8xuGspywWJ0h83CmnelS32aHMfqDgqvFw25QQLE9XgmK5w-QA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 157ms
53ms XHR
application/javascript 13.32.28.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.28.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-28-197.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id: KO0V33_zzBQMkGMaMpLupHqINiAUum0D
content-encoding: gzip
via: 1.1 307a3e1075dd3d0976c64513a6ec3d74.cloudfront.net (CloudFront)
date: Fri, 16 Dec 2022 05:47:43 GMT
x-amz-cf-pop: FRA56-C2
age: 48309
x-cache: Hit from cloudfront
last-modified: Wed, 07 Dec 2022 02:43:04 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: gCxOGNafPD-1fT7aHTEquXe3oMxGxflmmmn1DodGbttyG16dayK-Yw==

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 160 B
633 B 223ms
69ms Script
application/javascript 18.66.15.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-40.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4718dd9f68e969d1cb5e1b6172206b7150ad1d8cd5c5c1fe5812dd0e1646d426

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 18:37:25 GMT
via: 1.1 c172ad3d6658cab7ff64a4a64dca4822.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P1
age: 2127
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Fri, 14 Oct 2022 00:41:49 GMT
server: AmazonS3
etag: "af15ecfe46737cb2a37226fd060f23a6"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: 0kGxqQnHWVdKa3Dkr5HSNCBtByGmD6h2zIFe0RNgZ93Pi5P1Db7gFw==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
75 KB 181ms
70ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VN28FK7QFE&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-7620263-1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

91b6723f44eaaf13c3b8092d6abcf21e3dd9cf6961829854ee93e4706536e1c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76845
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 16 Dec 2022 19:12:51 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 96ms
28ms Script
text/javascript 216.239.36.178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-7620263-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.239.36.178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 16 Dec 2022 17:34:02 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 5929
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Fri, 16 Dec 2022 19:34:02 GMT

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
https://btloader.com/tag?o=5112081056530432&upapi=true

447 KB
56 KB

62ms
60ms

Script
application/javascript

104.26.7.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5112081056530432&upapi=true
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H2
Server: 104.26.7.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4519fe034201cde5e41e3c91f141eb7b8487073c9739c6d68c39b765ba52f067

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 16 Dec 2022 18:39:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2013
etag: W/"af7e51b6eb7ac25f4c4c6073f0f2387f"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=odW7kJx8DCJylyOeEfvWBAELbuDpaNIInlUaG32aRSRr2ERGMyXS6BQl9%2BJ8IIsKBmtqGCLeuAtkb8X9AU%2FysTTZp507CurYbDq%2FlXMLfmU4AMhf0L%2BvISRohWiTvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=86400
cf-ray: 77a9bba3085a0ae3-AMS

Redirect headers

date: Fri, 16 Dec 2022 19:12:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MEzL%2FuWOxDAuBGiT08WTA%2FmIs%2FnDZHPeYXfoEUYNME6zq7FsBIRX0bmGBm0ABLYhNY9c2mtK09zS8qVPul4%2BOSvBfNciyXyRfEXEJ1aCj4qwq0wecA3W8ftfjb4IfA%3D%3D"}],"group":"cf-nel","max_age":604800}
location: https://btloader.com/tag?o=5112081056530432&upapi=true
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 77a9bba29ffa0ae3-AMS
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 57 KB
17 KB 113ms
38ms Script
text/javascript 104.22.52.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.52.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39fae3dc476aaaa594e2c963401633dd5d02eccb3c175eda03912cfe0f91c92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 24 Nov 2022 12:48:29 GMT
server: cloudflare
x-amz-request-id: 34NSA6WR644WAHFH
age: 29
etag: W/"9ee82d693d1e83b3a37ee20226716f78"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 77a9bba248d70a35-ARN
x-amz-id-2: 3DiS999xbyrdrTY/2bMebqBOZAgkETxENCNIo4iZJSC2ZuWCkX7XtHoFs8KkOv/jJfKWnB2HQzY=

POST
H2 204 collect
region1.google-analytics.com/g/ 0
349 B 102ms
37ms Ping
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-VN28FK7QFE&gtm=2oebu0&_p=334898816&cid=805510516.1671217972&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1671217971&sct=1&seg=0&dl=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&dt=Websleuths&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VN28FK7QFE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:51 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
792 B 179ms
67ms Script
application/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 183ms
65ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
691 B 434ms
434ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=150357895109484&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=1&adks=3498223290&didk=478842339&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D4404216789133340%26eid%3D4404216789133340%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dwebsleuths_com-medrectangle-2-4404216789133340%26eb_br%3De66c30deca31b19eda212eeca1258584%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D24%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C67%2C0%2C193%2C196%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1428%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4276%2C2030%2C783&eri=1&cust_params=amznbid%3D1%26amznp%3D1&sc=1&cookie_enabled=1&abxe=1&dt=1671217971595&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

703ad290ea4697fa26c46257ef899c62b793396b3207f9e81b29a0c50a8bb8ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 661
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B91B 6 KB
3 KB 241ms
62ms Document
text/html 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s46-in-f1.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 19:12:51 GMT
expires: Sat, 16 Dec 2023 19:12:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
624 B 497ms
497ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=2375199542572511&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-medrectangle-3%2Cwebsleuths_com-medrectangle-4&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=468x60%2C320x50%7C468x60%7C320x50%7C234x60&fluid=0%2Cheight&ifi=2&adks=3860738611%2C2467986251&didk=478838826~478844209&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D2601769051098736%26eid%3D2601769051098736%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1117%26sap%3D1117%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dwebsleuths_com-medrectangle-3-2601769051098736%26eb_br%3Da7a863b24978e69c4cdbb5a49be70d5e%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D34%26br2%3D16%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C67%2C0%2C193%2C196%2C20%2C71%2C201%2C187%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%7Ca%3D%257C0%257C%26iid1%3D5478670923099893%26eid%3D5478670923099893%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1118%26sap%3D1118%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26tap%3Dwebsleuths_com-medrectangle-4-5478670923099893%26eb_br%3Da7a863b24978e69c4cdbb5a49be70d5e%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D34%26br2%3D16%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C193%2C0%2C67%2C0%2C193%2C196%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C2030%2C783&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1671217971613&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=401%2C110&adys=980%2C1178&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=1050x60%7C1050x60&msz=468x60%7C1050x60&fws=4%2C4&ohw=1600%2C1600&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

cafe /

Resource Hash

badc1704afec0d0ede3d53928abe19fe4199ae5740595f98360ca5f39ec175b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 594
x-xss-protection: 0
google-lineitem-id: -2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 99ms
39ms XHR
text/plain 216.239.36.178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=334898816&t=pageview&_s=1&dl=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&ul=en-us&de=UTF-8&dt=Websleuths&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1710903331&gjid=1202855415&cid=805510516.1671217972&tid=UA-7620263-1&_gid=1439467217.1671217972&_r=1&gtm=2oubu0&z=533235687

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.239.36.178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
405 B 187ms
56ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

35a24f0084552e890633aba24a790acd6bfe97e40feb3173db092b3e813ec148

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.websleuths.com
date: Fri, 16 Dec 2022 19:12:51 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 34 B
286 B 181ms
56ms XHR
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lbs.eu-1-id5-sync.com/lbs/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

1acf998ef6673c01f61ba09b1301f9aa14d42539d71546ff2ad29dac0b5fa6d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.websleuths.com
date: Fri, 16 Dec 2022 19:12:51 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 34
vary: Origin
content-type: application/json

GET
H2 200 pixel;r=1383965807;labels=Domain.websleuths_com%2CDomainId.347469;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F;uht=2;fpan=1;fpa=P0-2035940045-1671217971428;pbc=;ns=0;ce=1...
pixel.quantserve.com/ 35 B
371 B 83ms
50ms Image
image/gif 91.228.74.206
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1383965807;labels=Domain.websleuths_com%2CDomainId.347469;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F;uht=2;fpan=1;fpa=P0-2035940045-1671217971428;pbc=;ns=0;ce=1;qjs=1;qv=bf501fc4-20221215111636;cm=;gdpr=0;ref=;d=websleuths.com;dst=0;et=1671217971654;tzo=0;ogl=description.Forum%20software%20by%20XenForo%2Csite_name.Websleuths%2Ctype.website%2Ctitle.Websleuths%2Curl.https%3A%2F%2Fwww%252Ewebsleuths%252Ecom%2Fforums%2F%2Cimage.https%3A%2F%2Fwww%252Ewebsleuths%252Ecom%2Fforums%2Fdata%2Fassets%2Flogo%2Fwsog%252Epng;ses=25b346ee-4a76-4331-9157-d66466df1847

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.206 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:51 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
441 B 166ms
56ms XHR
text/plain 64.233.166.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-7620263-1&cid=805510516.1671217972&jid=1710903331&gjid=1202855415&_gid=1439467217.1671217972&_u=YADAAUAAAAAAACAAI~&z=1567110398

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.166.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wm-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 16 Dec 2022 19:12:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
847 B 131ms
44ms Image
image/gif 104.26.3.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 160354
x-guploader-uploadid: ADPycdt6UnknKJQGb01-IIoG64Z9C9xepCUvJAMvWjPaEoXdJdPtMMbqAbpSjAGe1zf-bnbWow6WDDGrB_-dPVuruOI
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=16w0tiuRG%2FMSFD90TMhNIsEXPXMLk8Otwg6eeL4rCddpFhNrMe1WvIcfN%2B0kHYW1EbjDSzYRRQCbJFWnHMldDHgN8bnpfGVtH5APCfNAImUC75PTYfkP24rKIAgV1brAyg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 77a9bba4599bb809-RIX
expires: Wed, 14 Dec 2022 23:38:14 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
663 B 174ms
55ms Image
image/x-icon 142.250.185.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 16:57:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8100
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 17 Dec 2022 16:57:51 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
328 B 133ms
46ms Image
image/gif 104.26.3.70
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7206431468425478
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 160354
x-guploader-uploadid: ADPycdt6UnknKJQGb01-IIoG64Z9C9xepCUvJAMvWjPaEoXdJdPtMMbqAbpSjAGe1zf-bnbWow6WDDGrB_-dPVuruOI
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ByEa0DpZWb8IjjyWhdKT7HLPjNGZhDv0TAXOe%2Bok3DuTsf7arqVqbtScHVjAI5aAA7MDGhmr%2BK32AoZTx4OxmEneYL44tNeETT7BJUqZASd%2F1%2BnrqY0QHfqRpcSrPt5BWg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 77a9bba4599db809-RIX
expires: Wed, 14 Dec 2022 23:38:14 GMT

GET
H3 200 houston.js Show response
www.websleuths.com/detroitchicago/ 6 KB
2 KB 41ms
41ms Script
application/javascript 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/houston.js?gcb=0&cb=33
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22411e2bcae3b8094e39c5b0b9e38a3257b78fe2e8b9fcf994a98e14534d9d44

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Nov 2022 23:06:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2578011
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s7gV9M9lPHQb3nq2XRexifTw8x4txTCXCjx0DjI%2B%2Fhd0oJ1J7RdQOWk8R%2Be7iUO%2Bt0MAMFnOH2yaPM5Lg9TbbwGYIRtJWWo5mEsOQqQf2ceQfU3puk50r4pkz7NXiMNSTuSZ5Lo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bba3fcf8b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 177ms
65ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 178ms
66ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 216 B
628 B 180ms
61ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

ac0fd997019d1a4be2f2f9d298be0b9a75d9271a9b03691587e971431c984814

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.websleuths.com
date: Fri, 16 Dec 2022 19:12:51 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
605 B 421ms
421ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=46273380206518&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-box-1%2Cwebsleuths_com-banner-2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=300x250%2C300x250&ifi=4&adks=827824745%2C110232293&didk=2612740235~3812235687&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D1306947225118161%26eid%3D1306947225118161%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dwebsleuths_com-box-1-1306947225118161%26eb_br%3Dad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D14%26br2%3D6%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1428%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C3919%2C3933%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%7Ca%3D%257C0%257C%26iid1%3D3869363067091809%26eid%3D3869363067091809%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D31%26al%3D1031%26compid%3D0%26tap%3Dwebsleuths_com-banner-2-3869363067091809%26eb_br%3De66c30deca31b19eda212eeca1258584%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D24%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C168%2C132%2C0%2C26%2C209%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C1428%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1671217971948&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=1180%2C1180&adys=217%2C1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=320x-1%7C320x-1&msz=300x-1%7C300x-1&fws=0%2C512&ohw=0%2C0&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a20efffab55b21bd40a73a2d67a91f65766f4011795359d6e07edf7521976b0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 575
x-xss-protection: 0
google-lineitem-id: -2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 country Show response
api.btloader.com/ 16 B
203 B 216ms
148ms Fetch
application/json 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country
Requested by: Host: btloader.com
URL: https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 65433ce9f5c2db2aa8c98d3eef8516d5e818cd23d60ec0e0bfd94c40c9f8d368

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 221ms
153ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=SpKlsmaBRL&w=4787931330379776&o=5112081056530432&cv=2.1.03-1-g6247d5c&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&sid=UnW6qtSSws&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?aax_id=AAX65WOCF&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 16 Dec 2022 19:12:52 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

GET
H3 200 dark-bottom.css
www.websleuths.com/ezoic/styles/ 3 KB
1 KB 43ms
43ms Stylesheet
text/css 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/ezoic/styles/dark-bottom.css
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/ezoic/cookieconsent.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94edf973e9deb80b5eccf17f8f3108eafe15209fe25fe417e8f8962a4d8f48b3

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Jun 2022 21:27:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 16636834
etag: W/"bd7-5e0698f2f8f80-gzip"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ULvqAqm%2F64AvYlFaj4VAxdxxDdYcx7B%2BZ4StyxbWeauOfajJiLU9X8h12yaYuEA%2F3YX0A9EQs%2FVPKKcMtIo6jFk8H0LQCMk%2FPUjA4YKq%2FlRs8SpBlYqEtDK024cZJznEJFGvpo4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 77a9bba52ed3b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 230ms
113ms XHR
application/json 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b3df287a1ed4e4bf5e11d34083f2d4a0d6dc516220c26230b31eab6a03b3c23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12657
x-xss-protection: 0

POST
H3 204 greenoaks.gif
www.websleuths.com/detroitchicago/ 0
528 B 64ms
63ms Ping
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiOWE1OTgwOGYtOGUxMy00MTUwLTY2NTMtZWMxMmYyMzdkYWJiIiwiZG9tYWluX2lkIjoiMzQ3NDY5IiwidF9lcG9jaCI6MTY3MTIxNzk2OSwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjItMTItMTYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxOSJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI1In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjlhNTk4MDhmLThlMTMtNDE1MC02NjUzLWVjMTJmMjM3ZGFiYiIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInRfZXBvY2giOjE2NzEyMTc5NjksImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0=
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZbHiEQCyQ%2Bmbr6RYVxvKPqGrTA%2BWZPnoXckk6yUujzGEZn3wIcyJGVAsCrhVhEAadLzegML%2B17nHXeVRwkAsEEtGyVVQZAaRGnyPTH6pvhIhx7DCTBjy8uMao7fGXUS8kjGYWTo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://www.websleuths.com
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bba56f1fb4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:52 GMT

GET
H3 204 greenoaks.gif Show response
www.websleuths.com/detroitchicago/ 0
502 B 109ms
106ms XHR
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiIxMjYwIn0seyJuYW1lIjoicGVyZl9jb25uZWN0X3RvX3Jlc3Bfc3RhcnQiLCJ2YWwiOiIyNjE3In0seyJuYW1lIjoicGVyZl9yZXNwX3RpbWUiLCJ2YWwiOiI3MSJ9LHsibmFtZSI6InBlcmZfaW50ZXJhY3RpdmUiLCJ2YWwiOiIxMjcxIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMTI4NiJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiIxNDU5In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiOWE1OTgwOGYtOGUxMy00MTUwLTY2NTMtZWMxMmYyMzdkYWJiIiwiZG9tYWluX2lkIjoiMzQ3NDY5IiwidF9lcG9jaCI6MTY3MTIxNzk2OSwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X3BhaW50IiwidmFsIjoiMzMzMyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjlhNTk4MDhmLThlMTMtNDE1MC02NjUzLWVjMTJmMjM3ZGFiYiIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInRfZXBvY2giOjE2NzEyMTc5NjksImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMzMzMyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjlhNTk4MDhmLThlMTMtNDE1MC02NjUzLWVjMTJmMjM3ZGFiYiIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInRfZXBvY2giOjE2NzEyMTc5NjksImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjkuMyJ9XX1d
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0YIPS09Zn1iNLD9BJ1cp%2BVCbBtpKjDDWZpiL7xWJP1FOpglj4EfMfjttBoj6zGa62fAMvOZrnIb%2BgYKef7FnCj6J7jj9psL1AYbyXGUzgD5DzVbZXbeFTbcMhtv2burSpwvSRrg%3D"}],"group":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bba56f21b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:50 GMT

GET
H3 204 greenoaks.gif Show response
www.websleuths.com/detroitchicago/ 0
507 B 110ms
108ms XHR
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiOWE1OTgwOGYtOGUxMy00MTUwLTY2NTMtZWMxMmYyMzdkYWJiIiwiZG9tYWluX2lkIjoiMzQ3NDY5IiwidF9lcG9jaCI6MTY3MTIxNzk2OSwiZGF0YSI6W3sibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiIxNTQwIn1dfV0=
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ypkyyajWJdZeSxSW9xX0AaWZtW0PivkResOwHQ34qhPkIFzrXobL%2Flwo7%2B7Kdf8R%2FEL6k7RW9ILHPYJip%2B0lQxcKv5ToudKpR14HhIp6JdXen604HVu%2FqKl8mRq27wwW2yLTGVM%3D"}],"group":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bba56f23b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:49 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 187ms
68ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 19:12:52 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F6F2 13 KB
5 KB 169ms
55ms Document
text/html 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f132.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

accept-ranges: bytes
age: 2912
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 18:24:20 GMT
expires: Sat, 16 Dec 2023 18:24:20 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D76A 783 B
1 KB 199ms
81ms Document
text/html 172.217.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6576ea453fc7e324b6f9c811c0495c268a1eb1fcb2bcf3662dcc870419e14c5b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BukR7no1H59ijhWVkT7t_g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-BukR7no1H59ijhWVkT7t_g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 19:12:52 GMT
expires: Fri, 16 Dec 2022 19:12:52 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame F6F2 36 KB
16 KB 159ms
53ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 15:44:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 271683
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 15:44:49 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D76A 0
0 162ms
87ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120501&jk=2096151623221257&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 64ms
63ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 65ms
65ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 145 KB
43 KB 634ms
634ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=841550876051597&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=6&adks=247345112&didk=1083507215&sfv=1-0-40&ists=1&fas=8&prev_scp=ic%3D1%26ezoic%3D1%26br1%3D12%26iid1%3D2822643941157631%26bra%3Dmod66%26ap%3D9999%26al%3D1006%26eb_br%3D14e8a85d4c42ff1db8790cbef9e33493%26ga%3D2497208%26tap%3Dwebsleuths_com-pixel1-2822643941157631%26bvr%3D8%26d%3D347469&eri=1&sc=1&cookie=ID%3D09d4a9d88c2f13b7%3AT%3D1671217972%3AS%3DALNI_Mbq6bD0NKG-FtglCl4txiVIx4Q_JA&gpic=UID%3D00000b938640244f%3AT%3D1671217972%3ART%3D1671217972%3AS%3DALNI_MY2wR8ZGmKZIhTUHmhvihrEq54prA&abxe=1&dt=1671217972829&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=ACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67d8e52f8fa233ee0e2e29fb5031abd6fc4bb693f63718ac24cc60fe898dbf68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44412
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_page_level_ads_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ 37 KB
14 KB 62ms
62ms Script
text/javascript 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022120501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

sffe /

Resource Hash

5eadb3853810c64a037b947f6355ca7f98036d56bfb46ee9f51a01f881259ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 12 Dec 2022 16:16:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 356159
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14011
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 12 Dec 2023 16:16:53 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F6F2 0
10 B 55ms
55ms Image
text/plain 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?bUQhEw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.161 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f161.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:52 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 94ms
29ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 15:39:13 GMT
content-encoding: gzip
age: 2172820
x-guploader-uploadid: ADPycdtXsihSIn-juE2xi3HCUfoDHbh2sjzJJEUjN58pMCUFSOHS-iOTo4e134B0mYgaxb9tRoVBHb7W7nQJhTwwSuHf5g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Tue, 21 Nov 2023 15:39:13 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 152ms
50ms Script
text/javascript 178.250.2.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f066a6392f3732829e95d97ac2a3dfb7dc7d35fc88d71a4ef62ff8f70399326c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-9c1f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 17 Dec 2022 19:12:53 GMT

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 97ms
36ms Script
application/javascript 104.16.89.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 37092
x-jsd-version: master
content-encoding: br
x-cache: MISS, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230064-FRA, cache-yyz4527-YYZ
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hHA%2BsGotUU6RQhxqhvUxrQ7qct3HwWgU4ssM52RGUZG9aEAde46gsVy2QavOhWwymGcQk7%2FPiCENwxOGUByJlyDIQwcofacpwiB1kvulq0wSNQljLkFa80YllonwLECnsbo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 77a9bbaecf6515e0-ARN

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 42ms
40ms Script
text/javascript 104.22.52.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.52.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a97afd769b3d774563606be9e943789398af5a1bf3583c2bc9a81f99832aa2b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 24 Nov 2022 12:48:29 GMT
server: cloudflare
x-amz-request-id: 2YAKAG9H0BH7RPZZ
age: 27
etag: W/"91dadf6b1eddd8d91a5cc2e3be5ea8cf"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 77a9bbae6c220a35-ARN
x-amz-id-2: +BiZ8Go4o3iYxboR3EUutEwDldqyf/2SkF9e0CrNnHon12dWcUiDxyN/I+y4AM1Q0nypWPSkoXU=

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
2 KB 94ms
29ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 23bc1d893ce2d2f30b68e549aa3cb991c2a7b7dd87e3df67d9fbb6a8dd113bf8

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 18:33:14 GMT
via: 1.1 google
age: 2379
x-guploader-uploadid: ADPycdsXO9iUVOKrheHQuW3MHHhD-d0VeZO03jbGqYdE8LIuiGN-hV_0L7bc4gd3XTlZ81lVoG-ji7AR6AeyXSd3eXcVqYz3oo9a
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1258
last-modified: Fri, 29 Jul 2022 16:55:09 GMT
server: UploadServer
etag: "f5bc066f146e3dbb049aa6c86c7012e6"
x-goog-generation: 1659113709880056
x-goog-hash: crc32c=6QojvA==, md5=9bwGbxRuPbsEmqbIbHAS5g==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 1258
accept-ranges: bytes
expires: Fri, 16 Dec 2022 19:33:14 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 32 KB
10 KB 187ms
55ms Script
text/javascript 65.9.66.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 66a8dfcc4572e000bf5b4351bae2a763b3357a65ed373ff27a7e7b38ec9486ae

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 06:30:00 GMT
content-encoding: gzip
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
last-modified: Mon, 21 Nov 2022 18:55:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 45774
x-amz-server-side-encryption: AES256
etag: W/"2c5f4a319c3d99310927955777b5abe3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: 0RH2rbYjqGdS8jbzGOG-C9T3CG5O_nnekU8t5EcNjeTeHxxA_9FZWw==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 983 B
1 KB 167ms
51ms Script
text/javascript 13.35.250.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.250.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-250-201.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e5a098542163dc535e0e3c4ed1bca8fcc8a13f0b827027385af73b8d3db5fa38

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Fri, 16 Dec 2022 16:50:52 GMT
Via: 1.1 c05282a87474a55ae2a8dd2aa77d1232.cloudfront.net (CloudFront)
Last-Modified: Tue, 13 Dec 2022 01:20:08 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA6-C1
Age: 8522
ETag: "0e5a5daa4df15b9fd6c9195ac991749e"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 983
X-Amz-Cf-Id: MHh9Kf6EwtxHc0VKbdHpt2uanB3tbWcRQ3VVwxSGs1ucwWHiUuP9YQ==

GET
H3 200 container.html Show response
75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 285D 6 KB
3 KB 175ms
58ms Document
text/html 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s46-in-f1.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 19:12:51 GMT
expires: Sat, 16 Dec 2023 19:12:51 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 greenoaks.gif Show response
www.websleuths.com/detroitchicago/ 0
500 B 111ms
111ms XHR
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjMwMDIifV19XQ==
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L5wEPclWvNdCKX4MLfIUN1ZoIoKzSuMwsnLIWyemfn2V4aKLzCgcylUt02PAptji33cek7fcerDjQenOtmD%2Fzt61WNf0TkRl9xIKqX3C089cL0Q9FdK84Ue5M8t01%2BeE6vW6Wn0%3D"}],"group":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bbae8a45b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:53 GMT

GET
H3 204 army.gif Show response
www.websleuths.com/porpoiseant/ 0
500 B 108ms
107ms XHR
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjgyMjY0Mzk0MTE1NzYzMSIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInVuaXQiOiJ3ZWJzbGV1dGhzX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI4MjI2NDM5NDExNTc2MzEiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ1bml0Ijoid2Vic2xldXRoc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY3MTIxNzk2OSwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiOWE1OTgwOGYtOGUxMy00MTUwLTY2NTMtZWMxMmYyMzdkYWJiIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjE0ZThhODVkNGM0MmZmMWRiODc5MGNiZWY5ZTMzNDkzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIyODIyNjQzOTQxMTU3NjMxIiwiZG9tYWluX2lkIjoiMzQ3NDY5IiwidW5pdCI6IndlYnNsZXV0aHNfY29tLXBpeGVsMSIsInRfZXBvY2giOjE2NzEyMTc5NjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDEyLCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTIsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjgyMjY0Mzk0MTE1NzYzMSIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInVuaXQiOiJ3ZWJzbGV1dGhzX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1NTMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjI4MjI2NDM5NDExNTc2MzEiLCJkb21haW5faWQiOiIzNDc0NjkiLCJ1bml0Ijoid2Vic2xldXRoc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY3MTIxNzk2OSwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiOWE1OTgwOGYtOGUxMy00MTUwLTY2NTMtZWMxMmYyMzdkYWJiIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bFaUQqtGppmz%2FAIG2yRP94jfvDfeJAYARgvsMrHEkWjaXLs2hfusx0bgrlT4ktLVEDQAZ7JchDWDb9qk5xsDektSogUzQmuTYpktM4BlYJwymar8DSnwOwdIJxnow9sYbB7Inls%3D"}],"group":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bbae8a48b4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:54 GMT

POST
H3 204 army.gif
www.websleuths.com/porpoiseant/ 0
529 B 62ms
62ms Ping
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMjgyMjY0Mzk0MTE1NzYzMSIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInVuaXQiOiJ3ZWJzbGV1dGhzX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiI5YTU5ODA4Zi04ZTEzLTQxNTAtNjY1My1lYzEyZjIzN2RhYmIiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMi0xMi0xNiJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE5In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjUifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I0EdkkieNJJNCxBTPXRF%2F6motksw%2B4IeAS28Yv8aQW8%2FCECEfZYSYB0dR0BwvhxjEwNfgwhIvzDUL0BWLsimaDbXCzB6f7HDI28vlvCdnDk%2FJVBlQjWndClr3JulXrxmNFBm1fE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://www.websleuths.com
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bbae8a4ab4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:52 GMT

POST
H3 204 army.gif
www.websleuths.com/porpoiseant/ 0
526 B 62ms
62ms Ping
text/plain 104.21.49.31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.websleuths.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMjgyMjY0Mzk0MTE1NzYzMSIsImRvbWFpbl9pZCI6IjM0NzQ2OSIsInVuaXQiOiJ3ZWJzbGV1dGhzX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjcxMjE3OTY5LCJhdWN0aW9uX2Vwb2NoIjoxNjcxMjE3OTczLCJhZF9wb3NpdGlvbiI6OTk5OSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjlhNTk4MDhmLThlMTMtNDE1MC02NjUzLWVjMTJmMjM3ZGFiYiIsImJpZF9mbG9vcl9pbml0aWFsIjoxMiwiYmlkX2Zsb29yX3ByZXYiOm51bGwsImJpZF9mbG9vcl9maWxsZWQiOjEyLCJhdWN0aW9uX2NvdW50IjoxLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo2NjYsIm11bHRpX2FkX3VuaXQiOm51bGwsIm11bHRpX2FkX2NvdW50IjpudWxsLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-3y02-8y06-13y07-2y0b-6y0d-21y14-4y18-5y22-3y30-4y5a-2y5e-22y65-1y62-28&cmbcb=117&sj=x04x02x06x07x0bx0dx14x18x22x30x5ax5ex65x62&abt=DelayAdXForPrebid
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.49.31 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/forums/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wWVfsAo8qGx8fWCjXJCpguafjE9fAbUQvksb7cz4iO%2FyRKkTADhdi99p0QCjwX83wqv9aimssLwQuIf%2BDtZo6JQU3y%2F5kEmoQuYZ7fWUEzZEm7pMKnPyS21pI56EIQkYrxDUdk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://www.websleuths.com
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
cf-ray: 77a9bbae8a4cb4f9-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 15 Dec 2022 19:12:54 GMT

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
327 B 170ms
56ms XHR
text/plain 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.websleuths.com
date: Fri, 16 Dec 2022 19:12:52 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H3 200 encrypt Show response
esp.rtbhouse.com/ 221 B
238 B 123ms
64ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 093746324ca4ae6cef02cc8fb496afe4f95bec43a2a6d004cbf0cbf9bd6785f1

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
via: 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 016f0367d0ad163b4465dc19c00309a4
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 221

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 154ms
61ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.websleuths.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://www.websleuths.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Fri, 16 Dec 2022 19:12:53 GMT
server: Google Frontend
vary: Origin
via: 1.1 google
x-cloud-trace-context: 5046b9d602458747600deb071b606030

GET
H3

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&rid=esp&cc=1

85 B
103 B

184ms
153ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&rid=esp&cc=1
Protocol: H3
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 3980f92c2631c0abb280bd91e607c84eaf31f70dcf2c1040e95c991fd29b5ba5

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-XcyR+mf1dLJta9vRML7D7EEu3iw"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.websleuths.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Fri, 16 Dec 2022 19:12:53 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://www.websleuths.com
location: /esp?url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 css2
fonts.googleapis.com/ Frame 285D 4 KB
1 KB 174ms
61ms Stylesheet
text/css 142.250.185.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f10.1e100.net

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Dec 2022 19:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 16 Dec 2022 17:19:07 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Dec 2022 19:12:53 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame ED47 8 KB
968 B 163ms
61ms Stylesheet
text/css 142.250.185.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f10.1e100.net

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Dec 2022 19:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 16 Dec 2022 17:34:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Dec 2022 19:12:53 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame ED47 2 KB
765 B 55ms
55ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 17:06:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 30 Dec 2022 17:06:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/ Frame ED47 23 KB
9 KB 56ms
56ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/abg_lite_fy2021.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 17:06:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 30 Dec 2022 17:06:09 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame ED47 3 KB
1 KB 56ms
55ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 13:47:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19503
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 30 Dec 2022 13:47:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame ED47 18 KB
7 KB 58ms
57ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 13:02:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 30 Dec 2022 13:02:25 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame ED47 0
0 177ms
63ms Image
text/html 172.217.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTQNhe_jPVENBAadOrX5BBGmtr5nYYAn0z76GXrVgIrwascKBSsot025tycl6ZL3VaoGmQrfXtTKykkKe0wUSWv_rsNIg
Requested by: Host: www.websleuths.com
URL: https://www.websleuths.com/forums/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: zrh04s06-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ED47 153 KB
47 KB 276ms
128ms Script
text/javascript 142.251.208.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.208.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s43-in-f2.1e100.net

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 19:12:53 GMT

GET
H2 200 5abbe811e7745ada511aeaa994a13f9f.js Show response
www.gstatic.com/mysidia/ Frame ED47 34 KB
14 KB 172ms
54ms Script
text/javascript 216.58.212.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5abbe811e7745ada511aeaa994a13f9f.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f3.1e100.net

Software

sffe /

Resource Hash

6b23e94a0591e43f749074a39df5a5e700d5bd6c40d1b8016a1a2e44a3176037

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 17:06:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 266804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14213
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 23:34:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 13 Mar 2023 17:06:09 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/ Frame 285D 19 KB
8 KB 64ms
64ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221207/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d0ed9630334a711204c67723b1eb52755c8316466fa7e4e601958e0c12a5da9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 06:12:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46795
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8084
x-xss-protection: 0
server: cafe
etag: 2222875591315018765
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 30 Dec 2022 06:12:58 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 285D 205 B
520 B 180ms
66ms Image
image/png 216.58.212.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 13:28:00 GMT
x-content-type-options: nosniff
age: 107093
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 15 Dec 2023 13:28:00 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 285D 604 B
695 B 180ms
67ms Image
image/png 216.58.212.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 15:59:05 GMT
x-content-type-options: nosniff
age: 11628
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 16 Dec 2023 15:59:05 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 207ms
65ms XHR
application/json 52.214.61.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.61.187 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-61-187.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f5815b011c7dd2dfb40663a8f80f796bb74d61b66c61c2c55fa79128639cfb4

Request headers

Referer: https://www.websleuths.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:53 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache
x-server: 10.45.24.15
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 4D49 15 KB
6 KB 485ms
53ms Document
text/html 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.websleuths.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d0f07190791630edc058ad6e5a33a3cda6a8f85c470e593ce0bbed46ffec148b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 19:12:53 GMT
server: Kestrel
server-processing-duration-in-ticks: 938213
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6F51 143 B
166 B 55ms
54ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

age: 988
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 18:56:25 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9713 1 KB
643 B 53ms
52ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

age: 29477
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 11:01:36 GMT
etag: 48472445140208031
expires: Sat, 17 Dec 2022 11:01:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 9713
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEEUECTQpyx1nbZXFRsRHsfY&google_cver=1&google_push=AavPq0OxAhadaOXAbfkK5CjRJ40ZzTUqYQgarT72YVD_YRSQzahVtRFm4DYH7Cqi2UDo7Uet1ijClbSHb6EUWpv8rlGfOFxyynvD
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDE5ODYyNjU1MzAxODMyMDAzNQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEEUECTQpyx1nbZXFRsRHsfY&google_cver=1

43 B
398 B

86ms
51ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEEUECTQpyx1nbZXFRsRHsfY&google_cver=1
Protocol: H2
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 16 Dec 2022 19:12:53 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEEUECTQpyx1nbZXFRsRHsfY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9713
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEL8JPK76HJhhScsPeJQOo4I&google_push=AavPq0O2MXrLwLQF6vw-_bvSJtPyalIrzpRTwE_V1tMQkG5ZkD1IEtKtbP...

170 B
188 B

179ms
82ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEL8JPK76HJhhScsPeJQOo4I&google_push=AavPq0O2MXrLwLQF6vw-_bvSJtPyalIrzpRTwE_V1tMQkG5ZkD1IEtKtbPo02OlyjZsBshFgCPmP32nUjJM_Zhk4ufk6OIIHU9fW

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-bma1639-BMA
pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1671217974.940913,VS0,VE91
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEL8JPK76HJhhScsPeJQOo4I&google_push=AavPq0O2MXrLwLQF6vw-_bvSJtPyalIrzpRTwE_V1tMQkG5ZkD1IEtKtbPo02OlyjZsBshFgCPmP32nUjJM_Zhk4ufk6OIIHU9fW
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9713
Redirect Chain

https://match.adsby.bidtheatre.com/adxcookie?id=&google_gid=CAESELcobV2PM-0x7Y6MLZAC640&google_cver=1&google_push=AavPq0NmxfS30SsSHaSuaYuhD6lkhB-EgQE6nkGQvhFc1m3FCo2QwIG2gfF_CZp2Vk7xATC7cAvaZ2RAqJZ...
https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AavPq0NmxfS30SsSHaSuaYuhD6lkhB-EgQE6nkGQvhFc1m3FCo2QwIG2gfF_CZp2Vk7xATC7cAvaZ2RAqJZOh8U_zPJlcXx0cj-C

170 B
188 B

213ms
100ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AavPq0NmxfS30SsSHaSuaYuhD6lkhB-EgQE6nkGQvhFc1m3FCo2QwIG2gfF_CZp2Vk7xATC7cAvaZ2RAqJZOh8U_zPJlcXx0cj-C

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AavPq0NmxfS30SsSHaSuaYuhD6lkhB-EgQE6nkGQvhFc1m3FCo2QwIG2gfF_CZp2Vk7xATC7cAvaZ2RAqJZOh8U_zPJlcXx0cj-C
Date: Fri, 16 Dec 2022 19:12:54 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 200 dds
rtb.openx.net/sync/ Frame 9713 43 B
350 B 115ms
54ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPnBwcEJNzIuhce5cjWkqaI&google_cver=1&google_push=AavPq0O7iTe_KVkvkWeYGoMU1_5N34n5bAry4xap1iGedGcStB0FPnOqq_Ly24W0hDo6teN7SltLpD1SoOXaTPTn9PMxtSKM6U94
Requested by: Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:53 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 6b42cnign35srudsa2qedqdd0aip3454

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame 9713 0
500 B 588ms
133ms Image
text/plain 69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAavPq0P0u6_jn36lc-OASCMR4tBUGhI4emrWahNn_VEjp9qWeEzB9agwcoM0LKCqYTBgX9Z2lgkgrck7xHyZnJtc5adjXh5KeV8%26google_hm%3D%5BUID%5D&google_gid=CAESEM0peRNWscXNfTLsKgvb_a0&google_cver=1

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Dec 2022 19:12:54 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-164
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 9713
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESENnbP1cxp0RHfTszEG4NrVM&google_cver=1&google_push=AavPq0NhwPzoJ8aoymDuhk2uQCdEGjjepy2nQGPEdyErrxH4cVmkyWANKTPtDd6JUL0Nlrdx4IGHhW-yimCL8e2NYbPpx9vm0xyJ
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AavPq0NhwPzoJ8aoymDuhk2uQCdEGjjepy2nQGPEdyErrxH4cVmkyWANKTPtDd6JUL0Nlrdx4IGHhW-yimCL8e2NYbPpx9vm0xy...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjEyMzk4NDYyNTQ1NTQ2MjQ0Mzg2Mw%3D%3D&google_push=AavPq0NhwPzoJ8aoymDuhk2uQCdEGjjepy2nQGPEdyErrxH4cVmkyWAN...

170 B
329 B

66ms
66ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjEyMzk4NDYyNTQ1NTQ2MjQ0Mzg2Mw%3D%3D&google_push=AavPq0NhwPzoJ8aoymDuhk2uQCdEGjjepy2nQGPEdyErrxH4cVmkyWANKTPtDd6JUL0Nlrdx4IGHhW-yimCL8e2NYbPpx9vm0xyJ

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjEyMzk4NDYyNTQ1NTQ2MjQ0Mzg2Mw%3D%3D&google_push=AavPq0NhwPzoJ8aoymDuhk2uQCdEGjjepy2nQGPEdyErrxH4cVmkyWANKTPtDd6JUL0Nlrdx4IGHhW-yimCL8e2NYbPpx9vm0xyJ
date: Fri, 16 Dec 2022 19:12:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9713
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESECqWgbYnPh4TdcS7x3tOJbA&google_cver=1&google_push=AavPq0NRw7syvS8cNnSESS7ulfxBw0Viku68aCZs4Jo-ijsrq6y1zAW4QuLLsu7CZ_28y93RGsEkG-bs25BPQS2KN0xn4te5QFVj
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzE0MjE5NTc0NzMzMzU4MjAwMFYxMA%3d%3d&mn_hm=MzE0MjE5NTc0NzMzMzU4MjAwMFYxMA%3d%3d&google_sc=1&google_push=AavPq0NRw7syvS8cNnSESS7ulfxBw0V...

170 B
188 B

102ms
79ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzE0MjE5NTc0NzMzMzU4MjAwMFYxMA%3d%3d&mn_hm=MzE0MjE5NTc0NzMzMzU4MjAwMFYxMA%3d%3d&google_sc=1&google_push=AavPq0NRw7syvS8cNnSESS7ulfxBw0Viku68aCZs4Jo-ijsrq6y1zAW4QuLLsu7CZ_28y93RGsEkG-bs25BPQS2KN0xn4te5QFVj&gdpr=&gdpr_consent=

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 16 Dec 2022 19:12:54 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzE0MjE5NTc0NzMzMzU4MjAwMFYxMA%3d%3d&mn_hm=MzE0MjE5NTc0NzMzMzU4MjAwMFYxMA%3d%3d&google_sc=1&google_push=AavPq0NRw7syvS8cNnSESS7ulfxBw0Viku68aCZs4Jo-ijsrq6y1zAW4QuLLsu7CZ_28y93RGsEkG-bs25BPQS2KN0xn4te5QFVj&gdpr=&gdpr_consent=
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
X-MNET-HL2: E
Expires: Fri, 16 Dec 2022 19:12:54 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 9713 0
223 B 184ms
65ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KNiLqbIC2TRQZQdJSIVz3rsuTI7x5j-_Mu2mxpuV6dU2ivY_X0hQOmgQ7Y4vy4ves1XKEq

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6F51
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

60ms
60ms

Document
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com
URL: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 19:12:53 GMT
expires: Fri, 16 Dec 2022 19:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Dec 2022 19:12:53 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame A52F 0
176 B 124ms
54ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.websleuths.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Fri, 16 Dec 2022 19:12:54 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 91B2 36 KB
16 KB 53ms
52ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: www.websleuths.com
URL: https://www.websleuths.com/forums/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://75600ade35d03c853524120fa0c72dbe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 13 Dec 2022 15:44:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 271685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 13 Dec 2023 15:44:49 GMT

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 4D49 435 B
557 B 61ms
53ms Fetch
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=websleuths.com&sn=ChromeSyncframe&so=0&topUrl=www.websleuths.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.websleuths.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fd4599b673cd6a1fea52b96bdbac3f6c2928688de10a2bba2a6496b3b2cf3c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.websleuths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Dec 2022 19:12:54 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2694332
expires: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 90ms
90ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120501&jk=2096151623221257&bg=!RUalRgLNAAYgquz3AKo7ACkAdvg8WhbS_luyZYix9rYmY2bWdqFp-N1zWlmmIsbErJzLY89iIwmdBAIAAABQUgAAAANoAQcKALnP5GuWgVSsFT5NMYXotqe-E2YGOxfaFwR5yt_ghAWLhzMumJbJBNfw7IsqW9PhAmS0VEi2hgiZuRUPtuCrPDFVLunk71uG84ggzdyABmCWVmhAiqHISkVtGNlJbZp0hDFT9ZY336AXXzP8MLGhArq-sTcl2daEODamncUIZsZ514tU04JqZBhFU9X4myoY0tiaDxAXwopjCwouQz8PBgCzz_HsBYL9HTgfcbne41uWRX75IaVYcwa1XJkC3FGTTINYEmYzIQVpZWHwEa7zkuJE5dQKPkUDpi07CLxJDRMQPePtNzr1iOH6DMK1ZHYk24yRfrV4Haklv9tgrQje5hQNsUgzMVAyCmZvFodLst1Ibx4R--DFrY3jqMJj_3Y3PXHXflCZcioE3NTEEpm48p_G_qZ-wtbAnn-EthjSzqPl1fztxtks4At2SuBnXhEurenOTZ8bhTa820FBqnbrIIvvSsPjr8XlTkchHHdKg8dhnb56WtywPNaQLXSa6epRsLUWKg0bzyTLRP4wurDPF6zJPLC2LbGz-lLvNMI0p9_kqWq5RwMd0oep0Yf9QV9N0W0qit4bKHZUfr_QO8ilXpuGy-x3G9VvCOk5XjuExXCF97c71B6xucwgy7TQANsGXigKLGiaSH7PsoTIba2UGLy2ypwpxKeOI2r87Ih4THblOYC050VA3ZaDgszkpnrjuB9dB2zL4kmGSFUhoYqlyhggt7Pw66VBNi2-aokD2Gu1-KbHief6ig1vyeGVL29ZwtldYgQTRNuSvGl62NvIGyHaJqzH-m2ZUW_GDLgOYyYVdnXiU65Ub0QHbBKVMWHw9-YZCzYw14kUr2JhkOvPx1dDSkMEOBYZq12o-k1tC46ZOMuk4u1DAuB4y36fJ-8c2fUch-OILI28pdBXDiEe_36rTmpX_feIxnzlUieMVLCBf7E_lImQMFV4rNOtYzw2tJ9vkilZ79JAZ0h5GJkAK0trKqEDyoZqB4Z47psrKv2wrPfyhK5niwyuiH1NpmPx0OKOAKBjLXEav_TgWrNKSZHj5oXARYZqixN_eBp73zr9U8_CJJ7j2cnWQzfVNYljwshINMhZNGVDrGw4gmQ49tVZK63j0fZzSrE-zHIn3fhxy5D9wfns_fK1cOPyU5QLQCVMV2Q3_PfjavMsC4omzWWRy2_8oY-wGptoYrLsSPquvuAhKbzgIa_pHGnBpmTSl8MXbJVrHlqrYw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 65ms
65ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 63ms
63ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.websleuths.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 954 B
446 B 387ms
386ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=1850705763015680&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=7&adks=3498223290&didk=478842339&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D4404216789133340%26eid%3D4404216789133340%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dwebsleuths_com-medrectangle-2-4404216789133340%26eb_br%3D1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D22%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C67%2C0%2C193%2C196%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1428%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D24%26reqt%3D1671217974949&eri=1&sc=1&cookie=ID%3D09d4a9d88c2f13b7%3AT%3D1671217972%3AS%3DALNI_Mbq6bD0NKG-FtglCl4txiVIx4Q_JA&gpic=UID%3D00000b938640244f%3AT%3D1671217972%3ART%3D1671217972%3AS%3DALNI_MY2wR8ZGmKZIhTUHmhvihrEq54prA&abxe=1&dt=1671217974955&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=ACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY65Hq4tEwSABSAghkEhkKCnB1YmNpZC5vcmcY0JLq4tEwSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGOuR6uLRMEgAUgIIZBLCAQoIcnRiaG91c2USrAFTd25id3hnRjlqSy8yUzJEbTE1S1QwWXJzbDhwY2VDcWRBS0tTcXpJMlBpb1J6Zjk0c3RrVW5QYTBMeGNvR0RFQzZYWjhpT1BpSlVEUlJ2alJ6V2c3NnRSSFVXaDIreEJOYXJTVkhZaS9tNEtnQ0tGL0VyKzhOV3c0RGZWT3c2dDJzZndBQ3JTcHkwOWFOTjlyYTk4TEJGcmRuQlJXVGpBeHRIdU1JOHVwLzg9GOiU6uLRMEgAEj4KBW9wZW54EixleUpwSWpvaVRWcGtXVmh1WldSUlJXa3lPRkpJYzBNNFdXaGlRVDA5SW4wPRjfleri0TBIABIZCgp1aWRhcGkuY29tGOuR6uLRMEgAUgIIZBIbCgxpZDUtc3luYy5jb20Y2JPq4tEwSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

30ce82da4f285cc7d2551509742e0774ff1473edbfe9af3c9ec71f46f63a13fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:55 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 417
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 946 B
441 B 446ms
446ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=738610700224296&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=8&adks=827824745&didk=2612740235&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D1306947225118161%26eid%3D1306947225118161%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dwebsleuths_com-box-1-1306947225118161%26eb_br%3D14e8a85d4c42ff1db8790cbef9e33493%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D12%26br2%3D6%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C760%2C761%2C815%2C816%2C817%2C818%2C899%2C919%2C1428%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3052%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3856%2C3919%2C3933%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D14%26reqt%3D1671217974943&eri=1&sc=1&cookie=ID%3D09d4a9d88c2f13b7%3AT%3D1671217972%3AS%3DALNI_Mbq6bD0NKG-FtglCl4txiVIx4Q_JA&gpic=UID%3D00000b938640244f%3AT%3D1671217972%3ART%3D1671217972%3AS%3DALNI_MY2wR8ZGmKZIhTUHmhvihrEq54prA&abxe=1&dt=1671217974960&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=1180&adys=217&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=320x-1&msz=300x-1&fws=0&ohw=0&psts=ACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY65Hq4tEwSABSAghkEhkKCnB1YmNpZC5vcmcY0JLq4tEwSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGOuR6uLRMEgAUgIIZBLCAQoIcnRiaG91c2USrAFTd25id3hnRjlqSy8yUzJEbTE1S1QwWXJzbDhwY2VDcWRBS0tTcXpJMlBpb1J6Zjk0c3RrVW5QYTBMeGNvR0RFQzZYWjhpT1BpSlVEUlJ2alJ6V2c3NnRSSFVXaDIreEJOYXJTVkhZaS9tNEtnQ0tGL0VyKzhOV3c0RGZWT3c2dDJzZndBQ3JTcHkwOWFOTjlyYTk4TEJGcmRuQlJXVGpBeHRIdU1JOHVwLzg9GOiU6uLRMEgAEj4KBW9wZW54EixleUpwSWpvaVRWcGtXVmh1WldSUlJXa3lPRkpJYzBNNFdXaGlRVDA5SW4wPRjfleri0TBIABIZCgp1aWRhcGkuY29tGOuR6uLRMEgAUgIIZBIbCgxpZDUtc3luYy5jb20Y2JPq4tEwSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7a89622fa9e5523e5f07aac2b1d4764e50eb7893517ddda379b210644fb29d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:55 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 412
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 949 B
443 B 427ms
427ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=2292521778021575&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-banner-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=9&adks=110232293&didk=3812235687&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D3869363067091809%26eid%3D3869363067091809%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D31%26al%3D1031%26compid%3D0%26tap%3Dwebsleuths_com-banner-2-3869363067091809%26eb_br%3D1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D22%26br2%3D12%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C4%2C0%2C168%2C132%2C0%2C26%2C209%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C1428%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3933%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D24%26reqt%3D1671217974939&eri=1&sc=1&cookie=ID%3D09d4a9d88c2f13b7%3AT%3D1671217972%3AS%3DALNI_Mbq6bD0NKG-FtglCl4txiVIx4Q_JA&gpic=UID%3D00000b938640244f%3AT%3D1671217972%3ART%3D1671217972%3AS%3DALNI_MY2wR8ZGmKZIhTUHmhvihrEq54prA&abxe=1&dt=1671217974964&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=1180&adys=1074&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=320x-1&msz=300x-1&fws=512&ohw=0&psts=ACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY65Hq4tEwSABSAghkEhkKCnB1YmNpZC5vcmcY0JLq4tEwSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGOuR6uLRMEgAUgIIZBLCAQoIcnRiaG91c2USrAFTd25id3hnRjlqSy8yUzJEbTE1S1QwWXJzbDhwY2VDcWRBS0tTcXpJMlBpb1J6Zjk0c3RrVW5QYTBMeGNvR0RFQzZYWjhpT1BpSlVEUlJ2alJ6V2c3NnRSSFVXaDIreEJOYXJTVkhZaS9tNEtnQ0tGL0VyKzhOV3c0RGZWT3c2dDJzZndBQ3JTcHkwOWFOTjlyYTk4TEJGcmRuQlJXVGpBeHRIdU1JOHVwLzg9GOiU6uLRMEgAEj4KBW9wZW54EixleUpwSWpvaVRWcGtXVmh1WldSUlJXa3lPRkpJYzBNNFdXaGlRVDA5SW4wPRjfleri0TBIABIZCgp1aWRhcGkuY29tGOuR6uLRMEgAUgIIZBIbCgxpZDUtc3luYy5jb20Y2JPq4tEwSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

725a932b68b7d17bbb67fa0da468a399eb86e9383d01e16f8b9e8b9d86a7a27e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:55 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 414
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 954 B
446 B 399ms
399ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=342702555553835&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ifi=10&adks=3860738611&didk=478838826&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D2601769051098736%26eid%3D2601769051098736%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1117%26sap%3D1117%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dwebsleuths_com-medrectangle-3-2601769051098736%26eb_br%3D54d0fa6d5f6aabe7623cb24faa42a441%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D30%26br2%3D16%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C131%2C0%2C67%2C0%2C193%2C196%2C20%2C71%2C201%2C187%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D34%26reqt%3D1671217974947&eri=1&sc=1&cookie=ID%3D09d4a9d88c2f13b7%3AT%3D1671217972%3AS%3DALNI_Mbq6bD0NKG-FtglCl4txiVIx4Q_JA&gpic=UID%3D00000b938640244f%3AT%3D1671217972%3ART%3D1671217972%3AS%3DALNI_MY2wR8ZGmKZIhTUHmhvihrEq54prA&abxe=1&dt=1671217974967&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=401&adys=980&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=1050x60&msz=468x60&fws=0&ohw=0&psts=ACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY65Hq4tEwSABSAghkEhkKCnB1YmNpZC5vcmcY0JLq4tEwSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGOuR6uLRMEgAUgIIZBLCAQoIcnRiaG91c2USrAFTd25id3hnRjlqSy8yUzJEbTE1S1QwWXJzbDhwY2VDcWRBS0tTcXpJMlBpb1J6Zjk0c3RrVW5QYTBMeGNvR0RFQzZYWjhpT1BpSlVEUlJ2alJ6V2c3NnRSSFVXaDIreEJOYXJTVkhZaS9tNEtnQ0tGL0VyKzhOV3c0RGZWT3c2dDJzZndBQ3JTcHkwOWFOTjlyYTk4TEJGcmRuQlJXVGpBeHRIdU1JOHVwLzg9GOiU6uLRMEgAEj4KBW9wZW54EixleUpwSWpvaVRWcGtXVmh1WldSUlJXa3lPRkpJYzBNNFdXaGlRVDA5SW4wPRjfleri0TBIABIZCgp1aWRhcGkuY29tGOuR6uLRMEgAUgIIZBIbCgxpZDUtc3luYy5jb20Y2JPq4tEwSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a50a55f310a6829a899e0800b29ca8ec455284fb8d01992b7bc66e6ad04e3ee4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://www.websleuths.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 19:12:55 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 417
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.websleuths.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 954 B
446 B 412ms
411ms XHR
text/plain 142.251.39.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2096151623221257&correlator=138075646638965&eid=31070873%2C31071145%2C31068825%2C44780792&output=ldjh&gdfp_req=1&vrg=2022120501&ptt=17&impl=fifs&iu_parts=1254144%3A1001550%2Cwebsleuths_com-medrectangle-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C468x60%7C320x50%7C234x60&fluid=height&ifi=11&adks=2467986251&didk=478844209&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D5478670923099893%26eid%3D5478670923099893%26t%3D134%26d%3D347469%26t1%3D134%26pvc%3D0%26ap%3D1118%26sap%3D1118%26as%3Drevenue%26plat%3D1%26bra%3Dmod66%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D22%26al%3D1022%26compid%3D0%26tap%3Dwebsleuths_com-medrectangle-4-5478670923099893%26eb_br%3D54d0fa6d5f6aabe7623cb24faa42a441%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11307%26asau%3D6560196383%26bv%3D37%26bvm%3D4%26bvr%3D6%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D30%26br2%3D16%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C193%2C0%2C67%2C0%2C193%2C196%2C20%2C71%2C201%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D17%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C4276%2C2030%2C783%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D34%26reqt%3D1671217974945&eri=1&sc=1&cookie=ID%3D09d4a9d88c2f13b7%3AT%3D1671217972%3AS%3DALNI_Mbq6bD0NKG-FtglCl4txiVIx4Q_JA&gpic=UID%3D00000b938640244f%3AT%3D1671217972%3ART%3D1671217972%3AS%3DALNI_MY2wR8ZGmKZIhTUHmhvihrEq54prA&abxe=1&dt=1671217974970&lmt=1671217969&dlt=1671217970479&idt=1072&adxs=110&adys=1178&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.websleuths.com%2Fforums%2F&frm=20&vis=1&psz=1050x60&msz=1050x60&fws=0&ohw=0&psts=ACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1%2CACgb8tuRJQV3aL0wM5iAvTk_u1w1&ga_vid=805510516.1671217972&ga_sid=1671217972&ga_hid=334898816&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY65Hq4tEwSABSAghkEhkKCnB1YmNpZC5vcmcY0JLq4tEwSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGOuR6uLRMEgAUgIIZBLCAQoIcnRiaG91c2USrAFTd25id3hnRjlqSy8yUzJEbTE1S1QwWXJzbDhwY2VDcWRBS0tTcXpJMlBpb1J6Zjk0c3RrVW5QYTBMeGNvR0RFQzZYWjhpT1BpSlVEUlJ2alJ6V2c3NnRSSFVXaDIreEJOYXJTVkhZaS9tNEtnQ0tGL0VyKzhOV3c0RGZWT3c2dDJzZndBQ3JTcHkwOWFOTjlyYTk4TEJGcmRuQlJXVGpBeHRIdU1JOHVwLzg9GOiU6uLRMEgAEj4KBW9wZW54EixleUpwSWpvaVRWcGtXVmh1WldSUlJXa3lPRkpJYzBNNFdXaGlRVDA5SW4wPRjfleri0TBIABIZCgp1aWRhcGkuY29tGOuR6uLRMEgAUgIIZBIbCgxpZDUtc3luYy5jb20Y2JPq4tEwSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS