money18.on.cc Open in urlscan Pro
104.16.136.235 Public Scan

Software

sffe /

Resource Hash

f8463bd186f64db19ec87eb4c9ec61ff02ddc349014c78513acac4a0bab406ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1003 / 864 of 1000 / last-modified: 1633126070"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 02 Oct 2021 03:45:01 GMT

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 52 B
103 B 855ms
855ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=200
Requested by: Host: ad5.on.cc
URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eaffa691cfbae8b4d916f49b18478eee3573505d0f7d80ae726bcaaee784eef6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:02 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef82bc1e3a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
178 B 838ms
838ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=702&campaignid=353&zoneid=3&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=5c388143ce
Requested by: Host: ad5.on.cc
URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:02 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aef82bc1f3a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pubads_impl_2021092301.js Show response
securepubads.g.doubleclick.net/gpt/ 338 KB
119 KB 30ms
28ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js?31063001

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7f36354b34b6689975a55773065d0b9dc7ab48ef63ee6e8bb68f199bf7debbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121150
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 08:34:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 02 Oct 2021 03:45:01 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 59 B
94 B 50ms
22ms XHR
application/json 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=money18.on.cc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd8ea3ad753025f56486e44ae13279c9076b5b9449c15ca846a98f73be1f93e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 03:45:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69
x-xss-protection: 0
expires: Sat, 02 Oct 2021 03:45:01 GMT

GET
H2 200 page.php Show response
www.facebook.com/plugins/ Frame C871 43 KB
15 KB 88ms
73ms Document
text/html 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

41082579822d87e6fdb7defa18e35022c1f3b350c6986003ddfa788a64ed7ad5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://money18.on.cc/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/

Response headers

vary: Accept-Encoding
content-encoding: br
x-fb-rlafr: 0
cross-origin-opener-policy: unsafe-none
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ wss://*.whatsapp.com:* v.whatsapp.net *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: 9kCzrMyiO54J279ParZkVMMiGijru2zlkHP/MaOmwzCD2G/7s4qNo5QDYaksxN9mXSVAIvMT231Ldnhgsj7jSQ==
date: Sat, 02 Oct 2021 03:45:02 GMT
priority: u=3,i
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 1 KB
820 B 821ms
820ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=14
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a5176a5b931f108be65f5f9c74c307356cb2e4a410fbc609bed8b234903ecd4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:03 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef881ec83a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 bg.png
money18.on.cc/ad/bnpParibas2017/img/ 40 KB
40 KB 26ms
26ms Image
image/png 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/bnpParibas2017/img/bg.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0cc997eecbba111b2f384fa28c637906da7d6eee512df49840bfc992e370b23

Request headers

:path: /ad/bnpParibas2017/img/bg.png
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: money18.on.cc
referer: https://money18.on.cc/css/style.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Sat, 02 Oct 2021 03:45:02 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 14 Jul 2021 08:09:14 GMT
server: cloudflare
age: 27772
etag: "60ee9baa-9ef8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=900, s-maxage=28800
accept-ranges: bytes
cf-ray: 697aef882ecf3a3b-CDG
content-length: 40696

GET
H3 200 mNbyASsmosL.css
www.facebook.com/rsrc.php/v3/yi/l/0,cross/ Frame C871 26 KB
6 KB 25ms
16ms Stylesheet
text/css 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yi/l/0,cross/mNbyASsmosL.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c09ace26d3b44cd5222188b9949612728b5b5fdb6a10001247ebf9d88880d8bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Origin: https://www.facebook.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:49:45 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 37DLiMNaA+p2ok4lubqdMg==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.facebook.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cross-origin-resource-policy: cross-origin
content-length: 6039
x-fb-rlafr: 0
x-fb-debug: qgIVuqcjSdf9itq3CNIWKeGDbu827FzJs7nvey22p6XL9eub2RRN06pMUM1pLAg1C8nAwMz00MJdkyxtUUQhww==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Oct 2022 15:49:45 GMT

GET
H3 200 FPdNN1TK3wJ.css
www.facebook.com/rsrc.php/v3/yF/l/0,cross/ Frame C871 2 KB
867 B 23ms
15ms Stylesheet
text/css 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yF/l/0,cross/FPdNN1TK3wJ.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a33a18d3ade364ae94fdc88f786c869ff8b45cae9bf98f2e2a16dd1459d98cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Origin: https://www.facebook.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 17:29:58 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: qki4Wy05mlz5CwH9oqDKag==
cross-origin-resource-policy: cross-origin
content-length: 815
x-fb-rlafr: 0
x-fb-debug: iE0VCWm3yKeTFymp8qvahE+uU8tfdjkXzIIp6W+U4MvIcfiL9nvgy00c+GMcooWIVEn2I6fFhCkOJrqZ7AzjOA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 30 Sep 2022 17:29:58 GMT

GET
H3 200 CDBUf3L5Iup.js Show response
www.facebook.com/rsrc.php/v3/yp/r/ Frame C871 300 KB
81 KB 16ms
8ms Script
application/x-javascript 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yp/r/CDBUf3L5Iup.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cf8c4e6304712bf09958038528196d87079449c1701c5910859358ff8f175ea8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Origin: https://www.facebook.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 18:56:24 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 2atFXW942+WxmS3wVGVhHw==
cross-origin-resource-policy: cross-origin
content-length: 83257
x-fb-rlafr: 0
x-fb-debug: 51dyt/a9MIhWbmpuQgSx1uNx1UexID58erXIPuk4D4IC5X3ldMBOMGFLvn6ieYatUYZKFsJnI7c4ggGw0+1eNQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 30 Sep 2022 18:56:24 GMT

GET
H3 200 GG1Y0sYc7My.js Show response
www.facebook.com/rsrc.php/v3/yv/r/ Frame C871 5 KB
2 KB 25ms
17ms Script
application/x-javascript 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yv/r/GG1Y0sYc7My.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

39685db80e880ec9e59c22115c5bcbf76586a95bf618a714d61fc0e5f271fe77

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Origin: https://www.facebook.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:10:56 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: kw22OIA6eDgOltzbJdNVmQ==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ wss://*.whatsapp.com:* v.whatsapp.net *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
cross-origin-resource-policy: cross-origin
content-length: 1640
x-fb-rlafr: 0
x-fb-debug: 18ZlAboRRv9cmr1EGKMUB4p7sIJC8rf2h98ovjVTbnM4Kkt2wkWw4BZ0gwah05Rzrh79AjwlhOQ5hJwMKonpvg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 27 Sep 2022 10:10:56 GMT

GET
H3 200 5IUqmPEqVXe.js Show response
www.facebook.com/rsrc.php/v3/yw/r/ Frame C871 65 KB
20 KB 14ms
7ms Script
application/x-javascript 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yw/r/5IUqmPEqVXe.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e7aa6b0f0e41040b29a7bbde77aa295d13be95ff684ed1040bb9e36b9e649d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Origin: https://www.facebook.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 18:21:11 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: kBdGwq+a9zU/cIQ4fSYPnA==
cross-origin-resource-policy: cross-origin
content-length: 20515
x-fb-rlafr: 0
x-fb-debug: y+D6jyw/dTgqaCEzt6jUOn+UcfgMVCMzkXmA4lWn0GXMrDd1Kd3ZpweKIpFVFWqq0Vu64F5fDACCSnrWUnz4FQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 21 Sep 2022 18:21:11 GMT

GET
H3 200 LaSaGFy1cqz.js Show response
www.facebook.com/rsrc.php/v3iEpO4/yk/l/en_US/ Frame C871 126 KB
35 KB 24ms
17ms Script
application/x-javascript 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3iEpO4/yk/l/en_US/LaSaGFy1cqz.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6aa40d95ce6aec657a94a1a1cc96404308b573ce189a91f13266f304bdec484b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Origin: https://www.facebook.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 21:14:18 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 14MXO6Me+nzpT1RB2KPlCw==
cross-origin-resource-policy: cross-origin
content-length: 35830
x-fb-rlafr: 0
x-fb-debug: pr/WncSLaqau39uhMGNufGtY2/X6txDGxS/+72iznjUVlcBuHuLDRsAn59fU0CAO70yB+txzST6Lq5iM+OTnYw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 23 Sep 2022 21:14:18 GMT

GET
H2 200 240494111_10159467371506552_4980069632129072687_n.jpg
scontent.xx.fbcdn.net/v/t1.6435-9/s228x119/ Frame C871 7 KB
7 KB 43ms
8ms Image
image/jpeg 157.240.236.1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t1.6435-9/s228x119/240494111_10159467371506552_4980069632129072687_n.jpg?_nc_cat=109&ccb=1-5&_nc_sid=dd9801&_nc_ohc=9k9Z8v6DaE8AX9vTd9Q&_nc_ht=scontent.xx&edm=ADwHzz8EAAAA&oh=ce539839051b7fc036ab09b6733daad1&oe=617CB6C5
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.236.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-02-frx5.fbcdn.net
Software: /
Resource Hash: fa066dc0852a6f7fd3f6df7b898c3f43a728fc183c1e904cd1cf9adb365b93e2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-haystack-needlechecksum: 1837096594
date: Sat, 02 Oct 2021 03:45:02 GMT
x-fb-trip-id: 917726464
last-modified: Mon, 30 Aug 2021 10:27:08 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 4221794780
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 7268

GET
H2 200 11800496_10153493827011552_4328724917271417425_n.png
scontent.xx.fbcdn.net/v/t1.18169-1/cp0/c3.3.295.295a/s50x50/ Frame C871 4 KB
4 KB 31ms
9ms Image
image/png 157.240.236.1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t1.18169-1/cp0/c3.3.295.295a/s50x50/11800496_10153493827011552_4328724917271417425_n.png?_nc_cat=109&ccb=1-5&_nc_sid=dbb9e7&_nc_ohc=S-bqsYSPWoAAX_Udz7u&_nc_ht=scontent.xx&edm=ADwHzz8EAAAA&oh=50b61c02d144ea6880e109ac1c000ac8&oe=617D39BB
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.236.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-02-frx5.fbcdn.net
Software: /
Resource Hash: 1ce66233f6459a9de3c3729399b2c3979734fe655c669872421634884dd22dd4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-haystack-needlechecksum: 2755656748
date: Sat, 02 Oct 2021 03:45:02 GMT
x-fb-trip-id: 917726464
last-modified: Thu, 30 Jul 2015 12:21:36 GMT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 959464782
timing-allow-origin: *
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3745

GET
H3 200 qGoWo6gBwwP.png
www.facebook.com/rsrc.php/v3/yy/r/ Frame C871 3 KB
3 KB 7ms
7ms Image
image/png 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/yy/r/qGoWo6gBwwP.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/rsrc.php/v3/yi/l/0,cross/mNbyASsmosL.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

66efeaacbd90eba053bda6c0f17599873a6d2023a9408bd9ad2d414cf9813444

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/rsrc.php/v3/yi/l/0,cross/mNbyASsmosL.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fb-debug: XxPpmaR0/A93juviXg4Zwn/MR1pijaOQ84P1pNGs0jE/w21234pmiBj8u2d37AR7xhHI9Xk6rxPDRgCiGB5NjA==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: iN31dShDArRt9ZikrDb13w==
date: Wed, 29 Sep 2021 23:40:24 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.facebook.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 2616
timing-allow-origin: *
priority: u=3,i
x-fb-rlafr: 0
expires: Thu, 29 Sep 2022 23:40:24 GMT

GET
H3 200 mOcgOmDDSbN.png
www.facebook.com/rsrc.php/v3/yL/r/ Frame C871 1 KB
1 KB 8ms
7ms Image
image/png 157.240.236.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/yL/r/mOcgOmDDSbN.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/rsrc.php/v3/yi/l/0,cross/mNbyASsmosL.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3dc936b3c6e476fbbbfea1c5d962f4bee0e3636450608357ffcf9e6e92e0d596

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.facebook.com/rsrc.php/v3/yi/l/0,cross/mNbyASsmosL.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fb-debug: 6n8qe5dNzbFd24OrECyrT7NWlo2qOuxaPxmUPyU6D8sC8C3pHcFMl7/NOo0rj3A2r+SWG9eEG2aYTyZYbuBMLQ==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 2bKr5oI1XogALo4o3p6kDA==
date: Wed, 29 Sep 2021 15:48:13 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
content-length: 1193
x-fb-rlafr: 0
expires: Thu, 29 Sep 2022 15:48:13 GMT

GET
H3

200

B23819896.268849960;dc_pre=CMj2rIroqvMCFcHnuwgd6pANjQ;dc_trk_aid=463465155;dc_trk_cid=129266000;ord=1633146303.4395;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N1048473.3041567MONEY18/
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N1048473.3041567MONEY18/B23819896.268849960;dc_trk_aid=463465155;dc_trk_cid=129266000;ord=1633146303.4395;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;...
https://ad.doubleclick.net/ddm/trackimp/N1048473.3041567MONEY18/B23819896.268849960;dc_pre=CMj2rIroqvMCFcHnuwgd6pANjQ;dc_trk_aid=463465155;dc_trk_cid=129266000;ord=1633146303.4395;dc_lat=;dc_rdid=;...

42 B
64 B

71ms
41ms

Image
image/gif

142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N1048473.3041567MONEY18/B23819896.268849960;dc_pre=CMj2rIroqvMCFcHnuwgd6pANjQ;dc_trk_aid=463465155;dc_trk_cid=129266000;ord=1633146303.4395;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N1048473.3041567MONEY18/B23819896.268849960;dc_pre=CMj2rIroqvMCFcHnuwgd6pANjQ;dc_trk_aid=463465155;dc_trk_cid=129266000;ord=1633146303.4395;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
178 B 891ms
890ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=458&campaignid=268&zoneid=14&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=064c695d08
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:04 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aef8d494a3a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 3 KB
1 KB 241ms
240ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=7
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2801740896d61e4063fb15ae317e74c4b206b5b64f2b49a7fa2aa80bb8a2c5ce

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:03 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef8d494c3a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 titlebar_20210622.jpg
ad6.on.cc/web/html/m18/desktop/ 9 KB
9 KB 823ms
813ms Image
image/jpeg 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad6.on.cc/web/html/m18/desktop/titlebar_20210622.jpg
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 417b77ae233691c2c943701602e6183f3e2ba30f0e24b94c70c277b102acd9cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:04 GMT
cf-cache-status: HIT
x-cacheable: L04
cf-ray: 697aef8edfdc3b4f-CDG
content-length: 9271
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 22 Jun 2021 02:31:28 GMT
server: cloudflare
etag: "2437-5c5519649e000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 169883151 172417893
cache-control: public, max-age=21600, s-maxage=21600
accept-ranges: bytes
content-type: image/jpeg
cf-bgj: h2pri

GET
H2 200 money_flow.png
money18.on.cc/ad/jpad/ 450 KB
451 KB 240ms
240ms Image
image/png 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad/money_flow.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41dcff45fc9d0ff1a074a7d7178498ea0134a70c84b587bc9b9322613d7ee6b3

Request headers

:path: /ad/jpad/money_flow.png
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:04 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Thu, 30 Sep 2021 01:08:40 GMT
server: cloudflare
etag: "61550e18-70924"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=5, s-maxage=5
accept-ranges: bytes
cf-ray: 697aef8eca573a3b-CDG
content-length: 461092

GET
H2 200 space.gif
ad6.on.cc/web/html/ 43 B
230 B 47ms
38ms Image
image/gif 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad6.on.cc/web/html/space.gif
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:03 GMT
cf-cache-status: HIT
x-cacheable: L04
age: 10216
content-length: 43
x-varnish: 133663002 133048482
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 06 Aug 2014 02:46:44 GMT
server: cloudflare
etag: "2b-4ffecfb84ed00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=21600, s-maxage=21600
accept-ranges: bytes
cf-ray: 697aef8edfdd3b4f-CDG

GET
H3

200

B23303268.307005129;dc_pre=COGpuIroqvMCFWLFuwgducIKOA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1633146303.6836;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_co...
ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1633146303.6836;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;t...
https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_pre=COGpuIroqvMCFWLFuwgducIKOA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1633146303.6836;dc_lat=;dc_rdid=;t...

42 B
65 B

47ms
47ms

Image
image/gif

142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_pre=COGpuIroqvMCFWLFuwgducIKOA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1633146303.6836;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_pre=COGpuIroqvMCFWLFuwgducIKOA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1633146303.6836;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
104 B 821ms
821ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=664&campaignid=62&zoneid=7&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=c50938fbe0
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:04 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aef8eca583a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 1 KB
656 B 880ms
880ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=9&sw=1600
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e785825b9330f05acc3a451de5e2e3da07e73d946be85dd66381944c47e81209

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:04 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef8eca593a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
104 B 914ms
913ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=703&campaignid=353&zoneid=9&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=db9ee2483e
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:05 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aef944d873a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 2 KB
764 B 823ms
823ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=10&sw=1600
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3d961807be78786b3d1f1628b5886e941b114a9bbf0201fe4d3940f8a23f869

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:05 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef944d883a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
116 B 845ms
844ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=704&campaignid=353&zoneid=10&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=46b4c80b81
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:06 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aef9978213a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 video-m18-new.html Show response
money18.on.cc/ Frame 33EC 6 KB
3 KB 810ms
810ms Document
text/html 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/video-m18-new.html
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4430ba2f4f38d422a5c3f58816459b5c4ff73477d2396e23cc7ae8c3ac91dfe

Request headers

:method: GET
:authority: money18.on.cc
:scheme: https
:path: /video-m18-new.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://money18.on.cc/
accept-encoding: gzip, deflate, br
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-type: text/html
last-modified: Wed, 20 May 2020 08:52:22 GMT
vary: Accept-Encoding
etag: W/"5ec4efc6-19ad"
referrer-policy: no-referrer-when-downgrade
cache-control: public, max-age=5, s-maxage=5
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 697aef9978223a3b-CDG
content-encoding: br

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 2 KB
846 B 819ms
819ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=6
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64545f69993c0898b23d7937c1a58ca81464036746a3f817ae835ce316114dda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef9978233a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 section-icon.sprite.png
money18.on.cc/img/section/ 20 KB
20 KB 24ms
24ms Image
image/png 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/section/section-icon.sprite.png?v=vhRW5nR0oOxeVSZyViCWUeHOpRKv9XEkTJMxO
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfd290d5b14fdfbe291f5632095b56cb5101a66752c22df6c5d50b6077638253

Request headers

:path: /img/section/section-icon.sprite.png?v=vhRW5nR0oOxeVSZyViCWUeHOpRKv9XEkTJMxO
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: money18.on.cc
referer: https://money18.on.cc/css/style.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Sat, 02 Oct 2021 03:45:05 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:25 GMT
server: cloudflare
age: 27772
etag: "5ecbad05-4f6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=900, s-maxage=28800
accept-ranges: bytes
cf-ray: 697aef9978243a3b-CDG
content-length: 20331

GET
H2 200 money18.woff
money18.on.cc/fonts/ 1 KB
1 KB 818ms
818ms Font
application/font-woff 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/fonts/money18.woff
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1755c62c1a21c72efe303a5d2722d3ab68f5e678502da6d38297d98c5f777576

Request headers

sec-fetch-mode: cors
origin: https://money18.on.cc
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301
:path: /fonts/money18.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: money18.on.cc
referer: https://money18.on.cc/css/style.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://money18.on.cc/css/style.min.css
Origin: https://money18.on.cc
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 28 Apr 2020 09:26:23 GMT
server: cloudflare
etag: W/"5ea7f6bf-4cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aef9978253a3b-CDG

GET
H2 200 h5player.css
hk.on.cc/module/player/ Frame 33EC 46 KB
8 KB 26ms
25ms Stylesheet
text/css 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/module/player/h5player.css
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/video-m18-new.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0350eaf35ccdb5e81fd6410f924aa857b491fce3bb1bc48e0935ad2b26a138e9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 04 Aug 2021 07:06:41 GMT
server: cloudflare
age: 5
etag: W/"610a3c81-b706"
x-cacheable: Y09
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-varnish: 64159746 10059779
content-type: text/css
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aef9e9a803a3b-CDG
vary: Accept-Encoding

GET
H2 200 jquery-1.12.1.min.js Show response
code.jquery.com/ Frame 33EC 95 KB
33 KB 57ms
15ms Script
application/javascript 69.16.175.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.12.1.min.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/video-m18-new.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: 2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: gzip
last-modified: Mon, 22 Feb 2016 19:07:54 GMT
server: nginx
etag: W/"56cb5c8a-17c7b"
vary: Accept-Encoding
x-hw: 1633146306.dop146.am5.t,1633146306.cds287.am5.hn,1633146306.cds284.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 33838

GET
H2 200 h5player.js Show response
hk.on.cc/module/player/ Frame 33EC 302 KB
60 KB 239ms
237ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/module/player/h5player.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/video-m18-new.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e354c5c1c485745f5de9cd5c6792c58b914e14d46d373e61a61ebce12900301

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y10
cf-ray: 697aef9eaa813a3b-CDG
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 28 Sep 2021 07:14:20 GMT
server: cloudflare
etag: W/"6152c0cc-4b8a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 72639618 80800085
access-control-allow-origin: *
cache-control: public, max-age=5, s-maxage=5
content-type: application/javascript

GET
H2 200 floatingCloseBtn.png
ad6.on.cc/web/html/ 2 KB
2 KB 42ms
41ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad6.on.cc/web/html/floatingCloseBtn.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be65b1c567e1f7558833b17c954318334b0e687a81cf4b77978460c58d210561

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
cf-cache-status: HIT
x-cacheable: L04
age: 7932
content-length: 1859
x-varnish: 133437608 109698558
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 17 Jul 2014 09:48:29 GMT
server: cloudflare
etag: "743-4fe608afd1540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=21600, s-maxage=21600
accept-ranges: bytes
cf-ray: 697aef9eaa923b4f-CDG

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
195 B 825ms
824ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=705&campaignid=353&zoneid=6&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=1d17faff66
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:07 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aef9eaa833a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 2 KB
845 B 260ms
259ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=8
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 198a1925002608aed108a27e6e98c0a6162961a51d420fd6c41b11ca05e731c7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aef9eaa823a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 top50_2.xml Show response
datafeed.on.cc/ontv/xml/Group/ Frame 33EC 6 KB
3 KB 549ms
283ms XHR
text/xml 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://datafeed.on.cc/ontv/xml/Group/top50_2.xml
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fd394ee21e653ea7f029332faae6040dfb37cf9d74b4b478ab1ac4ac974bd2c

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://money18.on.cc/video-m18-new.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:07 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L04
x-varnish: 274055720
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Oct 2021 02:25:13 GMT
server: cloudflare
etag: W/"187a-5cd5563cdd804"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: text/xml
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30
cf-ray: 697aefa1ee3d048b-CDG
expires: Sat, 02 Oct 2021 03:49:50 GMT

GET
H2 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
115 B 832ms
832ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=706&campaignid=353&zoneid=8&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=48d009bef1
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:07 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aefa04b293a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 279ms
30ms Script
application/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=money18.on.cc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js?31063001

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads
securepubads.g.doubleclick.net/gampad/ 0
31 KB 1092ms
1092ms Other
application/webbundle 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=802330861221651&correlator=4378826902260322&output=wbn&wbsu=28e20453-1873-49ce-a88d-6508e9b65fb2&callback=googletag.wbn1&impl=fifs&eid=31061422%2C31063001%2C21068766%2C31060545%2C31061424%2C31062464%2C31062324&vrg=2021092301&ptt=17&sc=1&sfv=1-0-38&ecs=20211002&iu_parts=21589405%2Cca-pub-1862194061110379-tag%2C1205252462%2C3098574441%2C5062126862%2C6171032222%2Cweb_interstitial&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6&prev_iu_szs=728x90%2C300x250%2C300x250%2C728x90%2C728x90%2C300x250%2C1x1&ists=1&fas=0%2C0%2C0%2C0%2C0%2C0%2C8&cookie_enabled=1&bc=31&abxe=1&lmt=1626250234&dt=1633146306614&dlt=1633146301515&idt=517&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C1000%2C1000%2C553%2C553%2C0%2C-9&adys=244%2C346%2C607%2C1125%2C1225%2C950%2C-9&adks=939323298%2C647227321%2C1587444710%2C2250133080%2C2250133081%2C3952770971%2C2691357424&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmoney18.on.cc%2F&ref=http%3A%2F%2Fmoney18.on.cc%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x100%7C300x252%7C300x252%7C767x90%7C767x90%7C300x-1%7C0x-1&msz=728x-1%7C300x-1%7C300x-1%7C728x-1%7C728x-1%7C300x-1%7C0x-1&ga_vid=16579377.1633146307&ga_sid=1633146307&ga_hid=1024252510&ga_fc=false&fws=4%2C4%2C4%2C4%2C4%2C516%2C2&ohw=1000%2C767%2C767%2C767%2C767%2C767%2C0&btvi=0%7C0%7C0%7C0%7C1%7C0%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js?31063001

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:07 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31610
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2,-2,-2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2,-2,-2,-1
content-type: application/webbundle
access-control-allow-origin: https://money18.on.cc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
URN 200
OK uuid:28e20453-1873-49ce-a88d-6508e9b65fb2 Show response
/ 3 KB
4 KB 1105ms
1105ms Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL

urn:uuid:28e20453-1873-49ce-a88d-6508e9b65fb2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js?31063001

Protocol

URN

Server

-, , ASN (),

Reverse DNS

Software

Resource Hash

e6054a8be6cb61e536789d5bc43906f7345ad6a89cb840830271c2f71f4f91ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Content-Type-Options: nosniff, nosniff
content-type: text/javascript; charset=utf-8

GET
H3 200 pubads_impl_page_level_ads_2021092301.js Show response
securepubads.g.doubleclick.net/gpt/ 36 KB
13 KB 23ms
22ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021092301.js?cb=31063001

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js?31063001

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f10.1e100.net

Software

sffe /

Resource Hash

3d265464ffea3c44cb0dd5d5c38da3019243e847b99c7f5c51aa1a5904f21d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13587
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 08:34:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 02 Oct 2021 03:45:06 GMT

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 52 B
104 B 262ms
262ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=5
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/ad/common/skycraper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbd612056ab2315212afad6814db8d2958c336e77d9ca9f002d0787391fe0855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aefa07b473a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 time_finance.js Show response
realtime-money18-cdn.on.cc/finance/js/ 559 B
419 B 878ms
878ms Script
application/javascript 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/finance/js/time_finance.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9926792f5a94b9e7fba00f5dc1a924d6008f491a8b791e541b7c379d2d905a91

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:07 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Sat, 02 Oct 2021 03:45:02 GMT
server: cloudflare
etag: W/"6157d5be-22f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 697aefa28d403b4f-CDG

GET
H2 200 spcjs.php Show response
ad5.on.cc/money18/www/delivery/ 2 KB
769 B 28ms
27ms Script
application/x-javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/spcjs.php
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3000f88e350ac237077bc5e3a25dfb25debb6ecb8f14c241d9c13d067a0fa50

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:06 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 27771
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-size: 2239
cf-ray: 697aefa28c4a3a3b-CDG
content-type: application/x-javascript
expires: Sat, 02 Oct 2021 10:58:46 GMT

GET
H2 204 rta.js Show response
rtax.criteo.com/delivery/rta/ 0
55 B 209ms
12ms Script
text/plain 178.250.2.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtax.criteo.com/delivery/rta/rta.js?netId=3124&cookieName=crtg_oncchk_rta&rnd=68187186626&varName=crtg_oncchk_content
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:07 GMT
server: nginx/1.20.1

GET
H2 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 52 B
105 B 826ms
826ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=162
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53d1dbaeb0e3dadb19c0c5a4a7070e6ef8f4f19566e616cc78cb6425db01c11f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:07 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aefa28c4b3a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 spc.php Show response
ad5.on.cc/money18/www/delivery/ 31 KB
5 KB 901ms
901ms Script
application/x-javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/spc.php?zones=ad_3%3D3%7Cad_6%3D6%7Cad_7%3D7%7Cad_8%3D8%7Cad_9%3D9%7Cad_10%3D10%7Cad_11%3D11%7Cad_12%3D12%7Cad_13%3D13%7Cad_14%3D14%7Cad_15%3D15%7Cad_16%3D16%7Cad_17%3D17%7Cad_18%3D18%7Cad_5%3D5%7Cad_77%3D77%7Cad_131%3D131%7Cad_132%3D132%7Cad_128%3D128%7Cad_129%3D129%7Cad_194%3D194%7Cad_193%3D193%7Cad_187%3D187%7Cad_81%3D81%7Cad_20%3D20%7C&nz=1&source=over1280&r=25609027&charset=UTF-8&loc=https%3A//money18.on.cc/&referer=http%3A//money18.on.cc/
Requested by: Host: ad5.on.cc
URL: https://ad5.on.cc/money18/www/delivery/spcjs.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bc738beedf565bf1e851da06ba8ceeaec85f2ee2f7ee2846e4dfebf9c1dfbf7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:07 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-size: 31619
cache-control: private, max-age=0, no-cache
cf-ray: 697aefa2bc5f3a3b-CDG
content-type: application/x-javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 fl.js Show response
ad5.on.cc/money18/www/delivery/ 6 KB
2 KB 806ms
806ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/fl.js
Requested by: Host: ad5.on.cc
URL: https://ad5.on.cc/money18/www/delivery/spcjs.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 316fd92de184f954a5c3ee62d7ff4c3cca0789d8f1f40eb719821f3acfd79b64

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 20 Dec 2013 07:57:45 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-host: M1804
cf-ray: 697aefa2bc603a3b-CDG

GET
H2 200 OBZ211002-14198-06-M.xml Show response
tv.on.cc/xml/Metadata/Video/202110/ Frame 33EC 6 KB
3 KB 896ms
887ms XHR
text/xml 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tv.on.cc/xml/Metadata/Video/202110/OBZ211002-14198-06-M.xml
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 317822e702309f5c41698694947808e34d502fb1390b85e2414d00a9a06f78ec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:08 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L04
x-varnish: 271630079
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Oct 2021 02:25:14 GMT
server: cloudflare
etag: W/"1612-5cd5563d021f9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: text/xml
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30
cf-ray: 697aefa3cec9048b-CDG
expires: Sat, 02 Oct 2021 03:50:00 GMT

GET
URN 200
OK uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc Show response
/ Frame 372B 111 KB
112 KB 0ms
0ms Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL

urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092301.js?31063001

Protocol

URN

Server

-, , ASN (),

Reverse DNS

Software

Resource Hash

f1d860583bde8e7097d5087c62dc395f41853937bcb6ebeaf9d0f342da4256df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Content-Type-Options: nosniff
content-type: text/html; charset=utf-8
x-content-type-options: nosniff

GET
H2 200 css2
fonts.googleapis.com/ Frame 372B 4 KB
1 KB 87ms
33ms Stylesheet
text/css 142.250.184.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 02 Oct 2021 03:07:33 GMT
server: ESF
date: Sat, 02 Oct 2021 03:45:07 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 02 Oct 2021 03:45:07 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 372B 205 B
294 B 78ms
24ms Image
image/png 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:07:59 GMT
x-content-type-options: nosniff
age: 2228
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 02 Oct 2022 03:07:59 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 372B 604 B
1 KB 77ms
23ms Image
image/png 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 10:54:11 GMT
x-content-type-options: nosniff
age: 60656
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 01 Oct 2022 10:54:11 GMT

GET
H2 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame 372B 17 KB
8 KB 82ms
26ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f10.1e100.net

Software

cafe /

Resource Hash

f0c966edfc6ce40ca892f7e2bc53a95bd27cb94ac8b6fa61fcb30457ff214600

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 01:32:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7950
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7655
x-xss-protection: 0
server: cafe
etag: 17297134792721902632
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 01:32:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 658C 3 KB
580 B 58ms
30ms Stylesheet
text/css 142.250.184.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 02 Oct 2021 01:54:49 GMT
server: ESF
date: Sat, 02 Oct 2021 03:45:07 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 02 Oct 2021 03:45:07 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 658C 1 KB
879 B 55ms
25ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2911b334d84ae35bdef7cb396241b38425398b6ae5f91f13a72943e805309ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2678
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 852
x-xss-protection: 0
server: cafe
etag: 14170629819630813772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 03:00:29 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 658C 18 KB
7 KB 52ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:06:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2293
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 03:06:54 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 658C 3 KB
1 KB 49ms
21ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:38:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 03:38:28 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 658C 122 KB
38 KB 562ms
507ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 03:45:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 658C 14 KB
6 KB 49ms
21ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 02:59:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2754
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 02:59:13 GMT

GET
H3 200 a05f1579543550f3e279366fb116adbd.js Show response
www.gstatic.com/mysidia/ Frame 658C 27 KB
11 KB 60ms
26ms Script
text/javascript 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a05f1579543550f3e279366fb116adbd.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

6cd4fdef93aef355d2c534bc7de3d08d9723234a1b0cf6161652193f34e4f820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 03:59:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 171914
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11147
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 01:21:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 29 Dec 2021 03:59:53 GMT

GET
H2 200 Article.js Show response
money18.on.cc/modules/Articles/ 24 KB
5 KB 876ms
876ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/Articles/Article.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/modules/Articles/ArticleModule.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99319ae30c1d43e38186b539848752ca1b6995a267d4ba95282c53b544bd8abb

Request headers

:path: /modules/Articles/Article.js
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:08 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 20 Apr 2021 05:24:14 GMT
server: cloudflare
etag: W/"607e657e-5e05"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefa85ec63a3b-CDG

GET
H2 200 Article.css
money18.on.cc/modules/Articles/ 8 KB
2 KB 873ms
873ms Stylesheet
text/css 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/Articles/Article.css
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b79f51f0917d28f0b1b7b9fd455c659496d28e6ddd7c7f21b0ccf64d2006580c

Request headers

:path: /modules/Articles/Article.css
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:08 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 27 May 2020 03:20:39 GMT
server: cloudflare
etag: W/"5ecddc87-2180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefa86ec73a3b-CDG

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D1C6 143 B
447 B 69ms
20ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmvxUkUIbgJQQYt2bWxqnmpgcz4GUxQWMSmGaEPD-tFAlD898UiFkUlaTwmH4o
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 02 Oct 2021 03:34:13 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 654
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6973 1 KB
1 KB 69ms
20ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 01 Oct 2021 08:58:57 GMT
expires: Sat, 02 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 67570
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6973 35 B
463 B 32ms
8ms Image
image/gif 91.228.74.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEiSfyPgIObtfNM-NBrU-1g&google_cver=1&google_push=AYg5qPKLKPZXq-Dv8whq0V6PEku7FSl2s8sUI1V0H6VJDlxJwxDGluqX5H7MrCDTJYsnh8zeLoFjiboN3S_pcEuahFvFJFyLU79Pvw

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 6973
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESENctxeiOjJdU1ZIKMwLYVbE&google_cver=1&google_push=AYg5qPJ6qMWjyhooQvIN7BSGKevH5Dn3SRvUG1eF81kUr8y6PKSuGj2woT-QZbEqim7Sd-eRoJD_yUus8SFCI2LXG0-HIL39wqzwi...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENctxeiOjJdU1ZIKMwLYVbE&google_cver=1&google_push=AYg5qPJ6qMWjyhooQvIN7BSGKevH5Dn3SRvUG1eF81kUr8y6PKSuGj2woT-QZbEqim7Sd-eRoJD_yUus8SFCI2LXG0-HIL39wqz...

43 B
442 B

174ms
174ms

Image
image/gif

104.18.13.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENctxeiOjJdU1ZIKMwLYVbE&google_cver=1&google_push=AYg5qPJ6qMWjyhooQvIN7BSGKevH5Dn3SRvUG1eF81kUr8y6PKSuGj2woT-QZbEqim7Sd-eRoJD_yUus8SFCI2LXG0-HIL39wqzwiQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJ6qMWjyhooQvIN7BSGKevH5Dn3SRvUG1eF81kUr8y6PKSuGj2woT-QZbEqim7Sd-eRoJD_yUus8SFCI2LXG0-HIL39wqzwiQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.13.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:09 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 697aefaebb53089f-CDG
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1420
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 697aefa958ff089f-CDG
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENctxeiOjJdU1ZIKMwLYVbE&google_cver=1&google_push=AYg5qPJ6qMWjyhooQvIN7BSGKevH5Dn3SRvUG1eF81kUr8y6PKSuGj2woT-QZbEqim7Sd-eRoJD_yUus8SFCI2LXG0-HIL39wqzwiQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJ6qMWjyhooQvIN7BSGKevH5Dn3SRvUG1eF81kUr8y6PKSuGj2woT-QZbEqim7Sd-eRoJD_yUus8SFCI2LXG0-HIL39wqzwiQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET gg_pixel
sync.adaptv.advertising.com/ Frame 6973 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6973
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEJecvCs0V63-H-Cw8vZZSRY&google_cver=1&google_push=AYg5qPIbbEzFUJhxTyS3qtNQbiQTa9olZvsS3gjeBMdH477M0bc_SIYEaFsybfcSLBnOFeAZMyvG2vqJs0R6IOqYsyHxlEq...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEJecvCs0V63-H-Cw8vZZSRY&google_cver=1&google_push=AYg5qPIbbEzFUJhxTyS3qtNQbiQTa9olZvsS3gjeBMdH477M0bc_SIYEaFsybfcSLBnOFeAZMyvG2vqJs0R6IOqYsyHxl...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPIbbEzFUJhxTyS3qtNQbiQTa9olZvsS3gjeBMdH477M0bc_SIYEaFsybfcSLBnOFeAZMyvG2vqJs0R6IOqYsyHxlEqocnoQWA

170 B
188 B

48ms
26ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPIbbEzFUJhxTyS3qtNQbiQTa9olZvsS3gjeBMdH477M0bc_SIYEaFsybfcSLBnOFeAZMyvG2vqJs0R6IOqYsyHxlEqocnoQWA

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPIbbEzFUJhxTyS3qtNQbiQTa9olZvsS3gjeBMdH477M0bc_SIYEaFsybfcSLBnOFeAZMyvG2vqJs0R6IOqYsyHxlEqocnoQWA
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6973
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEP5Ccxws_Dg28fpIpvNxwT0&google_cver=1&google_push=AYg5qPKDD7XM4zPzF7fkmWqOPf0Fkgo1Iqlx1yn-rPLzkNf2oxEd0jvkTpi5OXi47bMtSJ5oeRLKo734...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEP5Ccxws_Dg28fpIpvNxwT0&google_cver=1&google_push=AYg5qPKDD7XM4zPzF7fkmWqOPf0Fkgo1Iqlx1yn-rPLzkNf2oxEd0jvkTpi5OXi47bMtSJ5oeRL...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA2NDk4NzcwNTI2Mzk1NDkzNQ&google_push=AYg5qPKDD7XM4zPzF7fkmWqOPf0Fkgo1Iqlx1yn-rPLzkNf2oxEd0jvkTpi5OXi47bMtSJ5oeRLKo7...

170 B
188 B

50ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA2NDk4NzcwNTI2Mzk1NDkzNQ&google_push=AYg5qPKDD7XM4zPzF7fkmWqOPf0Fkgo1Iqlx1yn-rPLzkNf2oxEd0jvkTpi5OXi47bMtSJ5oeRLKo734zzwN-s36I8_jcBWjlqQR5w

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjA2NDk4NzcwNTI2Mzk1NDkzNQ&google_push=AYg5qPKDD7XM4zPzF7fkmWqOPf0Fkgo1Iqlx1yn-rPLzkNf2oxEd0jvkTpi5OXi47bMtSJ5oeRLKo734zzwN-s36I8_jcBWjlqQR5w
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6973
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESENKVk64i8LTcP6HKm4n-I6s&google_cver=1&google_push=AYg5qPJAlZE8bQUs8z55j1NZSXy8ZsDxgz-fPhJYToqCVJ5RXNBMLwrblrGUOjl23nK-EMXZ2Yb0Rbck9rtudII6Y3_XB5HtOGENgw
https://rtb.openx.net/sync/dds?google_gid=CAESENKVk64i8LTcP6HKm4n-I6s&google_cver=1&google_push=AYg5qPJAlZE8bQUs8z55j1NZSXy8ZsDxgz-fPhJYToqCVJ5RXNBMLwrblrGUOjl23nK-EMXZ2Yb0Rbck9rtudII6Y3_XB5HtOGENg...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJAlZE8bQUs8z55j1NZSXy8ZsDxgz-fPhJYToqCVJ5RXNBMLwrblrGUOjl23nK-EMXZ2Yb0Rbck9rtudII6Y3_XB5HtOGENgw&google_hm=bLzPg-scxxcYTc2JFUQczg==

170 B
188 B

50ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJAlZE8bQUs8z55j1NZSXy8ZsDxgz-fPhJYToqCVJ5RXNBMLwrblrGUOjl23nK-EMXZ2Yb0Rbck9rtudII6Y3_XB5HtOGENgw&google_hm=bLzPg-scxxcYTc2JFUQczg==

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJAlZE8bQUs8z55j1NZSXy8ZsDxgz-fPhJYToqCVJ5RXNBMLwrblrGUOjl23nK-EMXZ2Yb0Rbck9rtudII6Y3_XB5HtOGENgw&google_hm=bLzPg-scxxcYTc2JFUQczg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: k90u0ubpokbmm2mkerelvufi7hqibgf3

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 6973
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEEjHODo2VLECweVXUMaoPSQ&google_cver=1&google_push=AYg5qPI1TZBF51hGAdByX8JlhnujqvO4mjBPloZ9mWQYT_VFC5QxTHmaO2egv790Hs-E9H3FU07u9RYRES4ymCZ8...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI1TZBF51hGAdByX8JlhnujqvO4mjBPloZ9mWQYT_VFC5QxTHmaO2egv790Hs-E9H3FU07u9RYRES4ymCZ8Rz-Ym_PrXQi9GA

170 B
329 B

27ms
23ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI1TZBF51hGAdByX8JlhnujqvO4mjBPloZ9mWQYT_VFC5QxTHmaO2egv790Hs-E9H3FU07u9RYRES4ymCZ8Rz-Ym_PrXQi9GA

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 02 Oct 2021 03:45:08 GMT
via: 1.1 34f50889bc574f1edeb41dd758962a5b.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA2-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI1TZBF51hGAdByX8JlhnujqvO4mjBPloZ9mWQYT_VFC5QxTHmaO2egv790Hs-E9H3FU07u9RYRES4ymCZ8Rz-Ym_PrXQi9GA
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: -pRw8gBpZsDgoSmeWXk_4S5neNhsPilevXyF4x44krPv_OHYcFLcUA==

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 6973 0
244 B 58ms
20ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KdcWIm_Fo4C87W1j3_9i6nsazHAneBcpis9woBeq01BM1_8s9MH0lnOMAjE5lf8lX0IP3a

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:08 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D1C6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

59ms
29ms

Document
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: uuid
URL: urn:uuid:07dc9ca5-5e93-62a6-9ccc-62a65e9307dc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmvxUkUIbgJQQYt2bWxqnmpgcz4GUxQWMSmGaEPD-tFAlD898UiFkUlaTwmH4o
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 03:45:08 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 02-Oct-2021 04:45:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 02 Oct 2021 03:45:08 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 03:45:08 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 OBZ211002-14198-06-M_1633140716.js Show response
hk.on.cc/hk/video/segments/ Frame 33EC 23 B
188 B 843ms
842ms XHR
text/html 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/hk/video/segments/OBZ211002-14198-06-M_1633140716.js
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38bef13839fe2969461f7db1b36007b254d12152268dd2fdb302f9b7923148ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:08 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
x-cacheable: Y10
server: cloudflare
etag: "090ab3bf66440972448b96f1c0218afa6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 284816474
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=300
accept-ranges: bytes
cf-ray: 697aefa9588e048b-CDG
content-type: text/html;charset=utf-8
content-length: 23

GET
H2 200 hls.js Show response
hk.on.cc/module/player/ Frame 33EC 235 KB
71 KB 873ms
871ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/module/player/hls.js
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b7a5a4cc369fbf887fc098793578f308d0b3e1f51c6fdb5765e5b433e1dfc89

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y09
cf-ray: 697aefaea9d93a3b-CDG
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Mar 2021 03:57:55 GMT
server: cloudflare
etag: W/"60596743-3ab62"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 754024038 705942700
access-control-allow-origin: *
cache-control: public, max-age=5, s-maxage=5
content-type: application/javascript

GET
H2 200 hitCount.faces
bknwebapp.on.cc/onccMainWebapp/ Frame 33EC 57 B
57 B 900ms
891ms Image
text/html 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bknwebapp.on.cc/onccMainWebapp/hitCount.faces?newsId=OBZ211002-14198-06-M&pubCode=video&psCode=498&mediaType=web&1633146308892
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / JSF/1.2
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
x-powered-by: JSF/1.2
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html;charset=UTF-8
cf-ray: 697aefaeb9de3a3b-CDG

GET
H2 200 OBZ211002-14198-06-M.jpg
tv.on.cc/xml/Thumbnail/202110/bigthumbnail/ Frame 33EC 53 KB
53 KB 1037ms
1037ms Image
image/jpeg 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tv.on.cc/xml/Thumbnail/202110/bigthumbnail/OBZ211002-14198-06-M.jpg?t=1633141461
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9542cc417d66e786379d77ccf8d11169a8e1d7b733c5730f0e03029bea04ce4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
cf-cache-status: HIT
x-cacheable: L04
content-type: image/jpeg
content-length: 53789
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Oct 2021 02:25:13 GMT
server: cloudflare
etag: "d21d-5cd5563ce511d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 271563566
access-control-allow-origin: *
expires: Sat, 02 Oct 2021 03:50:06 GMT
cache-control: public, max-age=5, s-maxage=5, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 697aefaea9da3a3b-CDG
cf-bgj: h2pri

GET
H2 200 front-random-ads.html Show response
money18.on.cc/ad/ Frame 2AEA 2 KB
859 B 244ms
244ms Document
text/html 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/ad/front-random-ads.html
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d462740616344367ae5b3f5aee3ed0ad227d019e894256e989b706ce560232b

Request headers

:method: GET
:authority: money18.on.cc
:scheme: https
:path: /ad/front-random-ads.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://money18.on.cc/
accept-encoding: gzip, deflate, br
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
content-type: text/html
last-modified: Tue, 15 Sep 2020 09:45:56 GMT
vary: Accept-Encoding
etag: W/"5f608d54-7c7"
referrer-policy: no-referrer-when-downgrade
cache-control: public, max-age=5, s-maxage=5
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 697aefaec9e33a3b-CDG
content-encoding: br

GET
H2 200 config.common.js Show response
money18.on.cc/js/ 9 KB
3 KB 813ms
813ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/config.common.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06c1c1f10e818d4ea5a54455797d40f88d58fcedd1d7bee6dcd0dd853d6c4366

Request headers

:path: /js/config.common.js
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 24 Aug 2021 09:16:49 GMT
server: cloudflare
etag: W/"6124b901-220e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefaefa063a3b-CDG

GET
H2 200 jquery-1.12.1.min.js Show response
code.jquery.com/ Frame 2AEA 95 KB
33 KB 17ms
16ms Script
application/javascript 69.16.175.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.12.1.min.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/ad/front-random-ads.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: 2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/ad/front-random-ads.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
content-encoding: gzip
last-modified: Mon, 22 Feb 2016 19:07:54 GMT
server: nginx
etag: W/"56cb5c8a-17c7b"
vary: Accept-Encoding
x-hw: 1633146309.dop146.am5.t,1633146309.cds287.am5.hn,1633146309.cds284.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 33838

GET
H2 200 jquery.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ Frame 2AEA 1 KB
1 KB 59ms
22ms Script
application/javascript 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/ad/front-random-ads.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/ad/front-random-ads.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3828246
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 591
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec1-514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OsIetgl5s5UiDYuLy%2F2oBHjW%2F3eJry7wkP1K3SkFgOjm4w%2Fn0Y833cwJ2omd1GhIn4TgnB2dK%2FiDFkaNIqP5EC1wpMSqQdINhv8PwkMc52WAsURWsa4I0PQP9NLTVCjAAZHwgpMq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 697aefb09e1532b0-CDG
expires: Thu, 22 Sep 2022 03:45:09 GMT

GET
H2 200 web_banner.gif
hk.on.cc/fea/wealth/img/ Frame 2AEA 48 KB
48 KB 229ms
229ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/fea/wealth/img/web_banner.gif
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/ad/front-random-ads.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ed1426ebe71b5d8110d7c7f83a81a858de0598c439a3f669e35ba7bf628e0a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/ad/front-random-ads.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:09 GMT
cf-cache-status: HIT
x-cacheable: Y10
cf-ray: 697aefb0cb273a3b-CDG
content-length: 48728
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 28 Sep 2020 03:35:30 GMT
server: cloudflare
etag: "5f715a02-be58"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 786510392
cache-control: public, max-age=7200, s-maxage=14400
accept-ranges: bytes
content-type: image/gif

GET
H2 200 2020_iframe.html Show response
ad6.on.cc/web/html/oflx/ Frame 1033 123 B
401 B 813ms
812ms Document
text/html 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad6.on.cc/web/html/oflx/2020_iframe.html
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e466083beb8c93d1f030bf219ea3ff5e7931fcc4caf36708c5c69ca5b2de040e

Request headers

:method: GET
:authority: ad6.on.cc
:scheme: https
:path: /web/html/oflx/2020_iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://money18.on.cc/
accept-encoding: gzip, deflate, br
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-type: text/html
last-modified: Mon, 15 Jun 2020 07:57:39 GMT
etag: W/"7b-5a81ac7df9d02"
vary: Accept-Encoding,User-Agent
cache-control: public, max-age=1800, s-maxage=1800
x-cacheable: L03
x-varnish: 641778393
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 697aefb278773b4f-CDG
content-encoding: br

GET
H2 200 toTop.png
money18.on.cc/img/ 1 KB
2 KB 24ms
24ms Image
image/png 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/toTop.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f1cf4fb54da85f6d90d28175e926fd279441e33b404493ef4f29b7eaddb0d5

Request headers

:path: /img/toTop.png
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: money18.on.cc
referer: https://money18.on.cc/css/style.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Sat, 02 Oct 2021 03:45:09 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:10 GMT
server: cloudflare
age: 27772
etag: "5ecbacf6-5bd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=900, s-maxage=28800
accept-ranges: bytes
cf-ray: 697aefb41caa3a3b-CDG
content-length: 1469

GET
H2 200 index.js Show response
money18.on.cc/js/app/ 60 KB
13 KB 888ms
888ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/app/index.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba73cebf3fbd74939f833789a85f9853fea861ed845eca95fb0607460bfd309c

Request headers

:path: /js/app/index.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Tue, 24 Aug 2021 09:15:58 GMT
server: cloudflare
etag: W/"6124b8ce-f1dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb42cac3a3b-CDG

GET
H2 200 templates_helpers.js Show response
money18.on.cc/lib/ 851 B
476 B 809ms
809ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/templates_helpers.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95e34e916c953c9a1ebdd15260d3ae24d37550ea65e8735d40eb973c3c8b80ec

Request headers

:path: /lib/templates_helpers.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Thu, 03 Sep 2020 04:13:13 GMT
server: cloudflare
etag: W/"5f506d59-353"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb42cad3a3b-CDG

GET
H2 200 index.js Show response
money18.on.cc/modules/desktop_compenents/header/ 40 KB
9 KB 871ms
871ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/header/index.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83b7a23f018cfb9a6d838231ce215dface71b1d3c048495167df46263fae2056

Request headers

:path: /modules/desktop_compenents/header/index.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 01 Sep 2021 07:42:15 GMT
server: cloudflare
etag: W/"612f2ed7-9e56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb42cae3a3b-CDG

GET
H2 200 unicorp_v4.js Show response
on.cc/adv/web/corp/source/ 61 KB
14 KB 245ms
245ms Script
application/javascript 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d26ea3057811c2841a29c3c3f6889a00a7a157e603f4555c62c07ad8a5c4caad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L06
cf-ray: 697aefb429c63b4f-CDG
x-host: WL25
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 01 Sep 2021 00:11:14 GMT
server: cloudflare
etag: W/"612ec522-f33d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 315950865 315756670
cache-control: max-age=5, s-maxage=5
content-type: application/javascript

GET
H2 200 urchin.js Show response
money18.on.cc/lib/ 18 KB
6 KB 880ms
879ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/urchin.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab229322552892c8734d333a6b52b479f3d9cf7c8a1fc9cf2d8bd6ba3420284b

Request headers

:path: /lib/urchin.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
etag: W/"5ec4efb0-4661"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=60
cf-ray: 697aefb42cb03a3b-CDG

GET
H2 200 urchin-lib.js Show response
money18.on.cc/lib/ 9 KB
3 KB 814ms
814ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/urchin-lib.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76a1ffaa9a177acc8e6ad0fe8f7e89a76f765e0c5f88ff2438248d983b9201d8

Request headers

:path: /lib/urchin-lib.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 03:50:17 GMT
server: cloudflare
etag: W/"5e86b279-25d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=60
cf-ray: 697aefb42cb23a3b-CDG

GET
H2 200 function.js Show response
money18.on.cc/js/ 39 KB
11 KB 808ms
808ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/function.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdc7df4064ff4e70ba6b50694cf3674afd2fca208d3d78aeefd4742b640387c1

Request headers

:path: /js/function.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Thu, 10 Dec 2020 04:23:50 GMT
server: cloudflare
etag: W/"5fd1a2d6-9c4b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb44cbf3a3b-CDG

GET
H2 200 OBZ211002-14198-06-M.m3u8 Show response
video-cdn.on.cc/Video/202110/ Frame 33EC 226 B
408 B 847ms
834ms XHR
application/vnd.apple.mpegurl 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202110/OBZ211002-14198-06-M.m3u8?t=1633141461
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c85a5f7d595f64e08b4b4f231ca9538ea2a5f89e7abf8548a4e9a388da62e23

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 02 Oct 2021 02:12:16 GMT
server: cloudflare
etag: W/"6157c000-e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=2592000
cf-ray: 697aefb45bc8048b-CDG

GET
H2 200 yahoo_keywords.js Show response
on.cc/adv/web/corp/js/ 4 KB
743 B 816ms
816ms Script
application/javascript 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/js/yahoo_keywords.js
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79c369802018b75882ec40d4896c33c99ff78227d8ccce93357fc8167b32d386

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L06
cf-ray: 697aefb5bac53b4f-CDG
x-host: WL25
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 09 Mar 2011 04:11:26 GMT
server: cloudflare
etag: W/"4d76fdee-1198"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 296993856 297307541
cache-control: max-age=5, s-maxage=5
content-type: application/javascript

GET
H2 200 unicorp_disclaimer.js Show response
on.cc/adv/web/corp/source/ 4 KB
1 KB 252ms
251ms Script
application/javascript 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_disclaimer.js
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 112aba6073ee49f1843f50fb5239e2d7c8a004325b50bd7f93ab093cb6b72e4b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L06
cf-ray: 697aefb5bad03b4f-CDG
x-host: WL25
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 31 Aug 2021 06:55:25 GMT
server: cloudflare
etag: W/"612dd25d-f2a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 296344695
cache-control: max-age=5, s-maxage=5
content-type: application/javascript

GET
H2 200 unicorp_v4.css
on.cc/adv/web/corp/source/ 7 KB
2 KB 1554ms
1553ms Stylesheet
text/css 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_v4.css?v=31
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cdfc421265602e0a9c952b7c9e7ee8f58cfbdfb27b0d3649b818ecbb24f8908

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L05
cf-ray: 697aefb5bad23b4f-CDG
x-host: WL24
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 27 May 2020 01:59:01 GMT
server: cloudflare
etag: W/"5ecdc965-1de5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 643184386 632576175
cache-control: public, max-age=30, s-maxage=300
content-type: text/css

GET
H2 200 unicorp_v4_hk.css
on.cc/adv/web/corp/source/ 12 KB
2 KB 811ms
811ms Stylesheet
text/css 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70e1de1632d61c9c74213d099c9561877f0591d4861a5c3e82e766b53d4d666a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L06
cf-ray: 697aefb5bad33b4f-CDG
x-host: WL25
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 05:18:24 GMT
server: cloudflare
etag: W/"6018e0a0-3093"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 370939479 370676913
cache-control: public, max-age=30, s-maxage=300
content-type: text/css

GET
H2 200 checkrev.gif
home.on.cc/adv/web/corp/img/ 43 B
182 B 34ms
26ms Image
image/gif 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://home.on.cc/adv/web/corp/img/checkrev.gif
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L08
age: 6150
cf-ray: 697aefb5caef3b4f-CDG
x-host: WL25
content-length: 43
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 20 Oct 2008 03:57:30 GMT
server: cloudflare
etag: "48fc01aa-2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 917526 327686
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/gif

GET
H2 200 unicorp_disclaimer.css
hk.on.cc/adv/web/corp/source/ 1 KB
662 B 26ms
26ms Stylesheet
text/css 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/adv/web/corp/source/unicorp_disclaimer.css
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_disclaimer.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a89c5d02602316b77d7d50cb7b8a168c10d707994d6f2aba75788365896bf5ed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y10
age: 2535
cf-ray: 697aefb74e113a3b-CDG
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 06 Aug 2018 06:48:01 GMT
server: cloudflare
etag: W/"5b67ef21-5ab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 225622423 233239704
cache-control: public, max-age=1800, s-maxage=14400
content-type: text/css

GET
H2 200 ajs.php Show response
ad4.on.cc/web/www/delivery/ Frame 1033 1 KB
935 B 241ms
232ms Script
text/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4.on.cc/web/www/delivery/ajs.php?zoneid=415
Requested by: Host: ad6.on.cc
URL: https://ad6.on.cc/web/html/oflx/2020_iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a375829e3efded6c7f46c939ad894f1ae2757954d58234f2b9aa7a57fd87104d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
cf-ray: 697aefb7ae2c3a3b-CDG
content-type: text/javascript; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1033 143 KB
50 KB 87ms
57ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: ad4.on.cc
URL: https://ad4.on.cc/web/www/delivery/ajs.php?zoneid=415

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2b4b3cb80dc56aed843ed8b05863d2d96124fc0483ea0838c182ae8722b2310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50835
x-xss-protection: 0
server: cafe
etag: 4808167002673896053
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 02 Oct 2021 03:45:10 GMT

GET
H2 200 lg.php
ad4.on.cc/web/www/delivery/ Frame 1033 43 B
185 B 841ms
841ms Image
image/gif 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad4.on.cc/web/www/delivery/lg.php?bannerid=6314&campaignid=3387&zoneid=415&loc=1&referer=https%3A%2F%2Fad6.on.cc%2Fweb%2Fhtml%2Foflx%2F2020_iframe.html&cb=8024e19d49
Requested by: Host: ad6.on.cc
URL: https://ad6.on.cc/web/html/oflx/2020_iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 697aefb92eff3a3b-CDG
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 text.js Show response
money18.on.cc/lib/es5/ 16 KB
5 KB 818ms
818ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/es5/text.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c31bc55a5c70471e6307c73fcf5f764764eaf79778511ced360b5db2617ed4f

Request headers

:path: /lib/es5/text.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
etag: W/"5ec4efb0-3f83"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb93f093a3b-CDG

GET
H2 200 es5-sham.min.js Show response
money18.on.cc/lib/es5/ 6 KB
2 KB 812ms
811ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/es5/es5-sham.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0524344056b41aeb573d5d500659ba65af1bf8aadb6c1b7dbb5e5c151b72f14

Request headers

:path: /lib/es5/es5-sham.min.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
etag: W/"5ec4efb0-1610"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb93f0a3a3b-CDG

GET
H2 200 es5-shim.min.js Show response
money18.on.cc/lib/es5/ 25 KB
8 KB 865ms
864ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/es5/es5-shim.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f733dab20a413c25abbc4c1daad7b4abcf3249e108e26e2e079c8d8099b80d3a

Request headers

:path: /lib/es5/es5-shim.min.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
etag: W/"5ec4efb0-6340"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb95f143a3b-CDG

GET
H2 200 json3.min.js Show response
money18.on.cc/lib/json3/ 8 KB
4 KB 833ms
832ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/json3/json3.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c3e64ef84e5290feef3e6e6943c4618cd3b609995b6d7bde6e898b06bbf5d5a

Request headers

:path: /lib/json3/json3.min.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 20 May 2020 08:52:01 GMT
server: cloudflare
etag: W/"5ec4efb1-1fd1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb99f3c3a3b-CDG

GET
H2 200 OBZ211002-14198-06-M_ipad.m3u8 Show response
video-cdn.on.cc/Video/202110/ Frame 33EC 1 KB
416 B 831ms
831ms XHR
application/vnd.apple.mpegurl 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202110/OBZ211002-14198-06-M_ipad.m3u8?20211002101216
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 520e94ae9297dfa6ee8b7dd4029110ef8939540480f7b9175bde4c08e32f9635

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 02 Oct 2021 02:12:16 GMT
server: cloudflare
etag: W/"6157c000-4ca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=2592000
cf-ray: 697aefb99d51048b-CDG

GET
H2 200 m18_playicon.png
hk.on.cc/img/v2/ Frame 33EC 2 KB
2 KB 873ms
873ms Image
image/png 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/img/v2/m18_playicon.png
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7cf6749a7db1997d259a6f1921dc8cec500780a7584f1e47d3cb165aecd3d102

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hk.on.cc/module/player/h5player.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
cf-cache-status: HIT
x-cacheable: Y10
cf-ray: 697aefb99f403a3b-CDG
content-length: 2176
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Jul 2019 06:35:19 GMT
server: cloudflare
etag: "5d37fc27-880"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 653668305 829351347
cache-control: public, max-age=7200, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET OBZ211002-14198-06-M.js
hk.on.cc/hk/videoAdv/ Frame 33EC 0
0

GET
H2 200 dqb.js Show response
money18.on.cc/modules/connect/ 6 KB
1 KB 818ms
818ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/connect/dqb.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dd681f4cb067eec59f597d12fa993ab74b156bbb8ccfa3d39e2e177cd4d77cb

Request headers

:path: /modules/connect/dqb.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw; h5Volume=1; h5mute=true
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Thu, 11 Jun 2020 03:28:53 GMT
server: cloudflare
etag: W/"5ee1a4f5-1877"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb9af473a3b-CDG

GET
H2 200 sitemap.js Show response
money18.on.cc/modules/sitemap/ 19 KB
5 KB 816ms
816ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/sitemap/sitemap.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c1bdd1ac044c0be4632d56ec29c151efb679f5e1b0350a63259936f746f8cda

Request headers

:path: /modules/sitemap/sitemap.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; __gads=ID=df321a82f158e3df:T=1633146306:S=ALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw; h5Volume=1; h5mute=true
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Fri, 24 Sep 2021 09:34:14 GMT
server: cloudflare
etag: W/"614d9b96-4c46"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefb9bf4b3a3b-CDG

GET
H2 200 portfolio.js Show response
money18.on.cc/modules/portfolio/ 17 KB
5 KB 240ms
240ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/portfolio/portfolio.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a171dd65cd51ff08b70c8fba6d45c8e953341912ef29db8e5cc3a500d9db328

Request headers

:path: /modules/portfolio/portfolio.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 22 Sep 2020 08:44:14 GMT
server: cloudflare
etag: W/"5f69b95e-4501"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbe598e3a3b-CDG

GET
H2 200 stock.js Show response
money18.on.cc/modules/stock/ 26 KB
6 KB 818ms
818ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/stock/stock.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33d14e4313ca1450f896ae0ce28587c553b632ec2497ae69909cd251474d437d

Request headers

:path: /modules/stock/stock.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 28 Jul 2020 07:08:11 GMT
server: cloudflare
etag: W/"5f1fcedb-687d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbe59903a3b-CDG

GET
H2 200 index.js Show response
money18.on.cc/modules/AdvBox/ 14 KB
3 KB 816ms
815ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/AdvBox/index.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0dfcf7df9dcd3719322e4930b34600054f504fc6100bee667f1967d514d1a2c

Request headers

:path: /modules/AdvBox/index.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Tue, 13 Apr 2021 09:11:29 GMT
server: cloudflare
etag: W/"60756041-3823"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbeb9d03a3b-CDG

GET
H2 200 section.js Show response
money18.on.cc/modules/desktop_compenents/ 8 KB
2 KB 235ms
234ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/section.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 050e08e56b6538663051acd5630c68b38cfd57ffb2266bd9658c887c4e897484

Request headers

:path: /modules/desktop_compenents/section.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 27 May 2020 10:16:54 GMT
server: cloudflare
etag: W/"5ece3e16-203b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbec9d63a3b-CDG

GET
H2 200 news-entries.js Show response
money18.on.cc/modules/desktop_compenents/ 4 KB
2 KB 876ms
875ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/news-entries.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59dc1db7c86f610a3bcb9a5fdbd869c18456673d70f59ff9ac23971eaaa2d104

Request headers

:path: /modules/desktop_compenents/news-entries.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: EXPIRED
last-modified: Fri, 05 Jun 2020 08:36:58 GMT
server: cloudflare
etag: W/"5eda042a-1172"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbec9d73a3b-CDG

GET
H2 200 technical_status.js Show response
money18.on.cc/modules/technical_status/ 8 KB
2 KB 832ms
831ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/technical_status/technical_status.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d24c071024e74a458c209bfd4e85f699582769c0f011bc41d4e3d791a348bae7

Request headers

:path: /modules/technical_status/technical_status.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 09 Nov 2020 08:24:49 GMT
server: cloudflare
etag: W/"5fa8fcd1-2037"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbec9d83a3b-CDG

GET
H2 200 transaction.js Show response
money18.on.cc/modules/desktop_compenents/ 28 KB
7 KB 813ms
813ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/transaction.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fcf7f0ee5261613e1a15cd4516a57ebfc3c939669c90b38f167bd6de33676b54

Request headers

:path: /modules/desktop_compenents/transaction.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 24 Aug 2021 09:16:26 GMT
server: cloudflare
etag: W/"6124b8ea-6fa8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefbfda563a3b-CDG

GET
H2 200 slider.swiper.min.js Show response
hk.on.cc/js/v4/ 71 KB
19 KB 879ms
878ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/js/v4/slider.swiper.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e9f51bb07dbcb82846933a187635db37b42c271c5902b05c14a31be3b7622d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-cacheable: Y09
cf-ray: 697aefb9bf503a3b-CDG
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 26 Aug 2019 02:51:26 GMT
server: cloudflare
etag: W/"5d63492e-11a68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 683121404 682666942
access-control-allow-origin: *
cache-control: public, max-age=5, s-maxage=5
content-type: application/javascript

GET
H2 200 chart.js Show response
money18.on.cc/modules/chart/ 136 KB
29 KB 875ms
874ms Script
application/javascript 104.16.136.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/chart/chart.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.136.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d171e22135715cc6bf98592d3c5d45e569db43994999f5a8e77495109fcef7c3

Request headers

:path: /modules/chart/chart.js?
pragma: no-cache
cookie: __cfruid=3c4b901eeb8c98f25c7d72878d9488cdc4223a4b-1633146301; h5Volume=1; h5mute=true; __gads=ID=df321a82f158e3df-2236bfaa83c9007a:T=1633146306:RT=1633146310:S=ALNI_MZCVcu5ltv9kocmNPfM1BVy29DCVw
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: money18.on.cc
referer: https://money18.on.cc/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 04 Jan 2021 10:04:29 GMT
server: cloudflare
etag: W/"5ff2e82d-220f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 697aefc04a7f3a3b-CDG

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109280101/ Frame 1033 257 KB
95 KB 48ms
48ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109280101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3571272074788370&plah=ad6.on.cc&bust=31062978

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de03457f4fa968583481a57543fc09952ab5f1e3b78d48b316bd0690681dd1bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97125
x-xss-protection: 0
server: cafe
etag: 5949149064860273808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 02 Oct 2021 03:45:10 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210927/r20190131/ Frame D0E8 10 KB
5 KB 21ms
21ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210927/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210927/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmvxUkUIbgJQQYt2bWxqnmpgcz4GUxQWMSmGaEPD-tFAlD898UiFkUlaTwmH4o; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 01 Oct 2021 23:50:07 GMT
expires: Fri, 15 Oct 2021 23:50:07 GMT
content-type: text/html; charset=UTF-8
etag: 297313706323796346
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4617
x-xss-protection: 0
age: 14103
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 1033 195 B
405 B 38ms
23ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=ad6.on.cc&callback=_gfp_s_&client=ca-pub-3571272074788370&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109280101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3571272074788370&plah=ad6.on.cc&bust=31062978

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0bd6c1c38b27811e138d719339d2304f3cb04ac4739dd4973213fe6400d515

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 189
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 1033 107 B
853 B 80ms
32ms Script
application/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ad6.on.cc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 1033 107 B
122 B 72ms
30ms Script
application/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ad6.on.cc

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 03:45:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BA0C 16 KB
9 KB 458ms
457ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdb673336569f33ad562d175b381aef473b3c87823e11b82b132dceeb2933c13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmvxUkUIbgJQQYt2bWxqnmpgcz4GUxQWMSmGaEPD-tFAlD898UiFkUlaTwmH4o; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 03:45:11 GMT
server: cafe
content-length: 9338
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ic_arrow_hkhk_off.gif
on.cc/img/v2/ 1 KB
1 KB 38ms
36ms Image
image/gif 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/img/v2/ic_arrow_hkhk_off.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b4a8698e5c880ff6090a1c0cd2558e42b26c5a1bdf6cb08b9d8f2d78077fdd8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3468
cf-ray: 697aefbadf0b3b4f-CDG
x-host: WL25
content-length: 1172
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Nov 2013 03:59:55 GMT
server: cloudflare
etag: "5275ca3b-494"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629729181
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/gif

GET
H2 200 web_menu_m18.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 35ms
33ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_menu_m18.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10a1c3546508a4f60041203cd2de027ba35189ccac7bcc4701c98ac6595bc434

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3463
cf-ray: 697aefbadf0d3b4f-CDG
x-host: WL25
content-length: 2799
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-aef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 627306499 629823305
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_menu_m18_over.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 34ms
31ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_menu_m18_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b75455f6bc681b8ccf92a51442f1ac2c91fbfe1c813837a9650e975b3456913

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3463
cf-ray: 697aefbadf103b4f-CDG
x-host: WL24
content-length: 2832
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-b10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 908750684 916136484
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_ball_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 37ms
32ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2139db140b042be2a5bafd65fa757f0eb3cf3e0f97c6a8eec957052530b03d77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3462
cf-ray: 697aefbadf113b4f-CDG
x-host: WL24
content-length: 2168
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-878"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 917118140 916473950
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_ball_over.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 44ms
39ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eef61507e5ba153c053a683aefc1e14a84044b401e846c5736572094dd2fe5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3461
cf-ray: 697aefbadf133b4f-CDG
x-host: WL24
content-length: 2175
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-87f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 915878803 916302158
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_ball_off_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 33ms
28ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_off_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5587ca41f509ea115a518336f6ac6e376379a25fda215b58c4921f84040f0f39

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3461
cf-ray: 697aefbadf143b4f-CDG
x-host: WL25
content-length: 2124
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-84c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630298740
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_ball_over_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 45ms
39ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_over_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9de0c8978e69302a3aa776ff407769b18f57ffa7d8122c2da9ef747f93cd43cc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3460
cf-ray: 697aefbadf153b4f-CDG
x-host: WL25
content-length: 2138
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-85a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 627306501
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_horse_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 64ms
58ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: deebccefdbb9e3846fb52bdeb875696fa33b4fcafb00d83ac8f89631084df26b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3460
cf-ray: 697aefbadf173b4f-CDG
x-host: WL25
content-length: 1953
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-7a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629729194
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_horse_over.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 41ms
36ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e26801b344d9fb191aa53ea743d2d8b5f4888cebac66ce1128f63078aa53f750

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3460
cf-ray: 697aefbadf183b4f-CDG
x-host: WL25
content-length: 1952
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-7a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630075430
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_horse_off_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 43ms
38ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_off_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9c56677f5e4bf4db2d10b3e4251337f9c954733c8b35b24f6861cf634ae42a9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3459
cf-ray: 697aefbadf1a3b4f-CDG
x-host: WL25
content-length: 1856
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-740"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630424433 629595283
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_horse_over_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 46ms
41ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_over_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9613f7645c91aacd5d5027d72140f3ffcb148eb265aeee3b529303e28f8bd03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3454
cf-ray: 697aefbaef273b4f-CDG
x-host: WL25
content-length: 1861
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-745"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629037904
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_net_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 46ms
42ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_net_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce61748ce893b3ec7b81cd022f4a9ed673ab4c118f5cff9a4c72a2160d04b496

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3454
cf-ray: 697aefbaef293b4f-CDG
x-host: WL24
content-length: 2343
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-927"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 916900625 917243902
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 web_net_over.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 39ms
34ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_net_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 176b6e30b48ace76fce19e261ac688bde72e2defab631d9c2fafea242c559714

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3453
cf-ray: 697aefbaef2a3b4f-CDG
x-host: WL25
content-length: 2352
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-930"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629037907
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 logo_TC_on.gif
on.cc/adv/web/corp/img/ 12 KB
12 KB 55ms
51ms Image
image/gif 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_TC_on.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5124d27328c2f5c4b2a560fe2ad40a2ece04ed9f465f354fa35b741c124fd466

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3454
cf-ray: 697aefbaef2b3b4f-CDG
x-host: WL24
content-length: 11875
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:52:01 GMT
server: cloudflare
etag: "5fa8caf1-2e63"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 916900623 916900488
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/gif

GET
H2 200 logo_SC_on.gif
on.cc/adv/web/corp/img/ 12 KB
12 KB 52ms
48ms Image
image/gif 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_SC_on.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a12c17ab23790461e677329f9dac5efb0ce19a38fcece15f785ff7f42423cc26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3453
cf-ray: 697aefbaef2c3b4f-CDG
x-host: WL24
content-length: 11974
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:52:00 GMT
server: cloudflare
etag: "5fa8caf0-2ec6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 916669175 917117985
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/gif

GET
H2 200 logo_TC_off.png
on.cc/adv/web/corp/img/ 28 KB
28 KB 60ms
56ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_TC_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2ba400a3542c7f986dd240f2def70cc8d021912a6376e6da574c28630a67b3b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3453
cf-ray: 697aefbaef2e3b4f-CDG
x-host: WL25
content-length: 28481
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:51:59 GMT
server: cloudflare
etag: "5fa8caef-6f41"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629788797
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 logo_SC_off.png
on.cc/adv/web/corp/img/ 27 KB
27 KB 65ms
62ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_SC_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1de66009eea3c9f435d5bea771a3717b0c9dc7abc9418e9357442c1afec63117

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3453
cf-ray: 697aefbaef2f3b4f-CDG
x-host: WL25
content-length: 27615
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:52:05 GMT
server: cloudflare
etag: "5fa8caf5-6bdf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630391484
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 logo_net_off.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 56ms
52ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_net_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ab6ed9795e2f7e4f657148a92d36798a27dd29ab2d4e992fbce352de9a2e42b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3454
cf-ray: 697aefbaef303b4f-CDG
x-host: WL25
content-length: 3057
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-bf1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630298743
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 logo_net_on.png
on.cc/adv/web/corp/img/ 4 KB
4 KB 55ms
51ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_net_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2120ebbbe270d6417b8d272c6450d10ef0d94235287b3eb2e2c8a52de73cb17e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3453
cf-ray: 697aefbaef313b4f-CDG
x-host: WL25
content-length: 4259
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-10a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630233681
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 net_icon_off.png
on.cc/adv/web/corp/img/ 4 KB
4 KB 38ms
35ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/net_icon_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e91e1f5f9ab1b71b71686baf06d7a1661f89786df2019f315b2d3b8d1186f61

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3453
cf-ray: 697aefbaef323b4f-CDG
x-host: WL25
content-length: 3802
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jun 2020 06:39:24 GMT
server: cloudflare
etag: "5ed9e89c-eda"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629729191
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 net_icon_on.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 46ms
43ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/net_icon_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2c044e8e8af87330e2c1c28479713e3107e8b9fe79b3a881bcb247902531db1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3453
cf-ray: 697aefbaef333b4f-CDG
x-host: WL24
content-length: 3377
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jun 2020 06:39:24 GMT
server: cloudflare
etag: "5ed9e89c-d31"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 914270980 914765889
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 test_off.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 37ms
34ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/test_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af2d583999658b96ba5bc7d5cf834ca654a8930d5937c8f4830ee9c7e6fac5ed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3453
cf-ray: 697aefbaef343b4f-CDG
x-host: WL25
content-length: 1421
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-58d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630075433
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 test_on.png
on.cc/adv/web/corp/img/ 1 KB
1 KB 44ms
42ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/test_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc5e0245a9f89d144afabfb55c88f190a4153ad8c3baa67e340a2a7715a64940

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3452
cf-ray: 697aefbaef353b4f-CDG
x-host: WL25
content-length: 1370
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-55a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630424444 629729107
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 dot_off.png
on.cc/adv/web/corp/img/ 1 KB
1 KB 48ms
46ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/dot_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c660dec6cd5e8f9e0b3c518da51439c7a47a1b28da85193926a06b005f0905b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L05
age: 3452
cf-ray: 697aefbaef373b4f-CDG
x-host: WL24
content-length: 1029
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-405"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 917050527 916987179
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 dot_on.png
on.cc/adv/web/corp/img/ 1 KB
1 KB 46ms
44ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/dot_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45f029b0dec12e864c693266265b33e968158edb8ae5761c09013c8069544c2d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3452
cf-ray: 697aefbaef383b4f-CDG
x-host: WL25
content-length: 1025
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-401"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630298746
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 health_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 51ms
49ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/health_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b5514e397dfa4b681f07408e843b186c8e40f0c429e6b956154ac2c385aac34

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3452
cf-ray: 697aefbaef393b4f-CDG
x-host: WL25
content-length: 1546
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:35 GMT
server: cloudflare
etag: "5e6ae727-60a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630391490
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 health_on.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 51ms
50ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/health_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e32b017a5bc36cfd7104924ee59da3e015206b7be6132b36f5951b0e7775c4c6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3452
cf-ray: 697aefbaef3b3b4f-CDG
x-host: WL25
content-length: 1455
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:35 GMT
server: cloudflare
etag: "5e6ae727-5af"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630075436 630360407
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 sport_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 59ms
58ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/sport_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48deef5a4537b8c2d3bbc1c4cf8b5133ec55fade9fb3ab81bbe36bb4f7cc3f73

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3452
cf-ray: 697aefbaef3c3b4f-CDG
x-host: WL25
content-length: 1608
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:36 GMT
server: cloudflare
etag: "5e6ae728-648"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 630360451 629788795
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H2 200 sport_on.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 44ms
43ms Image
image/png 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/sport_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f6a761102c6ab539f8c8886b76f6c4f92a49955a4bc5fec019a0e741638cac3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:10 GMT
cf-cache-status: HIT
x-cacheable: L06
age: 3451
cf-ray: 697aefbaef3d3b4f-CDG
x-host: WL25
content-length: 1497
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:36 GMT
server: cloudflare
etag: "5e6ae728-5d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 629788800
cache-control: max-age=300, s-maxage=14400
accept-ranges: bytes
content-type: image/png

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BA0C 42 B
63 B 35ms
35ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ARa7QB6MjOYBYoaNU4Mdmjm7jnFrNODZVdfaDpHe3M-OJEJXvEJ5tjexB2uYeO3vK9EitKGdRnmGXifMLujmK0q6zhVBcisOMCu7vyp1YzLrDFOY4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame BA0C 3 KB
1 KB 20ms
20ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:38:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 403
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 03:38:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BA0C 122 KB
37 KB 74ms
38ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 03:45:11 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame BA0C 14 KB
6 KB 21ms
20ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 02:59:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 02:59:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame BA0C 0
0 83ms
31ms Image
text/html 142.250.185.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRBfax9I3YTH3q1Xv7Z2_M1rU0djIJcparckhiTgVMlGx6xdEE00tiV4MlNhDNdW78azvgbra7EDg-pxtEYMKRHwoabgQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9050 624 B
297 B 34ms
33ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNXQc4HYB8ZPoElID3eZyP1EsqqlKJEDIjtlYjKlIarQ26mOk_ID_v0E6VwDnB-lHig7lQLVCYZpxZ2o0dNV1fsuOXNtgzaJ7i4btYlAd1vCXZ7UKY0EgEZcfLY0J2bi7XUBUAwWu1gfQRX4iExkD6ozkrr153sxwybuSLbpcO4kOIVbVYI

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNXQc4HYB8ZPoElID3eZyP1EsqqlKJEDIjtlYjKlIarQ26mOk_ID_v0E6VwDnB-lHig7lQLVCYZpxZ2o0dNV1fsuOXNtgzaJ7i4btYlAd1vCXZ7UKY0EgEZcfLY0J2bi7XUBUAwWu1gfQRX4iExkD6ozkrr153sxwybuSLbpcO4kOIVbVYI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmvxUkUIbgJQQYt2bWxqnmpgcz4GUxQWMSmGaEPD-tFAlD898UiFkUlaTwmH4o; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 02 Oct 2021 03:45:11 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BA0C 70 KB
28 KB 54ms
54ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CZ7OEPWWmhirNEx926fDo5IxLoAnBl1T1EZ43L6kK3tMEmGhWzHxUyejl-Md_rqadNsWMHWM28cFSKbDFoKQfZSgS9Mic5sjzDzP6huHbv8uznNAppt1KU3mbI6jD74zUZAZVMbwPuJtkBC80wsXHawJBvQw&dbm_d=AKAmf-C0YdT5KyT0NWoUN-vJoKpdv1yk5d1dnUUee2FN2sZH8MHhJwh5q6eJKBJiRhW1QOmGnK4eRo5_BHXCoF19KgXZlW6L0tQMxeTQiSZgZMMolcMXN5nNJuvBV99MXYf7rcD2tqIW-D8Tn80u4H8Gj4Yh7B0LuXq2lE59szUP0qtcGLtV7kmQv_sVw7Nbjfq-79rmr9e3wDfHDW9vkJBLJCbloUImp4oNXpo1-SRpNYryK9O5YBQbAhtyzbiFT0a9Dy3ANySwElEvnXrD2ar1s4MDN-MC2Ix-vPbvJ2Ca_t34aTIdWiD4BGxtMyb8mabVVIYXAeQ4u5jptA6ogdn4illnmZ5T76J42H3T5CiY7e1GaD4eNXLlGNRSssLbnwySllG2S2OQusbQue5BwyyPe3TMf7me7omVr5qTB4nGRw7Nh1BcO7k9cPtx3JOC-11lOCUzhLEhUNpnWpoh9gY0yxJdtn6elNfozpiQEY9PJTlKw9rQ-_XOWAnC2owL_YY8F093F2r9RjdNOTKndThAolRBnaw2AF_iHiAptS-iaC9lepBOLcl-beONLMySBKicE92uiyRCGYjAXz1E4435gy-T7SOBniiYLJj4AvgkFEOQ7cdY3qByqiStAjKtnrG7KPfKxzE886tHs5UZQJjdK27ah1R_XN2H7XUqHdHDB1gnbR-eOTeJOSxyLHypDxLV0r67RBR8E2F3kSl710fX_R9A5611E54YTIozOsSRZMGN2knUbLiOiIwo_3msAUDnc8_LOUw2B0Gd9WL7L9AIABSzou-H0rulB2p4_8oOFD5xhoTUxi_IGxIdIMd73XJQtWxu5zucJ5g5Gdw70S9uRMdepFn3meOja6fguEakBpVjK_0zc5UO4CJZbJn3Y1YAxcaB-PPE76MfM19CHeXYUGozmCK2bXpvnvqpt0Ub_a2FYnx4fYuYN2nqIpvFXMD1NH2UVTrRK2tNYA9u0iwn1gLkiEVUsOhDCB4Ppv9hF_OcTvgg_RE4DK0TtObRixbffWe6ZFFSP14f1d1W3r14k7xAnaXEslDYEFHVq6lOWchOD6YOmqCvKzsT3mM-tBDaG8hkWFZHQwOIFKIkNXOI2cV5S0RcKWGrITR2QW0IBGZIkBfvT4sX2fSpPbLiO6SHwplN7KdzGXBwLHiBpLvJdVb6fpBvQoSq3HmZ0a_lEBKMTATxntA5dPIjJlfy6dd_fGAmMsi1et1nKsEn59AF-c9g068YBiPpWmqdDIDUqqEIxsiGGWFYh4w8qFxdYg1OXvyUt0zHTAm265mtHFqh33UsHgYZ8ZIyx7uLdAB7r9U4JW7DcgNQlF-e33ByswmIZWxvkHHsL36eMqBVI7PFeZEBGkhfId2Kftaq3fCTS9XDuUCJwKX8wzcqzYEskHDF9bNESWH_aNrZzxKDiozAygWnhAwmGqTYEPC0ImUomq75VLpsTuq6bO_WdTlA15mV4krXEFMyFIOT8GFClVqEep72hJKtxnh54dX-eWyd3LHwbZpj1Wsp0fpDIRHBbJ6zRfrJ7FEwpPLlw3jBw2hDiRmiF8R9-pPbaQMXqXK8LP6sDPsubsZy1hbYKzk7PMlpq4M_zQzg7XwJR8boG4B0WbM1IzP1GXwW5Ng846nzePiU03OK7LZTwcTvM69wvXyFV7EJ2qgUyG3CSo9ZsTH7-MXTY4UAPEXzLNlv_GR7Xze5ZZ_FZhMGWoNbOrxuHmx5QSs1FyMiEA-RNOnYjmLrqKo38z0diiWMhDbMyC_h3qCksNpkpsIq_1WKSsDOzGvLq-8o_awizg_cdxA0fYJ37oppmvChvmnbqDIruFWDJ0DQdn5O4vtcC6v6FoFib_8Vn3lmZiMNJDltGk3gz7XlV2jp6OsN4F2f3QNjJ9--E98W4ZQW_zamyGaLG80F-1dV7j_KiX0RdaxR16lSQtTWeygNPH5vo5asNspIewJSdmKZ3ySlIsH3y7qnYQSwpJaGEw_11GFbiyemu4EUbu03E981C8UnFfsprPNezNLmYAWx_e_4CRcP1RmmG9eVUVxV2TIELsxBSI1vdvmVBb0HORBJj0pDEQRyzilNzdxy5jPTQO0M2BdOjp7nMYT14zPCZ9nE-d9yp8fwypGYj7nGzbRrKNPrCgJTp0UL4qpbrT1YlGcOsUsrEopHeL-kPV-7e40cQ0BW4PvDJdT9XDfmfn706seUqkW9gaxPIhRc9kmzQTPtXkMKFIBklSmpt0oZ5pfiTCbFo65DSb1bv8thPQoFW28O8o9LiO-6uJXCWDm7a-N0oVErmJSDhskXSbfBJ5gFD89hnqWGprlnZg924AT8KjgXJMypfNw4VSTQOnciWVGPQ3P5eWyhUD4xRNYrsOtew7t4bQUChzpunWfw9di8kHZUxjq4gN4GLZcXNmOm5yVstZiU6-rRQOEq_WYHmNcxczQtVVx1vvg-2w7_7cAsonBd8kYqVqaUkDhxo-OLS2oT0izgilfC0LuSZMJSW0uzYwrtbMEuYgqK4JvafyDvC-wDpcYGzZjsBF0KftZ3o046cNEOptLzmxG3ptIKnMM9CXEtmkmSRKteqOkQP4BAyzSF6E0Hm50nZKvfZn4KAyGvYpYjm4n7hSKVlPnPAjpKjijTWeG5TJXrcXx82spFBKCm75lA8HKItvgnCrGKHHfiHL7qUzl3unfJMbiKBQxrLXtkeeNvTLZdu8shQoKE39AssWaza4DfNZ3hWerOfXt5URDgril8xnn-xFkSb_xjq3eyQ6fyD12SRFNKgxTeUvPlYzTZSMSm85cRYjJvRQm4_1crWbku5Pa4myqJrsEezoEJL5-WrmRCHCk-xqRQVM2cd7xLOxkcUdueOiMX65uW4qib3uQR2ighblUrUkufMQcx2-D9RgAIZkuMHyGQnBui7WjjC3mE1RlppLf5tB6sZuC352if2rpv2clm0On3CwD2oIDMuoUQfiSep3ML2CSi1giS4_7PR3Jq7NjIVBzZO6j6XtfQV3P5ialpbpRN3Md_DBrlt1to8VqcaEOagxJUDF4OgK_LMT61-UlVoyA0ECl7FrqRJqunQRHBdDLVwbWH&cid=CAASEuRoDBoeJZg__-8kARkylxHrog&rfl=2%2Chttps%253A%252F%252Fmoney18.on.cc%242%2Chttps%253A%252F%252Fad6.on.cc%252Fweb%252Fhtml%252Foflx%252F2020_iframe.html%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

704f88e7e5b451f3c2cd34b0d0fa5e27ffbab6f13373d8718a2d7dac8d145424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28562
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9050
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1&C=1

43 B
894 B

12ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNXQc4HYB8ZPoElID3eZyP1EsqqlKJEDIjtlYjKlIarQ26mOk_ID_v0E6VwDnB-lHig7lQLVCYZpxZ2o0dNV1fsuOXNtgzaJ7i4btYlAd1vCXZ7UKY0EgEZcfLY0J2bi7XUBUAwWu1gfQRX4iExkD6ozkrr153sxwybuSLbpcO4kOIVbVYI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 03:45:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 02 Oct 2021 03:45:11 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 03:45:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Sat, 02 Oct 2021 03:45:11 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9050
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVfVx8uy-ZhPQlX0QhVj-wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNXQc4HYB8ZPoElID3eZyP1EsqqlKJEDIjtlYjKlIarQ26mOk_ID_v0E6VwDnB-lHig7lQLVCYZpxZ2o0dNV1fsuOXNtgzaJ7i4btYlAd1vCXZ7UKY0EgEZcfLY0J2bi7XUBUAwWu1gfQRX4iExkD6ozkrr153sxwybuSLbpcO4kOIVbVYI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 03:45:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 02 Oct 2021 03:45:11 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECjOWnNTNA70DZb5FCH2P8Y&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9050
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEE8024aqU0ygVautVa5Scbc&google_cver=1

0
578 B

47ms
16ms

Image
text/html

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEE8024aqU0ygVautVa5Scbc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNXQc4HYB8ZPoElID3eZyP1EsqqlKJEDIjtlYjKlIarQ26mOk_ID_v0E6VwDnB-lHig7lQLVCYZpxZ2o0dNV1fsuOXNtgzaJ7i4btYlAd1vCXZ7UKY0EgEZcfLY0J2bi7XUBUAwWu1gfQRX4iExkD6ozkrr153sxwybuSLbpcO4kOIVbVYI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 03:45:11 GMT
X-Proxy-Origin: 216.131.111.22; 216.131.111.22; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c127d6ff-cb27-4b0c-bda2-ba5a637a6e6f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEE8024aqU0ygVautVa5Scbc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9050
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTk4ODk4OTQ5MDg2OTU0Ng%3D%3D

170 B
188 B

26ms
26ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTk4ODk4OTQ5MDg2OTU0Ng%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 03:45:11 GMT
X-Proxy-Origin: 216.131.111.22; 216.131.111.22; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 17d8cb90-a770-4b48-8adf-0f55c46981cf
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODIzNTk4ODk4OTQ5MDg2OTU0Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame BA0C 114 KB
40 KB 102ms
24ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 20:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27499
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Oct 2021 20:06:52 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame BA0C 8 KB
3 KB 23ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CZ7OEPWWmhirNEx926fDo5IxLoAnBl1T1EZ43L6kK3tMEmGhWzHxUyejl-Md_rqadNsWMHWM28cFSKbDFoKQfZSgS9Mic5sjzDzP6huHbv8uznNAppt1KU3mbI6jD74zUZAZVMbwPuJtkBC80wsXHawJBvQw&dbm_d=AKAmf-C0YdT5KyT0NWoUN-vJoKpdv1yk5d1dnUUee2FN2sZH8MHhJwh5q6eJKBJiRhW1QOmGnK4eRo5_BHXCoF19KgXZlW6L0tQMxeTQiSZgZMMolcMXN5nNJuvBV99MXYf7rcD2tqIW-D8Tn80u4H8Gj4Yh7B0LuXq2lE59szUP0qtcGLtV7kmQv_sVw7Nbjfq-79rmr9e3wDfHDW9vkJBLJCbloUImp4oNXpo1-SRpNYryK9O5YBQbAhtyzbiFT0a9Dy3ANySwElEvnXrD2ar1s4MDN-MC2Ix-vPbvJ2Ca_t34aTIdWiD4BGxtMyb8mabVVIYXAeQ4u5jptA6ogdn4illnmZ5T76J42H3T5CiY7e1GaD4eNXLlGNRSssLbnwySllG2S2OQusbQue5BwyyPe3TMf7me7omVr5qTB4nGRw7Nh1BcO7k9cPtx3JOC-11lOCUzhLEhUNpnWpoh9gY0yxJdtn6elNfozpiQEY9PJTlKw9rQ-_XOWAnC2owL_YY8F093F2r9RjdNOTKndThAolRBnaw2AF_iHiAptS-iaC9lepBOLcl-beONLMySBKicE92uiyRCGYjAXz1E4435gy-T7SOBniiYLJj4AvgkFEOQ7cdY3qByqiStAjKtnrG7KPfKxzE886tHs5UZQJjdK27ah1R_XN2H7XUqHdHDB1gnbR-eOTeJOSxyLHypDxLV0r67RBR8E2F3kSl710fX_R9A5611E54YTIozOsSRZMGN2knUbLiOiIwo_3msAUDnc8_LOUw2B0Gd9WL7L9AIABSzou-H0rulB2p4_8oOFD5xhoTUxi_IGxIdIMd73XJQtWxu5zucJ5g5Gdw70S9uRMdepFn3meOja6fguEakBpVjK_0zc5UO4CJZbJn3Y1YAxcaB-PPE76MfM19CHeXYUGozmCK2bXpvnvqpt0Ub_a2FYnx4fYuYN2nqIpvFXMD1NH2UVTrRK2tNYA9u0iwn1gLkiEVUsOhDCB4Ppv9hF_OcTvgg_RE4DK0TtObRixbffWe6ZFFSP14f1d1W3r14k7xAnaXEslDYEFHVq6lOWchOD6YOmqCvKzsT3mM-tBDaG8hkWFZHQwOIFKIkNXOI2cV5S0RcKWGrITR2QW0IBGZIkBfvT4sX2fSpPbLiO6SHwplN7KdzGXBwLHiBpLvJdVb6fpBvQoSq3HmZ0a_lEBKMTATxntA5dPIjJlfy6dd_fGAmMsi1et1nKsEn59AF-c9g068YBiPpWmqdDIDUqqEIxsiGGWFYh4w8qFxdYg1OXvyUt0zHTAm265mtHFqh33UsHgYZ8ZIyx7uLdAB7r9U4JW7DcgNQlF-e33ByswmIZWxvkHHsL36eMqBVI7PFeZEBGkhfId2Kftaq3fCTS9XDuUCJwKX8wzcqzYEskHDF9bNESWH_aNrZzxKDiozAygWnhAwmGqTYEPC0ImUomq75VLpsTuq6bO_WdTlA15mV4krXEFMyFIOT8GFClVqEep72hJKtxnh54dX-eWyd3LHwbZpj1Wsp0fpDIRHBbJ6zRfrJ7FEwpPLlw3jBw2hDiRmiF8R9-pPbaQMXqXK8LP6sDPsubsZy1hbYKzk7PMlpq4M_zQzg7XwJR8boG4B0WbM1IzP1GXwW5Ng846nzePiU03OK7LZTwcTvM69wvXyFV7EJ2qgUyG3CSo9ZsTH7-MXTY4UAPEXzLNlv_GR7Xze5ZZ_FZhMGWoNbOrxuHmx5QSs1FyMiEA-RNOnYjmLrqKo38z0diiWMhDbMyC_h3qCksNpkpsIq_1WKSsDOzGvLq-8o_awizg_cdxA0fYJ37oppmvChvmnbqDIruFWDJ0DQdn5O4vtcC6v6FoFib_8Vn3lmZiMNJDltGk3gz7XlV2jp6OsN4F2f3QNjJ9--E98W4ZQW_zamyGaLG80F-1dV7j_KiX0RdaxR16lSQtTWeygNPH5vo5asNspIewJSdmKZ3ySlIsH3y7qnYQSwpJaGEw_11GFbiyemu4EUbu03E981C8UnFfsprPNezNLmYAWx_e_4CRcP1RmmG9eVUVxV2TIELsxBSI1vdvmVBb0HORBJj0pDEQRyzilNzdxy5jPTQO0M2BdOjp7nMYT14zPCZ9nE-d9yp8fwypGYj7nGzbRrKNPrCgJTp0UL4qpbrT1YlGcOsUsrEopHeL-kPV-7e40cQ0BW4PvDJdT9XDfmfn706seUqkW9gaxPIhRc9kmzQTPtXkMKFIBklSmpt0oZ5pfiTCbFo65DSb1bv8thPQoFW28O8o9LiO-6uJXCWDm7a-N0oVErmJSDhskXSbfBJ5gFD89hnqWGprlnZg924AT8KjgXJMypfNw4VSTQOnciWVGPQ3P5eWyhUD4xRNYrsOtew7t4bQUChzpunWfw9di8kHZUxjq4gN4GLZcXNmOm5yVstZiU6-rRQOEq_WYHmNcxczQtVVx1vvg-2w7_7cAsonBd8kYqVqaUkDhxo-OLS2oT0izgilfC0LuSZMJSW0uzYwrtbMEuYgqK4JvafyDvC-wDpcYGzZjsBF0KftZ3o046cNEOptLzmxG3ptIKnMM9CXEtmkmSRKteqOkQP4BAyzSF6E0Hm50nZKvfZn4KAyGvYpYjm4n7hSKVlPnPAjpKjijTWeG5TJXrcXx82spFBKCm75lA8HKItvgnCrGKHHfiHL7qUzl3unfJMbiKBQxrLXtkeeNvTLZdu8shQoKE39AssWaza4DfNZ3hWerOfXt5URDgril8xnn-xFkSb_xjq3eyQ6fyD12SRFNKgxTeUvPlYzTZSMSm85cRYjJvRQm4_1crWbku5Pa4myqJrsEezoEJL5-WrmRCHCk-xqRQVM2cd7xLOxkcUdueOiMX65uW4qib3uQR2ighblUrUkufMQcx2-D9RgAIZkuMHyGQnBui7WjjC3mE1RlppLf5tB6sZuC352if2rpv2clm0On3CwD2oIDMuoUQfiSep3ML2CSi1giS4_7PR3Jq7NjIVBzZO6j6XtfQV3P5ialpbpRN3Md_DBrlt1to8VqcaEOagxJUDF4OgK_LMT61-UlVoyA0ECl7FrqRJqunQRHBdDLVwbWH&cid=CAASEuRoDBoeJZg__-8kARkylxHrog&rfl=2%2Chttps%253A%252F%252Fmoney18.on.cc%242%2Chttps%253A%252F%252Fad6.on.cc%252Fweb%252Fhtml%252Foflx%252F2020_iframe.html%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:26:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 03:26:19 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame BA0C 23 KB
9 KB 23ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:35:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 600
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 03:35:11 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BA0C 41 KB
15 KB 21ms
20ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 14:19:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 134731
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 30 Sep 2022 14:19:40 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DC3A 1 KB
749 B 23ms
23ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 01 Oct 2021 08:58:57 GMT
expires: Sat, 02 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 67574
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame BA0C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a464f1393b26e89ad6be95939e5b23dc47fd834156d95f219c6181f88b9674a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B635 22 KB
8 KB 21ms
20ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 30 Sep 2021 14:19:40 GMT
expires: Fri, 30 Sep 2022 14:19:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 134731
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEiSfyPgIObtfNM-NBrU-1g&google_cver=1&google_push=AYg5qPKqSglHqmIe9QHHo-e0VWRE39sMPobGHKWZjq4rZM-4HpprEhAb27...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKqSglHqmIe9QHHo-e0VWRE39sMPobGHKWZjq4rZM-4HpprEhAb27cG7K8RAbhZZODsXIsULnsCiTX5rOrK8KVbj8HOxjJgiA&google_hm=JfEm...

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKqSglHqmIe9QHHo-e0VWRE39sMPobGHKWZjq4rZM-4HpprEhAb27cG7K8RAbhZZODsXIsULnsCiTX5rOrK8KVbj8HOxjJgiA&google_hm=JfEm5CNlLBIuOVFa-3_aNg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKqSglHqmIe9QHHo-e0VWRE39sMPobGHKWZjq4rZM-4HpprEhAb27cG7K8RAbhZZODsXIsULnsCiTX5rOrK8KVbj8HOxjJgiA&google_hm=JfEm5CNlLBIuOVFa-3_aNg
pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIdYv4MC7quFh5VSmuIF0ubAMFJxtmrzan48Sv...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVZmVnh3QUFCZUAwelRPQA&google_push=AYg5qPIdYv4MC7quFh5VSmuIF0ubAMFJxtmrzan48Sv9Vg-9fkp7P1Xo4FIgLGNlc93z8ZPWmxni6aANuXT7Y6-NhCMJLeNhpH...

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVZmVnh3QUFCZUAwelRPQA&google_push=AYg5qPIdYv4MC7quFh5VSmuIF0ubAMFJxtmrzan48Sv9Vg-9fkp7P1Xo4FIgLGNlc93z8ZPWmxni6aANuXT7Y6-NhCMJLeNhpHZPyw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVZmVnh3QUFCZUAwelRPQA&google_push=AYg5qPIdYv4MC7quFh5VSmuIF0ubAMFJxtmrzan48Sv9Vg-9fkp7P1Xo4FIgLGNlc93z8ZPWmxni6aANuXT7Y6-NhCMJLeNhpHZPyw
Date: Sat, 02 Oct 2021 03:45:11 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKha2p3...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKha2p3...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMDIwMzQ1MTEwMDAxMjQxNTEwODE4OA%3D%3D&google_push=AYg5qPKha2p330syFa_xPYlHqNtD_6F5lMgEN1nQu8XUlC4aYWii71DUfHwp5B73Ejybyp...

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMDIwMzQ1MTEwMDAxMjQxNTEwODE4OA%3D%3D&google_push=AYg5qPKha2p330syFa_xPYlHqNtD_6F5lMgEN1nQu8XUlC4aYWii71DUfHwp5B73EjybypMKjWx1evyEryFIuq5wPL1KbB9z16c7ng

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMDIwMzQ1MTEwMDAxMjQxNTEwODE4OA%3D%3D&google_push=AYg5qPKha2p330syFa_xPYlHqNtD_6F5lMgEN1nQu8XUlC4aYWii71DUfHwp5B73EjybypMKjWx1evyEryFIuq5wPL1KbB9z16c7ng
pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Sat, 02 Oct 2021 03:45:11 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESENKVk64i8LTcP6HKm4n-I6s&google_cver=1&google_push=AYg5qPKabLRC49JY02XtH_H4mY-Qxr_iuzEzqAtnkF0zLejB32DwKfJd_aHkFRorDO04Wlwg20V9jj2rTTnucYW-WjnsMG33uAJh6A
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKabLRC49JY02XtH_H4mY-Qxr_iuzEzqAtnkF0zLejB32DwKfJd_aHkFRorDO04Wlwg20V9jj2rTTnucYW-WjnsMG33uAJh6A&google_hm=bLzPg-scxxcYTc2JFUQczg==

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKabLRC49JY02XtH_H4mY-Qxr_iuzEzqAtnkF0zLejB32DwKfJd_aHkFRorDO04Wlwg20V9jj2rTTnucYW-WjnsMG33uAJh6A&google_hm=bLzPg-scxxcYTc2JFUQczg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:10 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKabLRC49JY02XtH_H4mY-Qxr_iuzEzqAtnkF0zLejB32DwKfJd_aHkFRorDO04Wlwg20V9jj2rTTnucYW-WjnsMG33uAJh6A&google_hm=bLzPg-scxxcYTc2JFUQczg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: lidbngu3s3eudev03qopm43rv6akjvb9

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-QzpshIYTbOP7WrKYT_h0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

28ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-QzpshIYTbOP7WrKYT_h0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKckUiEz80nllO73f0FcKSQ6prWLxZpbzXvFLA3vn4E9g5-7bY_U-tHvebPJqmUHA0RhZ8YXUjpmYKx-ak3qrpjfixSDYNzHw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-QzpshIYTbOP7WrKYT_h0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKckUiEz80nllO73f0FcKSQ6prWLxZpbzXvFLA3vn4E9g5-7bY_U-tHvebPJqmUHA0RhZ8YXUjpmYKx-ak3qrpjfixSDYNzHw
date: Sat, 02 Oct 2021 03:45:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHqiDh0_oLQWA7lucewtwLM&google_cver=1&google_push=AYg5qPIoO-8r0lz2om7NSfJ_L22sdboIuJQkH8plYSgMtoLkIdLFVPV7s1WBPcYWhrr2LlIbPYg...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1U5OTVCMFotMjQtQlhPWg==&google_push=AYg5qPIoO-8r0lz2om7NSfJ_L22sdboIuJQkH8plYSgMtoLkIdLFVPV7s1WBPcYWhrr2LlIbPYgaSofc21IBOZxUmnrgEj-P_ysP

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1U5OTVCMFotMjQtQlhPWg==&google_push=AYg5qPIoO-8r0lz2om7NSfJ_L22sdboIuJQkH8plYSgMtoLkIdLFVPV7s1WBPcYWhrr2LlIbPYgaSofc21IBOZxUmnrgEj-P_ysP

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1U5OTVCMFotMjQtQlhPWg==&google_push=AYg5qPIoO-8r0lz2om7NSfJ_L22sdboIuJQkH8plYSgMtoLkIdLFVPV7s1WBPcYWhrr2LlIbPYgaSofc21IBOZxUmnrgEj-P_ysP
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame DC3A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVfVx8uy_ZhPQlX0QhVj_wAABLwAAAIB&google_gid=CAESEFU19YoMy-vvEASagTFcq1s&google_push=AYg5qPI4iwOknzGwIic0iaYJBxmGbpD-TuA1bgb13aB1wqeFzsO...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DC3A 0
12 B 25ms
25ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JURBZxLLD_8blpggPGgoU9-QLp6Bm_Lc1d8BP4dpl7cNNh4kED5rFwi8JC86iAMjJF6Jp8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 LftQ-87gh8ukbv8P1dh67h7Vjfro8G7aRn_R6x3uKA4.js Show response
pagead2.googlesyndication.com/bg/ Frame B635 35 KB
13 KB 24ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LftQ-87gh8ukbv8P1dh67h7Vjfro8G7aRn_R6x3uKA4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dfb50fbcee087cba46eff0fd5d87aee1ed58dfae8f06eda467fd1eb1dee280e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 07:49:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71750
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13320
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 07:49:21 GMT

GET
H2 200 OBZ211002-14198-06-M_ipad000.ts
video-cdn.on.cc/Video/202110/ Frame 33EC 261 KB
0 1156ms
1156ms XHR
video/mp2t 104.16.137.235
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202110/OBZ211002-14198-06-M_ipad000.ts?20211002101216
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.137.235 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:12 GMT
cf-cache-status: HIT
last-modified: Sat, 02 Oct 2021 02:12:16 GMT
server: cloudflare
etag: "6157c000-5e524"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 697aefbeeef0048b-CDG
content-length: 386340

GET
BLOB 200
OK e516de8c-c51f-4dbd-9e09-51d393aca4fb
https://money18.on.cc/ Frame 33EC 61 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://money18.on.cc/e516de8c-c51f-4dbd-9e09-51d393aca4fb
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d825cf02f25f38879ac6f09a7eccf1a2b7c6322b50b742d469c8f83976ba5f97

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Length: 62028
Content-Type: text/javascript

GET
H2 200 sfht0if3y.js Show response
cdn.krxd.net/controltag/ Frame BA0C 11 KB
4 KB 28ms
6ms Script
text/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/sfht0if3y.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 40a1b3366662d4c052b65b0e7842e3e7f78c4514afb3b4a387f550108ecdab03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Sat, 02 Oct 2021 03:45:11 GMT
via: 1.1 varnish, 1.1 varnish
age: 994
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 3744
x-served-by: config-service-a003-ash-prod.krxd.net, cache-bwi5177-BWI, cache-hhn4073-HHN
x-response-time: 1
x-do-esi: esi
x-timer: S1633146312.546535,VS0,VE0
etag: "6b7f7c5dd851aeb3a658ac72e276f359fcdeb737"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 35

GET
H3 200 index.html Show response
s0.2mdn.net/4528516/1924127429702291/ Frame 05BA 6 KB
2 KB 57ms
25ms Document
text/html 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4528516/1924127429702291/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d6205a9d1df46e5e8cce08efce39a92fcfea52a22d5e24e14857f588c450318

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /4528516/1924127429702291/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 2449
date: Fri, 01 Oct 2021 12:31:01 GMT
expires: Sat, 02 Oct 2021 12:31:01 GMT
last-modified: Wed, 30 Jun 2021 09:13:21 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 54850
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BA0C 0
592 B 124ms
52ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsukzD6_Dq5CPYQslUw_fh0jrehw9BhkIPkbQ0zE6tONofX0-ThC9lw74fX8cW91e5deLxBfYvXK5TgEAehkU8EuHoUyzt0if_rkGnjK_wSVh7256KMEAE0plkFZyibQWTayoJZV1btIArhLl7-8GKVjCx9LTmq1kXCip-GPO_oBhyU3gWi5Il3VCZnCbXAD55YFymH6JphzaR0eqVa_5w3uMX2jeRnKiUXeLYI43J2e-E0V3RmOZ-PuUDnEYI1lVI90drK7V2DGKzKDn_dqPDnHzi6w00M5Vz2RPePAUGX9_N2DUDy1wvGICm4dR2Xc9o_fyASuycf8Fl3HyqbHWY1YEc0YRBgvGEH2MfTU4W5jex_BiGVlYBvutNAwFi_9lz9IjZ0NddnDTiuqFORPy4gXA8x54HdH4UuWNZZDX_EaQ54z9gcjVFVzPxR4hrcNZlYzh8rzeE6QV63OBeu5BtW75h_jA2BiFjvKV3g9NP_7uaGTgiRlm_LjtOh9hb_Mz4HPnlXF1rJ9Y9mJvzYemJFtFL7XjNcn-WcDr0yDTZ3TXbYPtZ2s7H9pY6l6gbhMGj0QECp2n4cZNaQNGyQDKKVTOohzqKbBuu0nWN1yMel4PfrD7y9poAZSRzXZ24h_6CsG1UY8jFpEJJEc28msuPvmtXMeC27VDx0pGYgbVQwdsjotCbtgoTzZZjD2pHAe6y5tCa5AdqVt7hQcYN5o1H-DlaWGeqtQc8EjmuaNAdOf8012u68hbwW_8cLLSWfkGlpYTznnqi9QuhnorQrnsrEgCTWudMLEu4xb09bLuWuy_lc8LJl9Ji1XNKuQyZNrlfn1yz_yqnVbiBOBhO9pB--XuQbDoBOt0MI-TVSw9uaMD0kFcn_WGBBt5aDfesZdqYcrIlTeyCyOkh8LVMjKEDNd_VhlxBFi7a7PJN9JQPrrG7Og2kpZ285NYvdx-xgBbq4v0c6A26ffXViiyYURlGXj4OfLMbmH7uiTMY3CwBhMF1KCY4Vp2oGcElXmUpxw4Vc-oUWioGnUN9tUsF0x_llZE0OA1xgHqanO77wAOfOUO3ARaRAc3-DnbjsRROrFYBZGgUKQbqKvNEhZImBmKvTM2-l04mu-vRVf3GlXdDfpFfIXBFhn4yscvJzA4p1osEqTFhnU2_MMg1_aHw8lSKg5HJw4cOzK1Ag0FqCz1WJJGtCNtphS7Q&sai=AMfl-YTWj2wHRvwL5N2nNfbwLUch3g3e5bEXYT5p5DTYUHnVE7ot5FC1UJlc1ADs7XkYcGmpp0mLwBsa8kOVvWhonpYjOdSi7PQjWPs3A87pJFlQ51x1D47KtwzpKCqTt-bIYugGRTnSriD53xL6DkRD-LNcpyXVcA&sig=Cg0ArKJSzPCBoyaWgdQwEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=178&cbvp=1&cstd=175&cisv=r20210928.70835&adurl=

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 02 Oct 2021 03:45:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET template-web.js
money18.on.cc/lib/art_template_lib/ 0
0

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ Frame BA0C 259 KB
83 KB 10ms
9ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/sfht0if3y.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: gzip
age: 2606235
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 3586578
content-length: 84509
x-served-by: cache-hhn4073-HHN
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1633146312.561838,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H2 204 ad_impression.gif
beacon.krxd.net/ Frame BA0C 0
339 B 93ms
28ms Image
text/plain 54.229.245.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/ad_impression.gif?campaignid=11313517&advertiserid=4528516&placementid=150618923&adid=321276323&creativeid=153763284&siteid=1729994&url=https%3A%2F%2Fbeacon.krxd.net%2Fad_impression.gif&_kpid=af5fc09f-edef-481c-bfa7-696005c6deb3&confid=sfht0if3y
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3571272074788370&output=html&h=250&slotname=6393984442&adk=3333530506&adf=946259663&pi=t.ma~as.6393984442&w=300&psa=0&format=300x250&url=https%3A%2F%2Fmoney18.on.cc%2F&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633146310702&bpp=4&bdt=376&idt=84&shv=r20210927&mjsv=m202109280101&ptt=9&saldr=aa&cookie=ID%3Ddf321a82f158e3df%3AT%3D1633146306%3AS%3DALNI_MYvDuRSqJC45M2BEN4L-BlWTK9Qnw&correlator=1047830571160&frm=24&ife=1&pv=2&ga_vid=1462764227.1633146311&ga_sid=1633146311&ga_hid=92139704&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=639427608&scr_x=-12245933&scr_y=-12245933&eid=31062978&oid=2&pvsid=4019907014576825&pem=950&eae=2&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=1.6ot95rwh8ti8&fsb=1&dtd=98
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.245.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-245-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
cache-control: private, no-cache, no-store
x-request-time: D=36 t=1633146311
x-served-by: beacon-n010-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 05BA 236 KB
63 KB 67ms
14ms Script
text/javascript 2.16.107.27
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/4528516/1924127429702291/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.107.27 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-107-27.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: gzip
server: Apache
cache-control: max-age=900
vary: Accept-Encoding
content-type: text/javascript
x-n: S
accept-ranges: bytes
expires: Sat, 02 Oct 2021 04:00:11 GMT

GET
H3 200 javascript.js Show response
s0.2mdn.net/4528516/1924127429702291/ Frame 05BA 37 KB
8 KB 25ms
24ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4528516/1924127429702291/javascript.js?1624360851673

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4528516/1924127429702291/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67889c73904d219f835755982e3b354980b21a972313ca944be18e9ce67dd4d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/4528516/1924127429702291/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 12:31:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54850
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8526
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 09:13:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Oct 2021 12:31:01 GMT

GET
H2 200 af5fc09f-edef-481c-bfa7-696005c6deb3 Show response
consumer.krxd.net/consent/get/ Frame BA0C 236 B
426 B 55ms
32ms Script
text/javascript 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/af5fc09f-edef-481c-bfa7-696005c6deb3?idt=device&dt=kxcookie&callback=Krux.ns.congstar.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1c16d201a9100daacb04cf145129a08cb61e6c06afe4c81f9d63eb7090718c12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a013-dub-prod.krxd.net, cache-hhn4059-HHN
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1633146312.673939,VS0,VE26
content-length: 187
x-cache-hits: 0, 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B635 0
20 B 34ms
33ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFY0dx9VXYf2TEpmgrASGmYnICgAAAAA4AeAEAg&bg=!8fKl8rbNAAZE-GIIRPg7ACkAdvg8WgS1wAdKEU-M9o4DtunYsgCq5Th4ZIqbaAnjB6CPj1eDDGZqoAIAAACYUgAAAAtoAQeZAu2SnwaIst8y7b_i6vQWJHQ2XU9tjmuf6AhzFcOlxpYW_VOQfVp0y77kHei0if4Yhr9BZ1nIc4LVApvb6VqGUiAKv2EBgxZVmcfYkR3AzvHNpMO4OPpkqpqdIP_jpfu4il5BpnPjPLOTFuz4zU_9OIB4kvCf9sxcME8G2zDjnobqyo0l_g_aCfI-YtGSlGZQFIv7napJ0XkGIDgwktJUle_Q8zmHY0L-joPehTnpaULUIhvQEw4dWc0AySefKncYahSJanlenhaVEqFrclrbUtgv8GcMFMCToTbdtUNK2LWV8fgWANd-dFxaAJDlOQlbaInVfkokhC6SUhBuLo7cYFhQvZLq4jnIkWlfCpYgsdOb_8mOQhdbW0GMbpoNEouBd68FlnHPajs0UFDhkGXhRlFzQpt9vx_BDTjUYq_F_JAcpBvclo7Ad71qFd3cuBJutfvPSYiViymn4F3UjwLqDaY95GrZ3MxCx-gl5qV1kw5eEVAir-teDXh7YHaFEDllZTL3qI-062q01fgLXc8tAFU4igoicba42yGN7sIT4FOB4xKnqRC02q-4P7g8tIznEipH9bDfIG2LHqO3LwtdfRlMSRpz_D65AJsOb6ZJDwhZdaiHk2eVw8ri_rEUGWMHHhDLlCwMELCYDnZLVqEPKaXbSK1bI9D07iZJqQ__AH6CqOfaHPiawgPyJ1AGyjaunWvVMogo83cwQGN884UaaTUWWx7kSoIoKiBmAfsR_0A6Qw0PwLZ7plJpwYYHtdK3qJZbGBby43lytqIkwFlYqiKPInGadJfFdWnPmS0M234DdZQ8UVL6ub-hIHwZWvcaDhMEUMrIosFLcAHDJ2KqbHUT3O8G-KaH8kSN2oFgtIpv7mwPeaim1pgKIf5vEtH07pybptJPzMgFJNqaQ4WwdgVMdaW395z7jKZZWeS23N-ql6J2Ybtez4xduQbmQHZh4m5qMDUi5UhbUGCKpJMlcbVN7su3oSc4BJRUX6fkgw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 03:45:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame BA0C 0
23 B 69ms
35ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 03:45:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET threadLoader.js
money18.on.cc/modules/desktop_compenents/ 0
0

GET
H2 200 optout_check Show response
beacon.krxd.net/ Frame BA0C 81 B
240 B 28ms
28ms Script
text/javascript 54.229.245.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.congstar.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.245.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-245-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b2598a13fe765ae6836b8a9d6da96c56e633e88597b8ce8cf411fc1ebe7e92f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=27 t=1633146311
x-served-by: beacon-n024-dub-prod.krxd.net
content-type: text/javascript

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1033 11 KB
8 KB 72ms
38ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210927&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e19dc9cde547dca3f0c8e9d01138281a507a9f13114cec35961cfd5775067f1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8462
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1033 17 KB
6 KB 29ms
29ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:45:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 02 Oct 2021 03:45:11 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame E293 12 KB
5 KB 20ms
20ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Fri, 01 Oct 2021 20:54:24 GMT
expires: Sat, 01 Oct 2022 20:54:24 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 24647
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 1F21 783 B
533 B 33ms
33ms Document
text/html 142.250.185.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f4.1e100.net

Software

GSE /

Resource Hash

f9094e81ff66b54c7db6ffd5156613557d01ffd665c359db24b05f75d6ab4815

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4tso3OdeMMyvFiNi9q9IeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sat, 02 Oct 2021 03:45:11 GMT
date: Sat, 02 Oct 2021 03:45:11 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-4tso3OdeMMyvFiNi9q9IeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 CongstarFont.woff2
s0.2mdn.net/ads/richmedia/studio/45844501/ Frame 05BA 102 KB
102 KB 26ms
26ms Font
font/woff2 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/45844501/CongstarFont.woff2

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c310a100b2bb38cd97a6ed696abe3dd3556b707607d207a13b838cd89f73e78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/4528516/1924127429702291/index.html
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:40:35 GMT
x-content-type-options: nosniff
age: 276
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104232
x-xss-protection: 0
last-modified: Thu, 06 Oct 2016 14:32:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Oct 2021 03:55:35 GMT

GET
H3 200 NNk1vzza2fvPfI2QNF-UnTMKXalxTSrKsyU60SrCuuY.js Show response
pagead2.googlesyndication.com/bg/ Frame E293 35 KB
13 KB 23ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/NNk1vzza2fvPfI2QNF-UnTMKXalxTSrKsyU60SrCuuY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34d935bf3cdad9fbcf7c8d90345f949d330a5da9714d2acab3253ad12ac2bae6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 16:30:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126871
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13338
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Fri, 30 Sep 2022 16:30:40 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 1F21 0
0 37ms
37ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20210927&jk=4019907014576825&rc=
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
s0.2mdn.net/creatives/assets/1881029/ Frame 05BA 57 KB
57 KB 25ms
25ms Font
font/woff 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/1881029/86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/4528516/1924127429702291/index.html
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 03:30:59 GMT
x-content-type-options: nosniff
age: 853
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58447
x-xss-protection: 0
last-modified: Wed, 15 Feb 2017 10:23:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Oct 2021 03:45:59 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 1033 0
0 48ms
48ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210927&jk=4019907014576825&bg=!mZqlmt7NAAZNQyuQTUM7ACkAdvg8Wn_OqRUQ3ahRGMzeFo6rfg9WouCoVcgjb0whmIziCt_cYH8TxQIAAABtUgAAAAtoAQeZAt6UX_UR6B00lE3T1WXYv14u5jEyP78HHYR5IZqlK4C4-lt4YqZia4YMvCS6d7P7CRVL-Bz_mth9GhrEYJHwakOqGEzBYRKDLmMUDMAXZY4yvRmxHGiF1TYC3i0U85iV1oK0HsVZfT0znJRCGxnnXcWwiz9tikuLocSmHqtAaHd8xR-UL2Ix5eeq0GbaAkGcKn-U2-wLjsh3tvZN9F0_oSdWo498j2Iz3JCZQUk0ZGMNWlz91lCuQGKsfbp6Bc0OrUz_QAwT3PHLurLSpToBlVk2FripceeAw2BieVyK6doUxMEcAT3O0tELg42X-tBQLvVw3I0tkC17wr71yYloZpA_hbw2Cv5l9Il_PPDVlosrLYzSOoCqsEJs2Etqj6fqhMda4mjRmgieEJ-peaUPICM_JzzPxPyL6oQiAKj0HD6PJP_eqAHUdo6wIOd_3DPVc5v2Qs3qvgc4KBL3OilpoT_4NinXE_Wpr0RmguOWUaKE9sRZCn_u20IlskB0cLcL1OsQdBJu_iL9X4hqQ309a_779dmKlahzLznzjIruz97LLFNgEyRpJ3LUAwPoUo5G568rJvxlJBMDKtZyAOPMbJ0eNdN4mhUPVJ_thANIr1tkFDaB1Yi5rCb1SDwF62oUFWUMj-R7nGd7YkjcNv2Cspe11N33Lud-DIZCEtIQM3Jwbd3Og9Yl4FFaDg-bjCAiNWesJnWF6EFTMkP7U5XPxZM-bOl52dI7pYz5f0uwTI09dZ68ZmKMnolC-gceh9mlh4bzzRt-IMpPm13GsOHOfFCYiL1XGs3n-mWkCbH-vpZBwzPD0p6lJGmiP-yTvqZ3IhrjcLu30cH6I27bkwZXDL5QYvxpnBWTAX1zToX8GsLAhU4-JoYDSvm7OA5u9L7qkV7xoIMhHv-ph_zemFP4MPoRQRiQdMWCQyuEIVvXHbkV5G4ebRRPPEePy8Swj1ZnWLAHdWiiFqFtr_KWojPKig
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad6.on.cc/web/html/oflx/2020_iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET expired_stock.js
money18.on.cc/js/ 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BA0C 42 B
64 B 47ms
46ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstg10WyUYokXcBM6kdLP_N8C-Vb0AO5xQ3Xdufa7YFQ_-AMWP2efeo5TBTrox_hZ0n_hTRPJwSGTCs_YVkTzb0-5AJx87WADn6c5TDo_dNvrnbM5zMn6Q&sai=AMfl-YSvxVjOAMSI_FmGzB9WOBX7wU1GoJqN-uf7dlY7PCUdlqsN1e1la5r8b6IE4HWHvl2SVID8IvGd3ILc7Uck43-y9wVaFD9UdwOneNt3uSrheu8BeNBsnVQlGmuF&sig=Cg0ArKJSzMa3dUbT64L2EAE&cid=CAASEuRoDBoeJZg__-8kARkylxHrog&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211001&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3333530506&rs=2&met=ce&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1633146310801&rpt=649

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS