windowstechs.com Open in urlscan Pro
173.233.67.178 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Submission: On September 23 via api (September 23rd 2023, 2:27:15 pm UTC) from US — Scanned from US

Summary HTTP 179 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 19 IPs in 4 countries across 24 domains to perform 179 HTTP transactions. The main IP is 173.233.67.178, located in Latham, United States and belongs to TURNKEY-INTERNET, US. The main domain is windowstechs.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 15th 2023. Valid for: 3 months.

This is the only time windowstechs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
24	173.233.67.178 173.233.67.178	40244 (TURNKEY-I...) (TURNKEY-INTERNET)
6 39	2607:f8b0:400... 2607:f8b0:4004:c08::9b	15169 (GOOGLE) (GOOGLE)
1	45.60.31.34 45.60.31.34	19551 (INCAPSULA) (INCAPSULA)
1	2607:f8b0:400... 2607:f8b0:4004:c17::9a	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4004:c09::5f	15169 (GOOGLE) (GOOGLE)
46	2607:f8b0:400... 2607:f8b0:4004:c0b::84	15169 (GOOGLE) (GOOGLE)
8	2607:f8b0:400... 2607:f8b0:4004:c17::9c	15169 (GOOGLE) (GOOGLE)
12	2607:f8b0:400... 2607:f8b0:4004:c06::5e	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:4004:c1d::5e	15169 (GOOGLE) (GOOGLE)
12	172.253.62.154 172.253.62.154	15169 (GOOGLE) (GOOGLE)
1 5	2607:f8b0:400... 2607:f8b0:4004:c06::68	15169 (GOOGLE) (GOOGLE)
2 2	23.61.60.237 23.61.60.237	16625 (AKAMAI-AS) (AKAMAI-AS)
2 17	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE)
2 4	2606:4700::68... 2606:4700::6812:19ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	31.220.27.155 31.220.27.155	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2 2	64.74.236.95 64.74.236.95	19024 (INTERNAP-...) (INTERNAP-BLK5)
2 2	35.207.24.140 35.207.24.140	15169 (GOOGLE) (GOOGLE)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
3 3	35.208.249.213 35.208.249.213	19527 (GOOGLE-2) (GOOGLE-2)
2	2620:116:800b... 2620:116:800b:21:b08a:1dc5:659b:4055	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4 4	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	82.145.213.8 82.145.213.8	39832 (NO-OPERA) (NO-OPERA)
1 2	104.112.20.199 104.112.20.199	16625 (AKAMAI-AS) (AKAMAI-AS)
1	44.209.104.88 44.209.104.88	14618 (AMAZON-AES) (AMAZON-AES)
2 3	2a02:6b8::90 2a02:6b8::90	208722 (GLOBAL_DC) (GLOBAL_DC)
179	19

24 173.233.67.178 (Latham, United States)

ASN40244 (TURNKEY-INTERNET, US)
PTR: webserver77.turnkeywebspace.com

windowstechs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2607:f8b0:4004:c08::9b (United States) 6 redirects

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.60.31.34 (United States)

ASN19551 (INCAPSULA, US)

isc.sans.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::9a (United States)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4004:c09::5f (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

46 2607:f8b0:4004:c0b::84 (United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4004:c17::9c (United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:4004:c06::5e (United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4004:c1d::5e (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.253.62.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f154.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c06::68 (United States) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.61.60.237 (United States) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-61-60-237.deploy.static.akamaitechnologies.com

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 172.253.63.155 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: bi-in-f155.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:19ad (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.220.27.155 (Amsterdam, Netherlands) 1 redirects

ASN39572 (ADVANCEDHOSTERS-AS, NL)

s.uuidksinc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.74.236.95 (United States) 2 redirects

ASN19024 (INTERNAP-BLK5, US)
PTR: chi.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.207.24.140 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com

rtb.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

ius.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.208.249.213 (Mountain View, United States) 3 redirects

ASN19527 (GOOGLE-2, US)
PTR: 213.249.208.35.bc.googleusercontent.com

trace.mediago.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800b:21:b08a:1dc5:659b:4055 (United States)

ASN14618 (AMAZON-AES, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.71.131.137 (Seattle, United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.96.105.8 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 82.145.213.8 (United Kingdom) 1 redirects

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology

t.adx.opera.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.112.20.199 (United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-112-20-199.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.209.104.88 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-104-88.compute-1.amazonaws.com

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6b8::90 (Moscow, Russian Federation) 2 redirects

ASN208722 (GLOBAL_DC, FI)

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
67	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 122 tpc.googlesyndication.com — Cisco Umbrella Rank: 169	822 KB
35	doubleclick.net 8 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 cm.g.doubleclick.net — Cisco Umbrella Rank: 329	287 KB
24	windowstechs.com windowstechs.com	544 KB
18	gstatic.com www.gstatic.com fonts.gstatic.com	223 KB
13	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1368 www.googleadservices.com — Cisco Umbrella Rank: 178	610 B
8	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 254	455 KB
7	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113	6 KB
5	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 11	1 KB
4	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 637	2 KB
4	tribalfusion.com 2 redirects a.tribalfusion.com — Cisco Umbrella Rank: 1469 s.tribalfusion.com — Cisco Umbrella Rank: 3247	2 KB
3	yandex.ru 2 redirects an.yandex.ru — Cisco Umbrella Rank: 4716	961 B
3	mediago.io 3 redirects trace.mediago.io — Cisco Umbrella Rank: 1569	1 KB
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 2022	604 B
2	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2803	292 B
2	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 1260	925 B
2	mfadsrvr.com 2 redirects rtb.mfadsrvr.com — Cisco Umbrella Rank: 1698	1 KB
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 906	1 KB
2	owneriq.net 2 redirects px.owneriq.net — Cisco Umbrella Rank: 3422	2 KB
1	adentifi.com rtb.adentifi.com — Cisco Umbrella Rank: 1944	35 B
1	opera.com 1 redirects t.adx.opera.com — Cisco Umbrella Rank: 2169	673 B
1	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 830	642 B
1	ctnsnet.com 1 redirects ius.ctnsnet.com — Cisco Umbrella Rank: 13762	670 B
1	uuidksinc.net 1 redirects s.uuidksinc.net — Cisco Umbrella Rank: 10895	335 B
1	sans.edu isc.sans.edu — Cisco Umbrella Rank: 86629	10 KB
179	24

	Domain	Requested by
46	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
24	windowstechs.com	windowstechs.com
21	pagead2.googlesyndication.com	windowstechs.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
18	googleads.g.doubleclick.net	6 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
17	cm.g.doubleclick.net	2 redirects googleads.g.doubleclick.net
12	www.googleadservices.com	windowstechs.com
12	www.gstatic.com	googleads.g.doubleclick.net
8	www.googletagservices.com	googleads.g.doubleclick.net
7	fonts.googleapis.com	googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com
5	www.google.com	1 redirects tpc.googlesyndication.com googleads.g.doubleclick.net
4	match.adsrvr.org	4 redirects
3	an.yandex.ru	2 redirects
3	trace.mediago.io	3 redirects
2	sync.teads.tv	1 redirects
2	tr.blismedia.com	googleads.g.doubleclick.net
2	cms.quantserve.com	googleads.g.doubleclick.net
2	rtb.mfadsrvr.com	2 redirects
2	b1sync.zemanta.com	2 redirects
2	s.tribalfusion.com
2	a.tribalfusion.com	2 redirects
2	px.owneriq.net	2 redirects
1	rtb.adentifi.com	googleads.g.doubleclick.net
1	t.adx.opera.com	1 redirects
1	px.ads.linkedin.com	1 redirects
1	ius.ctnsnet.com	1 redirects
1	s.uuidksinc.net	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	isc.sans.edu	windowstechs.com
179	29

This site contains links to these domains. Also see Links.

Domain
securityboulevard.com
isc.sans.edu
news.slashdot.org
thehackernews.com
hackaday.com
it.slashdot.org
security.stackexchange.com
www.facebook.com
twitter.com
www.linkedin.com
catchthemes.com

Subject Issuer	Validity	Valid
windowstechs.com cPanel, Inc. Certification Authority	`2023-09-15` - `2023-12-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
imperva.com GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-21` - `2024-03-19`	6 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
quantserve.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-08-07` - `2023-11-05`	3 months	crt.sh
adentifi.com Amazon RSA 2048 M01	`2023-07-06` - `2024-08-03`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Frame ID: 193519E0BA226BD37618A3FA64345280
Requests: 34 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/zrt_lookup.html
Frame ID: 26E696E2BED0CF0135EDDAFB16706FA4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&adk=1812271804&adf=3025194257&lmt=1695515230&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x540_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479230562&bpp=16&bdt=339&idt=135&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8452531300305&frm=20&pv=2&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=160
Frame ID: 28A8485F0699D3FDEEF97F7CCD7DE67E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=280&adk=3796677708&adf=3474651343&pi=t.aa~a.1829178219~rp.4&w=1000&fwrn=4&fwrnh=100&lmt=1695515230&rafmt=1&to=qs&pwprc=2062561900&format=1000x280&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479230578&bpp=2&bdt=355&idt=147&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=169&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=j4zzxHlsrx&p=https%3A//windowstechs.com&dtd=151
Frame ID: DEDA9105CE472CDC3126C790E4EB9962
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 469C885496B978CAA7CE060C115E875C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=250&adk=3990647781&adf=2778194034&pi=t.aa~a.749167770~rp.4&w=320&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=320x250&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280&nras=3&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=330&ady=1403&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=ZgJTXIdXA0&p=https%3A//windowstechs.com&dtd=6
Frame ID: 51197D357353D98DAC77F678441BFD53
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=600&adk=2053324183&adf=1379365821&pi=t.aa~a.1287707200~rp.2&w=300&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=300x600&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1629&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250&nras=4&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=340&ady=1703&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=qIVdPYycIC&p=https%3A//windowstechs.com&dtd=14
Frame ID: 3FE73B563E259518315E9FAB131AE854
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=200&adk=3332155356&adf=1835424514&pi=t.aa~a.1779471494~rp.1&w=590&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=590x200&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250%2C300x600&nras=5&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=680&ady=4234&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=hHl5PAVTYW&p=https%3A//windowstechs.com&dtd=18
Frame ID: 91EE947D7BE2F2C3F5DC2A9BA66D77EB
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1
Frame ID: 02E6C30E98F73479F7AF1EE8DF03E739
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1
Frame ID: 7FAE1D7149E536B6217A34F2FE5BF24F
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1
Frame ID: F3C98A62251FD779E52866A4233C8680
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1
Frame ID: 28AAFF6C73418CCAE59D43266F9B2C38
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 2CE46639AD50BC915A3A8970B09F2B8E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D95C9C978419F4CF84BBA8304E777B44
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js
Frame ID: 029362CE2BE68A23AF3394A566BD7F9B
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: A227F548A419746996D0CF173C720324
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 60B8BE7EAD95CCA951520F62523CEEB3
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 9FAB29A6C91105A66E9AD2B871712CF5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 43161916550B45AA951C508261EDE0D6
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 3345141265625D31860BC97BE68B3006
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 51490B145FD4F23B0F7ECE929E28B2E5
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 31A904BE0A15B202E7C1BB1140F75AA5
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0DCD8E8F57C93A29BF7210FE53670480
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 34B0F8752D922670745109D40240447D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 9D9C5B4DD14888CED5E7A6D596DCAF64
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js
Frame ID: 3FE9B5FD21EFC48593C1F5A1E7CBE39A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

browser hijacker – WindowsTechs.com

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Yandex.Direct (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://an\.yandex\.ru/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

179
Requests

87 %
HTTPS

44 %
IPv6

24
Domains

29
Subdomains

19
IPs

4
Countries

2364 kB
Transfer

5302 kB
Size

31
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://securityboulevard.com/2018/10/remove-igames-start-browser-hijacker/
Title: Remove iGames Start Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-igames-search-browser-hijacker/
Title: Remove iGames Search Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-mybrowser-search-com-hijacker/
Title: Remove Mybrowser-search.com Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-giffysocial-browser-hijacker/
Title: Remove GiffySocial Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-movixhub-browser-hijacker/
Title: Remove MovixHub Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-utilitychest-browser-hijacker/
Title: Remove UtilityChest Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-freeshoppingtool-browser-hijacker/
Title: Remove FreeShoppingTool Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-gardeningenthusiast-browser-hijacker/
Title: Remove GardeningEnthusiast Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-sportshero-browser-hijacker/
Title: Remove SportsHero Browser Hijacker

Search URL Search Domain Scan URL

URL: https://securityboulevard.com/2018/10/remove-advisurf-com-redirect/
Title: Remove Advisurf.com Redirect

Search URL Search Domain Scan URL

URL: https://isc.sans.edu/

Search URL Search Domain Scan URL

URL: https://news.slashdot.org/story/23/09/22/2021211/feds-cook-sees-signs-of-ai-improving-us-labor-productivity?utm_source=rss1.0mainlinkanon&utm_medium=feed
Title: Fed’s Cook Sees Signs of AI Improving US Labor Productivity

Search URL Search Domain Scan URL

URL: https://thehackernews.com/2023/09/deadglyph-new-advanced-backdoor-with.html
Title: Deadglyph: New Advanced Backdoor with Distinctive Malware Tactics

Search URL Search Domain Scan URL

URL: https://hackaday.com/2023/09/23/exploring-ground-effect-with-a-quadcopter/
Title: Exploring Ground-Effect With a Quadcopter

Search URL Search Domain Scan URL

URL: https://it.slashdot.org/story/23/09/22/1913215/meredith-whittaker-reaffirms-that-signal-would-leave-uk-if-forced-by-privacy-bill?utm_source=rss1.0mainlinkanon&utm_medium=feed
Title: Meredith Whittaker Reaffirms That Signal Would Leave UK If Forced By Privacy Bill

Search URL Search Domain Scan URL

URL: https://security.stackexchange.com/questions/272323/is-this-js-file-malicious-ran-as-nodejs-everything-is-encoded
Title: is this JS file malicious (ran as nodejs)? everything is encoded

Search URL Search Domain Scan URL

URL: https://www.facebook.com/windowstechs
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/techxperts
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/jamesdouglas
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://catchthemes.com/
Title: Catch Themes

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44

https://googleads.g.doubleclick.net/pagead/adview?ai=C4gCEvvUOZZTkLsi2NZzzmvgMkq_Sj3PcxsK2vhGbpcfY1D8QASDPtbMoYMnujovApIwQoAHI9MXGKcgBCakCkEf2R4zzeD6oAwHIA8sEqgT4AU_Qy6tnyiA5oS0VKawv2U6EULtNLu2YZV47PQGvPaNF4X2zdmgyJuAiIdQiJ5UlO20ZGK-ML-SwyZjyWoYqcyh37zmp6SZyjbaBfOiVpvSzB0sb172ysipGDPzpnr6PRZByIftYLlgOxTVqF0R8_kQrm6jH6XRtqH0WUXCesKrvBsZSX3PnojnOqdnaqa9gLUKJAL04yOtPWJ8q8W3jLwGBcxj_6IEekUj3_DdHgRMjrfjH4zoe0J_MKQL7_Yl5EYaWE8i6yScW1KNBv84Q6Lts7prD65eTvIibVfqJ26Slz8cUxOEesc7M5THgWSQt6joZa7b0k0IwwATggvm4wQSIBeWFoZxMkgUECAQYAZIFBAgFGASgBi6AB7rusuQEqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQ18VT0ggUCIBhEAEYHzICigI6AoBASL39wTqaCZsBaHR0cHM6Ly91cy5mb2JsdWUuY29tL2RzP3E9Z29sZCUyMGJhdGhyb29tJTIwdGlsZXMmcmFjPVNlYXJjaCUyMGZvciUyMGdvbGQlMjBiYXRocm9vbSUyMHRpbGVzJmFzaWQ9Zm9fY2hfYmFfNjc5Jm53PWQmZGU9YyZscGlkPTkwMDU1MzImcHViPXdpbmRvd3N0ZWNocy5jb22ACgHICwHaDBAKChDwk5TqitG7wUoSAgEDuBPkA9gTDIgUAtAVAYAXAbIXHAoaCAASFHB1Yi01NTI0NDQ5MDQ1NjA5OTk0GAA&sigh=EY8VgeTYkhw&uach_m=[UACH]&ase=2&nis=4&cid=CAQSGwBpAlJWDqjXDSRQrpbY_qkJQ_cVKkNIOj7sQRgB&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x676ab9e61643bb450000000000000000%22,%224%22:%220x2aaf4e76d8d7c3630000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%225644644656995116759%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216109780286879077825%22}&andc=true

Request Chain 103

https://googleads.g.doubleclick.net/pagead/adview?ai=C13OtvvUOZbqoLoiK_gSkh52YB73yrtpyjte_peIR1_yr4pUOEAEgz7WzKGDJ7o6LwKSMEKAByPTFxinIAQmpApBH9keM83g-qAMByAPLBKoE-AFP0OwJGjh-VZox_e6BwFm2wrGRMlmvXMl30E5utyy_mRIfCgMLhSZOt8XQTYXcS9gmeiqu4Y8reIm40wJOayZFq4vQLbvfFZpKaqPrCEeQHMa4N9Sl8FUf1vJzBgqo5tAZaurzTAt6Tc3A77JQPUA9RGd9xP4dVilIg11UBVnhZCVihxeMstSFjo18EjbrpSlgqB_y2mepqz0DFt6KGFnd58LUgYAVMFZxBu6SGy5_GC96BmeonbyPBKarSNEkGapDZh8n0vev0-AyyUcpm_awq5UlEUuKRGeK7jJG5j_ao1g6qpPaAtcg-MVFaVghq-s9hPi8J7HhGsAE993ygbkEiAXx5cqVTJIFBAgEGAGSBQQIBRgEoAYugAe05qzkBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEM_aEdIIFAiAYRABGB8yAooCOgKAQEi9_cE6mgmIAWh0dHBzOi8vdXMuZm9ibHVlLmNvbS9kc3I_cT1wYW50cnklMjBkZXNpZ24mcmFjPVNlYXJjaCUyMGZvciUyMHBhbnRyeSUyMGRlc2lnbiZhc2lkPWZiX2NoMzM0Jm53PWQmZGU9YyZscGlkPTkwMDU1MzImcHViPXdpbmRvd3N0ZWNocy5jb22ACgHICwHaDBAKChCQ5aGbsZOi4TwSAgED2BMMiBQC0BUBgBcBshccChoIABIUcHViLTU1MjQ0NDkwNDU2MDk5OTQYAA&sigh=DPytrB8y_2c&uach_m=[UACH]&ase=2&nis=4&cid=CAQSGwDICaaNVM1isnLYgAfqABDam4X15bf7Hv6N-xgB&template_id=5000&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x8925d48e1ae1c6e80000000000000000%22,%224%22:%220xae0efa9e8299e94a0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%2216121160698027789128%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213148832468189437777%22}&andc=true

Request Chain 105

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 107

https://googleads.g.doubleclick.net/pagead/adview?ai=CtprIvvUOZbmoLoiK_gSkh52YB8n8r9ty6Ijv7LoRw-Tz_QgQASDPtbMoYMnujovApIwQoAHI9MXGKcgBCakCkEf2R4zzeD6oAwHIA8sEqgT0AU_QX1gm05yIP3Elnz58U_08WfyIEfQsAWYrcahzcvjc-_DdGeVKAOHeKh5Gq1XjHFAojRaZkMyOYBJWJY1o6z4IRFPIqYoQzb2XCiqa4gXvhVt2frFtk8lDXhPC44stn_juo90wTZl_NkisHX4KO1QpmIX0HdkOJpA-1hY6YpOYM6ayWAg5jDDYaYzOudismVIsYE2VBruhBejwj2H6hawkfQ_7veQU1JZGTidqco1i2RC4H3Doa2E-tZphqeHC3gUh_60fQiTkiTfpJDm4D51_l4BVQRLTpS5eGSjomq4X3u8Ted_tPdbQSp2wO4ulUBThOqTABIfP84G5BIgF9fLKlUySBQQIBBgBkgUECAUYBKAGLoAHtOas5ASoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCllx7SCBQIgGEQARgfMgKKAjoCgEBIvf3BOpoJigFodHRwczovL3VzLmZvYmx1ZS5jb20vZHNyP3E9aG9tZSUyMGJyb2FkYmFuZCZyYWM9U2VhcmNoJTIwZm9yJTIwaG9tZSUyMGJyb2FkYmFuZCZhc2lkPWZiX2NoMjA5Jm53PWQmZGU9YyZscGlkPTkwMDU1MzImcHViPXdpbmRvd3N0ZWNocy5jb22ACgHICwHaDBAKChCAtMGgo8SMpCYSAgEDuBPkA9gTDIgUAtAVAYAXAbIXHAoaCAASFHB1Yi01NTI0NDQ5MDQ1NjA5OTk0GAA&sigh=7bnmMkILLTc&uach_m=[UACH]&ase=2&nis=4&cid=CAQSGwDICaaNVM1isnLYgAfqABDam4X15bf7Hv6N-xgB&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x505d723a32d3a7c0000000000000000%22,%224%22:%220x86e811dfa9fc5ebf0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%228548739894537787213%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2218397843124970589889%22}&andc=true

Request Chain 145

https://px.owneriq.net/ecmg?google_gid=CAESEJLqfTSa9DDp_lPrRRfevyc&google_cver=1&google_push=AXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0BcpHYdLY8-fwXIcfc98g52_c965IRLl5YcF3GE1T-VqKdZNHTThMciGA0 HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0BcpHYdLY8-fwXIcfc98g52_c965IRLl5YcF3GE1T-VqKdZNHTThMciGA0%26google_cver%3d1%26google_gid%3dCAESEJLqfTSa9DDp_lPrRRfevyc%26google_hm%3dUTc0ODc2NTYzMjE2MjE4MDE0NzU%3d&uid=Q7487656321621801475&ref=%2Fecmg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0BcpHYdLY8-fwXIcfc98g52_c965IRLl5YcF3GE1T-VqKdZNHTThMciGA0&google_cver=1&google_gid=CAESEJLqfTSa9DDp_lPrRRfevyc&google_hm=UTc0ODc2NTYzMjE2MjE4MDE0NzU=

Request Chain 146

https://a.tribalfusion.com/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 147

https://s.uuidksinc.net/match/47/?remote_uid=CAESEAwV6HvTi1_cIShKn2VSh-o&c_param1=AXcoOmTx8I7J1_VQaqDQVJ3JYKWk1fZH3qjpmwJmTZgvG5rmMtMNvuuCftR72jhcDefo3IM-ahD0VrjDBbCxrcBSVz38OzMn4ResvdGZAMDcIdOe3D89af1-ut21qPRMdFmoD8i2caAanm5rDn1Pkch6w7R4I6g&gdpr=%%GDPR%%&addtl_consent=%%ADDTL_CONSENT%%&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTx8I7J1_VQaqDQVJ3JYKWk1fZH3qjpmwJmTZgvG5rmMtMNvuuCftR72jhcDefo3IM-ahD0VrjDBbCxrcBSVz38OzMn4ResvdGZAMDcIdOe3D89af1-ut21qPRMdFmoD8i2caAanm5rDn1Pkch6w7R4I6g

Request Chain 148

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEBwH7i3shtyjTI4UIli0H2g&google_cver=1&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4efDPUD8ZdkS6pu5XrfGGMoU9_7nmRVbDkcJDMZVjTnjdzyzaLzzRpHkZX3QlamDIxxbw2j3H6g HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEBwH7i3shtyjTI4UIli0H2g&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4efDPUD8ZdkS6pu5XrfGGMoU9_7nmRVbDkcJDMZVjTnjdzyzaLzzRpHkZX3QlamDIxxbw2j3H6g&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4efDPUD8ZdkS6pu5XrfGGMoU9_7nmRVbDkcJDMZVjTnjdzyzaLzzRpHkZX3QlamDIxxbw2j3H6g&google_hm=cEtQNFVtX3pPdTY2LTBvdHlyUEI=

Request Chain 149

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESELcT4zDyCCbmNJUd88p6jOg&google_cver=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr3pRGfmLu_BqGuT1DbNbzBmBXc0awRyjWcKUBWIDdALWs999CgoX4KiRb5DAg0aNy_apHn1puv3O97FfIVSwkHoIqhR HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESELcT4zDyCCbmNJUd88p6jOg&google_cver=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr3pRGfmLu_BqGuT1DbNbzBmBXc0awRyjWcKUBWIDdALWs999CgoX4KiRb5DAg0aNy_apHn1puv3O97FfIVSwkHoIqhR HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=MFNukGctTEKsXg6R3x7-3g==&no_redirect=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr3pRGfmLu_BqGuT1DbNbzBmBXc0awRyjWcKUBWIDdALWs999CgoX4KiRb5DAg0aNy_apHn1puv3O97FfIVSwkHoIqhR

Request Chain 150

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEHJ81Hifzsujrkkbej07qTg&google_cver=1&google_push=AXcoOmQKHfETUE_iT6lcDR74HUAEOKSebOJIz8q4RkLPPVMjCucsCmG1xPDNJEWnBgUx8F2LOSoe244RaCTAiAaN5htetRRa-aFPRWzniWHxJov9AiHIoZGVfHwZLDx9DCoyOQyFcUSTHJRWAEusHxk6ZA6yKViZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQKHfETUE_iT6lcDR74HUAEOKSebOJIz8q4RkLPPVMjCucsCmG1xPDNJEWnBgUx8F2LOSoe244RaCTAiAaN5htetRRa-aFPRWzniWHxJov9AiHIoZGVfHwZLDx9DCoyOQyFcUSTHJRWAEusHxk6ZA6yKViZ&google_hm=q4_MqugUQB2oxwRjL133RCM

Request Chain 151

https://trace.mediago.io/cs/google?google_gid=CAESEO2I3Ug4_47ZSU1Aw-CysSQ&google_cver=1&google_push=AXcoOmSCUMJ7C14r6yrXwi7qpU1d2kp8Iqjz5xp2ueTyBD76aNBKP4FWhhPiT6jz15PviOhoHZ8U9uQrMIncQJo58rDgqzIhJlGckjPAPS868PljAiEowwhPZGsKWjnVR1knjJtpbXFq0EMqTUwzlqb5AmclqJg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSCUMJ7C14r6yrXwi7qpU1d2kp8Iqjz5xp2ueTyBD76aNBKP4FWhhPiT6jz15PviOhoHZ8U9uQrMIncQJo58rDgqzIhJlGckjPAPS868PljAiEowwhPZGsKWjnVR1knjJtpbXFq0EMqTUwzlqb5AmclqJg&google_hm=199e3e9bfc4b278f11xv8n00lmw4k4s5

Request Chain 155

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESELt37Ll0Bo79v7uNnC1EHps&google_cver=1&google_push=AXcoOmRqgyjjx2b2QEb-tC7SeO5FrK6S3veKsiO3tnVO_8PdilkaSXYh8pjnvXQ7R5ukbrQ6jSDJo5MSQJ8Tr97ODpJNl72ddAY2og HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRqgyjjx2b2QEb-tC7SeO5FrK6S3veKsiO3tnVO_8PdilkaSXYh8pjnvXQ7R5ukbrQ6jSDJo5MSQJ8Tr97ODpJNl72ddAY2og

Request Chain 156

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmTiTrsaQVL0Ha3RjVaqTPO-4agwrKaqPG3BOgouF1GKhdYh3F1nUOWtdaDozXLybniIYXRmw4_mNVsFGihvQKLk-FAgXwhF HTTP 302
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmTiTrsaQVL0Ha3RjVaqTPO-4agwrKaqPG3BOgouF1GKhdYh3F1nUOWtdaDozXLybniIYXRmw4_mNVsFGihvQKLk-FAgXwhF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e

Request Chain 158

https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmSYif2FbKboRHHg8fHEsRlbwb1HKPkgKaRF_zwfFR51M3t81ccT3w_ex9yZjAGEtuZxsJgkHTvAYaMuNDTEoKBSZifC7e076yI&google_gid=CAESED6fTQJN5QDZpYDidJy3zWg&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESED6fTQJN5QDZpYDidJy3zWg&google_hm=T1BVNTNjNmM4NzY1YWU1NGE2ZWE1NWY3ODE1ZmYzMWJhNWE&google_nid=opera_norway_as&google_push=AXcoOmSYif2FbKboRHHg8fHEsRlbwb1HKPkgKaRF_zwfFR51M3t81ccT3w_ex9yZjAGEtuZxsJgkHTvAYaMuNDTEoKBSZifC7e076yI

Request Chain 159

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEFXPmzyUfYvWrdEZMRMoS0k&google_cver=1&google_push=AXcoOmTvmsKGQuy5X9u3xU2_jDk4GEHonS2crpTNohqluhGW9Ez-insSQvS9Kg7u3R176Q6qu3dTbHzRcEKyF5TG4J0gaZRc6A6o5g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=MDhmYjFlZjktNDgyNS00ZDMzLWEwNmQtMjAyMTE4YTM1NDRm&google_push=AXcoOmTvmsKGQuy5X9u3xU2_jDk4GEHonS2crpTNohqluhGW9Ez-insSQvS9Kg7u3R176Q6qu3dTbHzRcEKyF5TG4J0gaZRc6A6o5g HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 160

https://trace.mediago.io/cs/google?google_gid=CAESEO2I3Ug4_47ZSU1Aw-CysSQ&google_cver=1&google_push=AXcoOmQIJmZm6lhzbR-EqnsESQ5AzZMqinUrnI-U1QuvSbUOrcnye7GB_i3tgmLpHFqwaLm5DPq9Z5SNPqkrTBMdAGHG3dqE1Vmw6JU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQIJmZm6lhzbR-EqnsESQ5AzZMqinUrnI-U1QuvSbUOrcnye7GB_i3tgmLpHFqwaLm5DPq9Z5SNPqkrTBMdAGHG3dqE1Vmw6JU&google_hm=199e3e9bfc4b278f1n3km500lmw4k4s5

Request Chain 168

https://a.tribalfusion.com/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 169

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmRa1T7KYDTMu22mPyHz0Vs4NXy-bo3AsHCzKHZGRwkjiwFbjqmch3KAwI4T2HaDMTv3JEuKXlvYYzmI7IfqEi8Z96r0xwfVKxFY HTTP 302
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmRa1T7KYDTMu22mPyHz0Vs4NXy-bo3AsHCzKHZGRwkjiwFbjqmch3KAwI4T2HaDMTv3JEuKXlvYYzmI7IfqEi8Z96r0xwfVKxFY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e

Request Chain 172

https://an.yandex.ru/mapuid/google/CAESEDgV9_EYCDmP8AqP5Yvv71Y?ext-param=AXcoOmQHGG6wpqoyEfNSI3um08LxwW1NmCXFp_KIZ1e7Uhq7aPvLhstXDEK4VXskGn7YJmhEkHUDwhsWKwDrL_5cTAf1TFVNY1nmdHjC9g&partner-tag=yandex_ag&google_cver=1 HTTP 302
https://an.yandex.ru/mapuid/google/CAESEDgV9_EYCDmP8AqP5Yvv71Y?redir-setuniq=1&ext-param=AXcoOmQHGG6wpqoyEfNSI3um08LxwW1NmCXFp_KIZ1e7Uhq7aPvLhstXDEK4VXskGn7YJmhEkHUDwhsWKwDrL_5cTAf1TFVNY1nmdHjC9g&partner-tag=yandex_ag&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEDgV9_EYCDmP8AqP5Yvv71Y&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif HTTP 302
https://an.yandex.ru/resource/spacer.gif

Request Chain 173

https://trace.mediago.io/cs/google?google_gid=CAESEO2I3Ug4_47ZSU1Aw-CysSQ&google_cver=1&google_push=AXcoOmT679BmcFxWF8a6aPjC0JfYFs7U8c1pFhA86NcrthupVzDLjf5nCj7DWlQGBFqQWUjwNKp8ZinnFeg5LwoPiZNbjaiwCQzB4HJ5UQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmT679BmcFxWF8a6aPjC0JfYFs7U8c1pFhA86NcrthupVzDLjf5nCj7DWlQGBFqQWUjwNKp8ZinnFeg5LwoPiZNbjaiwCQzB4HJ5UQ&google_hm=199e3e9bfc4b278f1n3km500lmw4k4s5

Request Chain 177

https://googleads.g.doubleclick.net/pagead/adview?ai=CnRq3v_UOZb--N8PhxtYPx7qG4AuJl9OOc5zOwra-EZulx9jUPxABIM-1syhgye6Oi8CkjBCgAcj0xcYpyAEBqQKQR_ZHjPN4PqgDAcgDy4SAgASqBPcBT9CpK2jtI5SU3uruNSsdgxlsM-DxWRWFAMxbji0k_yxoNinmtm9lEFR4z25FX01oeoqk4pQghM3qqR3n2boU0CYKGbzbfXKhUTFb4MLWJtcCYEYQHLcOpTNenTCNSWP6QdeXRyNxFpg8cO2Z0ecjbrScKHHm5gXLWJgDdNS2i6ivHf3_f8SmwxENpVpvScr1PB7f2GZXEJUvjGSYEVSbzDp-nd4t_xYHl2Mfeckmt62Vkr1vRY450LZEHEm2QGMkVROu9T6ykMUJpPaNmj4I22pqwhLi-gfxSAgnZgEgo4AXCnbUqP7Msyt4vLtTtg8sSSFqc3n-RcAEoIr5uMEEiAWj_uueTJIFBAgEGAGSBQQIBRgEoAYCgAe67rLkBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEKXkBtIIFAiAYRABGB8yAooCOgKAQEi9_cE6mgmJAWh0dHBzOi8vdXMuZm9ibHVlLmNvbS9kcz9xPWJhdGglMjByZW1vZGVsJnJhYz1TZWFyY2glMjBmb3IlMjBiYXRoJTIwcmVtb2RlbCZhc2lkPWZvX2NoX2JhXzY4MyZudz1kJmRlPWMmbHBpZD05MDA1NTMyJnB1Yj13aW5kb3dzdGVjaHMuY29tgAoByAsB2gwQCgoQgMv-1ujdtPZuEgIBA9gTDIgUAdAVAYAXAbIXHAoaCAASFHB1Yi01NTI0NDQ5MDQ1NjA5OTk0GAA&sigh=Ed-_PWfJYoI&uach_m=[UACH]&ase=2&nis=4&cid=CAQSPABpAlJWrUT2E8qym9taFODrVCVw9f0waUcSDv-dz9cNBu8kqxIoQZ2T2MzaAYGkt_oTStIKIcT2O6JkYhgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x4f32fd3426edda2e0000000000000000%22,%224%22:%220x5c814367dae0836e0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%221953208686361328789%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216033081025340946257%22}&andc=true

Request Chain 179

https://googleads.g.doubleclick.net/pagead/adview?ai=CVY1Iv_UOZe-vN-PlvPIP5_ayEPyHvIBzlJ-HxfMQ2tkeEAEgz7WzKGDJ7o6LwKSMEKAB84_7qSnIAQmpAmExRh9x37E-qAMByAPLBKoEggJP0I6r3rqQNcH6aetLK07ayOyZ6-2VQpddkw6LdavpLiz6qim7ckfjuJv21AsnbdFQS2FH9G7y9UCcCZEj2R3h6LyDn1vIXWqCPV-jgHS4-IVbQQGm9XKvaUQfCwINjO7bn_pNC1Xluw92IabBz5I7dETpfPCCHc5aDva-jPPGZo2ihBP3EvXmGU9wHHoQMo5-Vu_YEEyGJRyR03T0Aruzx9NuYvhPUbmy8u5b04LdDDygS5-mPJPvz3KwOlwkOgJjvxDN9OJbQvlXAEMmuH5aekjPzOGkSAzougnYoNSjmigKodnKsBGsTAY9dPz33axCkijSF5B3jDqzQQrZBTGx0q_ABO_P4sekBIgF7bH41UmSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH88fLiQSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDsiwjSCBQIgGEQARgfMgKKAjoCgEBIvf3BOpoJ5wFodHRwczovL3VzLnNob2Zhc3QuY29tL2Rzcj9xPWNvbW1lcmNpYWwlMjByZWFsJTIwZXN0YXRlJTIwcG9ydGZvbGlvJTIwbWFuYWdlbWVudCUyMHNvZnR3YXJlJmFzaWQ9em13X2NoNDI4JmRlPWMmc2NsaWQ9MC0yNDAxNSZnY2xpZD17Z2NsaWR9JnJhYz1iZXN0JTIwY29tbWVyY2lhbCUyMHJlYWwlMjBlc3RhdGUlMjBwb3J0Zm9saW8lMjBtYW5hZ2VtZW50JTIwc29mdHdhcmUmbnc9ZCZsb2NhbGU9ZW5fVVOACgHICwHaDBAKChCQ1ZTzlvmE-x0SAgEDuBPkA9gTDIgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi01NTI0NDQ5MDQ1NjA5OTk0GAA&sigh=lPR0ZohNCMY&uach_m=[UACH]&ase=2&nis=4&cid=CAQSPABpAlJWBDZIzwp__T14zU8ocYJgT8C3dcZv39pvzhsCc7F-gr7mEgHq9F8Iwodo7nMB7WzeedT1T39TjxgB&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5dbdb48fa77e0000000000000000%22,%224%22:%220x103bb54aa01979b70000000000000000%22,%225%22:%220x8f58a660a6ff063b0000000000000000%22},%22debug_key%22:%2216903804563069940608%22,%22debug_reporting%22:true,%22destination%22:%22https://shofast.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093854195%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216994729001637751905%22}&andc=true

Request Chain 181

https://googleads.g.doubleclick.net/pagead/adview?ai=Cdalbv_UOZdbENsHEvPIP67eGyAX8h7yAc5Sfh8XzENrZHhABIM-1syhgye6Oi8CkjBCgAfOP-6kpyAEJqQJhMUYfcd-xPqgDAcgDywSqBIICT9C4vMyOD4VBlDL9vlkCZy0-mLmIxh-8hmJcZYueM9l-pm8ZjvOsBnVn8pMQIOmJAVIMOCkwK21clchUbggJjbFghGZkpiOk0igUgscVVOw9T-GDKwaQJRC3BymclV7jHJJKLwXP-L-CUyRLrCWUJJewt_CwZIew9H_EU1DtULAuHzoFIUL9qhUScDzmkkuZhXvpAHehGGASgZn2usnQR5CodJKe1o-9CZlwUsMbbMPwsKJ7jUxpGr5FWO2WV72yUQ-NEJiVdxMfDf-OfrjQy5xiqXWgL0CpDEuH09lovqEarU17IGGzkZL1QiP5CMV8wtf_5rYxQdvjcFUseBViLmF4wATvz-LHpASIBe2x-NVJkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB_PHy4kEqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQ8oEE0ggUCIBhEAEYHzICigI6AoBASL39wTqaCecBaHR0cHM6Ly91cy5zaG9mYXN0LmNvbS9kc3I_cT1jb21tZXJjaWFsJTIwcmVhbCUyMGVzdGF0ZSUyMHBvcnRmb2xpbyUyMG1hbmFnZW1lbnQlMjBzb2Z0d2FyZSZhc2lkPXptd19jaDQyOCZkZT1jJnNjbGlkPTAtMjQwMTUmZ2NsaWQ9e2djbGlkfSZyYWM9YmVzdCUyMGNvbW1lcmNpYWwlMjByZWFsJTIwZXN0YXRlJTIwcG9ydGZvbGlvJTIwbWFuYWdlbWVudCUyMHNvZnR3YXJlJm53PWQmbG9jYWxlPWVuX1VTgAoByAsB2gwRCgsQoIDCz_GAmN6jARICAQO4E-QD2BMMiBQB0BUBmBYBgBcBshccChoIABIUcHViLTU1MjQ0NDkwNDU2MDk5OTQYAA&sigh=M8CoYy7KKr0&uach_m=[UACH]&ase=2&nis=4&cid=CAQSPABpAlJWqapSdMJNQoKVplUGaB1LBKqcFA0V1JBy3UU9zeaYa8V4wEcjL-rAUUhL-LAdVqL_3_NgljOJ7xgB&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5dbdb48fa77e0000000000000000%22,%224%22:%220x103bb54aa01979b70000000000000000%22,%225%22:%220x8f58a660a6ff063b0000000000000000%22},%22debug_key%22:%222152282685287216271%22,%22debug_reporting%22:true,%22destination%22:%22https://shofast.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093854195%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225424252820824690177%22}&andc=true

179 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
windowstechs.com/wp/index.php/tag/browser-hijacker/ 93 KB
93 KB 832ms
762ms Document
text/html 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 325454ac963cd976e55a14bdf3ce6358604ec1dbb2ce06cac64582ef2a8fbebb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:09 GMT
link: <https://windowstechs.com/wp/index.php/wp-json/>; rel="https://api.w.org/", <https://windowstechs.com/wp/index.php/wp-json/wp/v2/tags/24481>; rel="alternate"; type="application/json"
server: Apache

GET
H2 200 style.min.css
windowstechs.com/wp/wp-includes/css/dist/block-library/ 102 KB
102 KB 60ms
54ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-includes/css/dist/block-library/style.min.css?ver=6.3.1
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Wed, 19 Jul 2023 20:43:56 GMT
server: Apache
accept-ranges: bytes
content-length: 104484
content-type: text/css

GET
H2 200 a11y-toolbar.css
windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/fonts/css/ 814 B
867 B 92ms
86ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/fonts/css/a11y-toolbar.css?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: c4a15659b80c847cd26a45a5a94e9841b01f4b14f80cb4b173c9f2e4973f5bab

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 814
content-type: text/css

GET
H2 200 a11y.css
windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/css/ 3 KB
3 KB 93ms
86ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/css/a11y.css?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: da01907e24efa9fc8c829e78b8f8f5547a3a6f4b073b6f3a4dfb624a388558d0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 3107
content-type: text/css

GET
H2 200 a11y-fontsize.css
windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/css/ 740 B
770 B 95ms
89ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/css/a11y-fontsize.css?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: b0d850c9769da596686b6f4b2778d9fa0b6ea9308de03853a5e53520e08fa1c5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 740
content-type: text/css

GET
H2 200 wpa-style.css
windowstechs.com/wp/wp-content/plugins/wp-accessibility/css/ 5 KB
5 KB 93ms
87ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/css/wpa-style.css?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 13031d4ec04980984b56e9152739c608e15fcda23007e524117198f054385eb6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 5217
content-type: text/css

GET
H2 200 genericons.css
windowstechs.com/wp/wp-content/themes/catch-box/genericons/ 28 KB
28 KB 92ms
86ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/genericons/genericons.css?ver=3.4.1
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 10 Dec 2020 08:10:50 GMT
server: Apache
accept-ranges: bytes
content-length: 28266
content-type: text/css

GET
H2 200 style.css
windowstechs.com/wp/wp-content/themes/catch-box/ 87 KB
87 KB 94ms
88ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/style.css?ver=20220608-122046
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 8e4c9716b25cf832b1d2ce7e4fea29b42980469edc763f31e79eac27bd0a429d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Wed, 08 Jun 2022 12:20:46 GMT
server: Apache
accept-ranges: bytes
content-length: 89474
content-type: text/css

GET
H2 200 blocks.css
windowstechs.com/wp/wp-content/themes/catch-box/css/ 10 KB
10 KB 95ms
89ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/css/blocks.css?ver=1.0
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 95963adb7571430676dc2c03206c0d61abc639cf0d1365d4fddf72318e763ee2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 10 Dec 2020 08:10:50 GMT
server: Apache
accept-ranges: bytes
content-length: 10245
content-type: text/css

GET
H2 200 blue.css
windowstechs.com/wp/wp-content/themes/catch-box/colors/ 3 KB
3 KB 94ms
88ms Stylesheet
text/css 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/colors/blue.css
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: d9fdede283adf8e099526246143b63748b216083d702b586fd645f0cf5d18aae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 10 Dec 2020 08:10:50 GMT
server: Apache
accept-ranges: bytes
content-length: 3067
content-type: text/css

GET
H2 200 jquery.min.js Show response
windowstechs.com/wp/wp-includes/js/jquery/ 85 KB
86 KB 95ms
89ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-includes/js/jquery/jquery.min.js?ver=3.7.0
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Fri, 26 May 2023 21:03:36 GMT
server: Apache
accept-ranges: bytes
content-length: 87482
content-type: application/javascript

GET
H2 200 jquery-migrate.min.js Show response
windowstechs.com/wp/wp-includes/js/jquery/ 13 KB
13 KB 125ms
119ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Fri, 09 Jun 2023 15:19:24 GMT
server: Apache
accept-ranges: bytes
content-length: 13577
content-type: application/javascript

GET
H2 200 menu.min.js Show response
windowstechs.com/wp/wp-content/themes/catch-box/js/ 4 KB
4 KB 123ms
118ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/js/menu.min.js?ver=2.1.1.1
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 325162e216f8db34e9275889cd5efbd4901bd975b2a2ef0aee0407a2ba5978ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Sun, 06 Feb 2022 07:09:10 GMT
server: Apache
accept-ranges: bytes
content-length: 4219
content-type: application/javascript

GET
H2 200 html5.min.js Show response
windowstechs.com/wp/wp-content/themes/catch-box/js/ 3 KB
3 KB 124ms
119ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/js/html5.min.js?ver=3.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: e87bcce4761b410d32df511bc602a89913a89bf460d121a7736175817d57552a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 10 Dec 2020 08:10:50 GMT
server: Apache
accept-ranges: bytes
content-length: 2639
content-type: application/javascript

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
50 KB 127ms
60ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53e5efbe2e24d4fb36be193ba451e8b1d5ed9e12d2d3368800d16b0979defddc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51160
x-xss-protection: 0
server: cafe
etag: 83113654909353843
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:10 GMT

GET
BLOB 200
OK 3183465a-23e3-420d-8244-1486f1b381d6
https://windowstechs.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://windowstechs.com/3183465a-23e3-420d-8244-1486f1b381d6
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 status.gif
isc.sans.edu/images/ 9 KB
10 KB 107ms
50ms Image
image/gif 45.60.31.34
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://isc.sans.edu/images/status.gif

Requested by

Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.31.34 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nc -l -p 80 /

Resource Hash

c70bf511d04c83aabcf124f35a69beff663f31dcfef25365851beffcb06ae849

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:09 GMT
strict-transport-security: max-age=31556926; includeSubDomains
x-content-type-options: nosniff
x-cdn: Imperva
x-iinfo: 13-94002943-0 0CNN RT(1695479229477 53) q(0 -1 -1 -1) r(0 -1)
permitted-cross-domain-policies: none
x-heyjason: DEV522 rocks
content-length: 9005
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sat, 23 Sep 2023 14:08:54 GMT
server: nc -l -p 80
etag: "232d-6060743f5afac"
expect-ct: max-age=0, report-uri="https://isc.sans.edu/cspreport.html"
x-frame-options: SAMEORIGIN
content-type: image/gif
x-do-not-hack: 18 U.S.C. Parag 1030
cache-control: max-age=183, public
x-incap-sess-cookie-hdr: iQTTLcBD7j++Enpl5hFKFL31DmUAAAAA40lZrXdh7qV+MU8zpTnRbQ==
expires: Sat, 23 Sep 2023 14:30:12 GMT

GET
H2 200 wpa-toolbar.js Show response
windowstechs.com/wp/wp-content/plugins/wp-accessibility/js/ 2 KB
2 KB 35ms
35ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/js/wpa-toolbar.js?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 3db59e4fb00b04d1da0ea32f6ff0191aae083a130976f10420db8a40121a912e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 1698
content-type: application/javascript

GET
H2 200 a11y.js Show response
windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/js/ 3 KB
3 KB 35ms
35ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/js/a11y.js?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: cb8068c7715e850b7694c9ffbaab85b5fa9625ec627925d840c47f0b7089423f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 3481
content-type: application/javascript

GET
H2 200 skip-link-focus-fix.js Show response
windowstechs.com/wp/wp-content/themes/catch-box/js/ 1 KB
1 KB 37ms
36ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/js/skip-link-focus-fix.js?ver=20151112
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 66c48dc6be21195324a58b3fb2e2aeb740f1d226a44e926e8c074e029a307013

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 10 Dec 2020 08:10:50 GMT
server: Apache
accept-ranges: bytes
content-length: 1058
content-type: application/javascript

GET
H2 200 catchbox-scrollup.min.js Show response
windowstechs.com/wp/wp-content/themes/catch-box/js/ 327 B
357 B 35ms
34ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/js/catchbox-scrollup.min.js?ver=20072014
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 4cf80393593908e0a01168329e38e06fdd547e13f09c31aa223859adbddbc57c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Sun, 06 Feb 2022 07:09:10 GMT
server: Apache
accept-ranges: bytes
content-length: 327
content-type: application/javascript

GET
H2 200 wp-accessibility.js Show response
windowstechs.com/wp/wp-content/plugins/wp-accessibility/js/ 11 KB
11 KB 36ms
35ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/js/wp-accessibility.js?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 88a7f2522dd8c93c1f5007fcbcd059cff32a895cdab67e4d0398e94e950fbb65

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 11296
content-type: application/javascript

GET
H2 200 longdesc.button.js Show response
windowstechs.com/wp/wp-content/plugins/wp-accessibility/js/ 3 KB
3 KB 35ms
34ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/js/longdesc.button.js?ver=1.7.3
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 05c78d6a2624f38e659dfad31d402bbda31897361e2ea1a4ef04bd1e78d41b85

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 3322
content-type: application/javascript

GET
H2 200 windowstechs.jpg
windowstechs.com/wp/wp-content/uploads/2016/03/ 50 KB
50 KB 34ms
34ms Image
image/jpeg 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowstechs.com/wp/wp-content/uploads/2016/03/windowstechs.jpg
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 09c928c408b72a989d0252eb8a238c26a38cebd22443994f15a3026667a501f1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 03 Mar 2016 11:51:15 GMT
server: Apache
accept-ranges: bytes
content-length: 50751
content-type: image/jpeg

GET
H2 200 social-profiles.png
windowstechs.com/wp/wp-content/themes/catch-box/images/ 16 KB
16 KB 35ms
35ms Image
image/png 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowstechs.com/wp/wp-content/themes/catch-box/images/social-profiles.png
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/wp-content/themes/catch-box/style.css?ver=20220608-122046
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: e369d799b14f365dc7a0ce6d5a3a392e4260ecf38361d50253376cb8fd3b2308

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/wp-content/themes/catch-box/style.css?ver=20220608-122046
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 10 Dec 2020 08:10:50 GMT
server: Apache
accept-ranges: bytes
content-length: 16048
content-type: image/png

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer
Origin: https://windowstechs.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 a11y.woff2
windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/fonts/css/ 752 B
791 B 35ms
34ms Font
font/woff2 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/fonts/css/a11y.woff2
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/fonts/css/a11y-toolbar.css?ver=1.7.3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 463774833c268778806c2cbd8d297898d4fa0c9f2e55fde71b9a2b6c57c8ec50

Request headers

Referer: https://windowstechs.com/wp/wp-content/plugins/wp-accessibility/toolbar/fonts/css/a11y-toolbar.css?ver=1.7.3
Origin: https://windowstechs.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Tue, 13 Dec 2022 00:32:18 GMT
server: Apache
accept-ranges: bytes
content-length: 752
content-type: font/woff2

GET
H2 200 wp-emoji-release.min.js Show response
windowstechs.com/wp/wp-includes/js/ 18 KB
18 KB 35ms
34ms Script
application/javascript 173.233.67.178
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://windowstechs.com/wp/wp-includes/js/wp-emoji-release.min.js?ver=6.3.1
Requested by: Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.233.67.178 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: webserver77.turnkeywebspace.com
Software: Apache /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/wp/index.php/tag/browser-hijacker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
last-modified: Thu, 02 Feb 2023 11:23:26 GMT
server: Apache
accept-ranges: bytes
content-length: 18692
content-type: application/javascript

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/ 379 KB
129 KB 68ms
68ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b656e989df5b75f36afbfbbaa2fc08931e8a1e479919434fed98c19924d4bd0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131521
x-xss-protection: 0
server: cafe
etag: 12863493719349462274
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:10 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/ Frame 26E6 10 KB
5 KB 33ms
32ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 26403
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 07:07:07 GMT
etag: 2603938475786422795
expires: Sat, 07 Oct 2023 07:07:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 399 B
610 B 108ms
42ms Script
text/javascript 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=windowstechs.com&callback=_gfp_s_&client=ca-pub-5524449045609994

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15325855b803d62fa5f7dd35c0919f350e3befcc5853f3d9099a7046ace201ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 258
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 28A8 606 KB
109 KB 1032ms
1031ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&adk=1812271804&adf=3025194257&lmt=1695515230&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x540_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479230562&bpp=16&bdt=339&idt=135&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8452531300305&frm=20&pv=2&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=160

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b51f36642966599b936bc845f88be80f6a6e45bbb6a43abd0c01ed06950bdfd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 111997
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:11 GMT
expires: Sat, 23 Sep 2023 14:27:11 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DEDA 105 KB
36 KB 712ms
712ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=280&adk=3796677708&adf=3474651343&pi=t.aa~a.1829178219~rp.4&w=1000&fwrn=4&fwrnh=100&lmt=1695515230&rafmt=1&to=qs&pwprc=2062561900&format=1000x280&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479230578&bpp=2&bdt=355&idt=147&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=169&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=j4zzxHlsrx&p=https%3A//windowstechs.com&dtd=151

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfcef2f50cfc9b946213c69d1ef23e23a59a3634f89fff32437523104d8be4fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 37088
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:11 GMT
expires: Sat, 23 Sep 2023 14:27:11 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame DEDA 4 KB
1 KB 109ms
44ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=280&adk=3796677708&adf=3474651343&pi=t.aa~a.1829178219~rp.4&w=1000&fwrn=4&fwrnh=100&lmt=1695515230&rafmt=1&to=qs&pwprc=2062561900&format=1000x280&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479230578&bpp=2&bdt=355&idt=147&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=169&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=j4zzxHlsrx&p=https%3A//windowstechs.com&dtd=151

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 12:31:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:11 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame DEDA 2 KB
973 B 128ms
61ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19902
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame DEDA 23 KB
9 KB 101ms
36ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame DEDA 3 KB
1 KB 106ms
41ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame DEDA 20 KB
8 KB 97ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75595
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/11535717371302319742/ Frame DEDA 157 KB
157 KB 127ms
63ms Image
image/jpeg 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11535717371302319742/14763004658117789537

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba6d8a3edb6fd7fcefbafd89c57b33e887f13fee69bfa87af416703498570852

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:11 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 160396
x-xss-protection: 0
last-modified: Fri, 18 Aug 2023 14:39:38 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 14:27:11 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/431453808489595836/ Frame DEDA 3 KB
3 KB 125ms
61ms Image
image/png 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/431453808489595836/14763004658117789537?w=100&h=100

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c4c167e0f4ff33820b6559de30b9adc0e9d196db6a0beb599725687d5229134

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 11:24:21 GMT
x-content-type-options: nosniff
age: 97370
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2987
x-xss-protection: 0
last-modified: Wed, 02 Aug 2023 07:25:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 21 Sep 2024 11:24:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DEDA 182 KB
57 KB 104ms
35ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:11 GMT

GET
H2 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame DEDA 36 KB
15 KB 102ms
33ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117847
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
DATA 200
OK truncated
/ Frame DEDA 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 732e8278fb82d947d82912b17919dc7c5a569317860b7c7380b2b025fc029efe

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame DEDA 16 KB
16 KB 100ms
34ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 10:26:49 GMT
x-content-type-options: nosniff
age: 14422
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 10:26:49 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame DEDA 15 KB
15 KB 110ms
46ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:44:41 GMT
x-content-type-options: nosniff
age: 74550
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 17:44:41 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame DEDA
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C4gCEvvUOZZTkLsi2NZzzmvgMkq_Sj3PcxsK2vhGbpcfY1D8QASDPtbMoYMnujovApIwQoAHI9MXGKcgBCakCkEf2R4zzeD6oAwHIA8sEqgT4AU_Qy6tnyiA5oS0VKawv2U6EULtNLu2YZV4...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x676ab9...

0
0

114ms
47ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x676ab9e61643bb450000000000000000%22,%224%22:%220x2aaf4e76d8d7c3630000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%225644644656995116759%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216109780286879077825%22}&andc=true

Requested by

Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0x5edafad330b6ce9d0000000000000000","3":"0x676ab9e61643bb450000000000000000","4":"0x2aaf4e76d8d7c3630000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"5644644656995116759","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"16109780286879077825"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 23 Sep 2023 14:27:12 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 23 Sep 2023 14:27:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0x5edafad330b6ce9d0000000000000000","3":"0x676ab9e61643bb450000000000000000","4":"0x2aaf4e76d8d7c3630000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"5644644656995116759","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"16109780286879077825"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 469C 37 KB
14 KB 77ms
76ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243897
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 117ms
48ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 110ms
47ms XHR
application/json 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230920&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

391924fc2a29211c7905288b19ffec92326ed492e014eb14a05f40078a224307

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12025
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/ 154 KB
52 KB 61ms
61ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3dcff6754ca06a924cb07278d75876cd327e1d9d34e747dc89e68763b6714a5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53706
x-xss-protection: 0
server: cafe
etag: 13655905228227063584
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:11 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5119 107 KB
38 KB 632ms
631ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=250&adk=3990647781&adf=2778194034&pi=t.aa~a.749167770~rp.4&w=320&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=320x250&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280&nras=3&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=330&ady=1403&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=ZgJTXIdXA0&p=https%3A//windowstechs.com&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d7a8cca7b95aa4b5904e68166f93ee84356f964248d1ebfcca66518706aaf35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 39355
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:12 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3FE7 101 KB
39 KB 595ms
595ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=600&adk=2053324183&adf=1379365821&pi=t.aa~a.1287707200~rp.2&w=300&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=300x600&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1629&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250&nras=4&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=340&ady=1703&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=qIVdPYycIC&p=https%3A//windowstechs.com&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

33e2d1c754114357ff845782989f54c8a2107ab50a95395296db047d115bef11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 40029
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:12 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 91EE 109 KB
38 KB 668ms
667ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=200&adk=3332155356&adf=1835424514&pi=t.aa~a.1779471494~rp.1&w=590&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=590x200&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250%2C300x600&nras=5&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=680&ady=4234&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=hHl5PAVTYW&p=https%3A//windowstechs.com&dtd=18

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90cde8f1e3bef4f2ffed183ce33524190c7ad59894a6d50746b29e46904ee960

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 39169
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:12 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 35ms
35ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 23 Sep 2023 14:27:11 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/ Frame 02E6 10 KB
4 KB 33ms
32ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 27767
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 06:44:24 GMT
etag: 2603938475786422795
expires: Sat, 07 Oct 2023 06:44:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/ Frame 7FAE 10 KB
4 KB 32ms
32ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 27767
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 06:44:24 GMT
etag: 2603938475786422795
expires: Sat, 07 Oct 2023 06:44:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/ Frame F3C9 10 KB
4 KB 31ms
31ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 27767
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 06:44:24 GMT
etag: 2603938475786422795
expires: Sat, 07 Oct 2023 06:44:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/ Frame 28AA 10 KB
4 KB 32ms
32ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 27767
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 06:44:24 GMT
etag: 2603938475786422795
expires: Sat, 07 Oct 2023 06:44:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 02E6 4 KB
767 B 43ms
42ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 13:43:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 02E6 205 B
519 B 34ms
32ms Image
image/png 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:38:13 GMT
x-content-type-options: nosniff
age: 53339
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 21 Sep 2024 23:38:13 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 02E6 604 B
696 B 34ms
33ms Image
image/png 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:55:55 GMT
x-content-type-options: nosniff
age: 117077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 21 Sep 2024 05:55:55 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/elements/html/ Frame 02E6 15 KB
6 KB 34ms
34ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6ece8077c8a8d8d057b5a03c892dcf1fed9da76ff1bc964cd17416008752c48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6551
x-xss-protection: 0
server: cafe
etag: 511223485441000916
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/elements/html/ Frame 02E6 20 KB
8 KB 35ms
34ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd91080d2c7f2120ad82727f5c07bbb439b810ed4035993ddb1825ca1611396b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 22:16:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58257
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8566
x-xss-protection: 0
server: cafe
etag: 5625731030761120726
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 22:16:15 GMT

GET
H2 200 2ab36c0d951b69d9c04f85f5eb613648.js Show response
www.gstatic.com/mysidia/ Frame 7FAE 9 KB
4 KB 37ms
37ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/2ab36c0d951b69d9c04f85f5eb613648.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f36c6941b3a0b755df6e1c1ba6919dc8eeab051a52504ff431c3564d4d791a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:53:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117239
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3933
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 20:01:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:53:13 GMT

GET
H2 200 d25b659b0dd7add20d23ec95887fd393.js Show response
www.gstatic.com/mysidia/ Frame 7FAE 11 KB
5 KB 33ms
33ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d25b659b0dd7add20d23ec95887fd393.js?tag=text/vanilla_highlight_ms_cta_adjustment

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bd90a11f15a6e28af278037393b9041e3d8489a317f18baf60ac3c9b21c5fcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117237
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4877
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:53:15 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7FAE 14 KB
1 KB 44ms
42ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 12:49:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7FAE 2 KB
892 B 52ms
50ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 7FAE 23 KB
9 KB 36ms
34ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7FAE 3 KB
1 KB 52ms
50ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7FAE 20 KB
8 KB 36ms
35ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7FAE 182 KB
57 KB 55ms
54ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H2 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame 7FAE 36 KB
15 KB 36ms
34ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F3C9 6 KB
779 B 42ms
42ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 12:32:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame F3C9 2 KB
892 B 45ms
45ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame F3C9 23 KB
9 KB 45ms
44ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame F3C9 3 KB
1 KB 44ms
44ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame F3C9 20 KB
8 KB 36ms
35ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F3C9 182 KB
57 KB 65ms
65ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H2 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame F3C9 36 KB
15 KB 35ms
35ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 28AA 14 KB
1 KB 44ms
43ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 12:33:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 28AA 2 KB
892 B 50ms
50ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 28AA 23 KB
9 KB 48ms
48ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 28AA 3 KB
1 KB 53ms
52ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 28AA 20 KB
8 KB 34ms
34ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 28AA 182 KB
57 KB 73ms
70ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H2 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame 28AA 36 KB
15 KB 36ms
32ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2CE4 13 KB
5 KB 35ms
33ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 6491
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 12:39:01 GMT
expires: Sun, 22 Sep 2024 12:39:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D95C 829 B
1 KB 113ms
46ms Document
text/html 2607:f8b0:4004:c06::68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9f9cdf06fd1e1647c1f32abf021a37203153bf79a045505395699d306e44485e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-e1aDOHj8HVKGrJn4OYMSuw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://windowstechs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-e1aDOHj8HVKGrJn4OYMSuw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:12 GMT
expires: Sat, 23 Sep 2023 14:27:12 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/16639438049605084452/ Frame 28AA 12 KB
12 KB 44ms
43ms Image
image/jpeg 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16639438049605084452/14763004658117789537?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2398bec8a5b55282871253c7e6f1bd567df237f71378ffa140000707af4831b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 07:38:25 GMT
x-content-type-options: nosniff
age: 24527
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11785
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 15:03:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 07:38:25 GMT

GET
DATA 200
OK truncated
/ Frame 28AA 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 00526e46a0cd4e0849012e53b5a9a2d003af41042d22f7cd4d6e2aaeb38577fd

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 28AA 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 0293 2 KB
892 B 32ms
31ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 0293 23 KB
9 KB 35ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 0293 3 KB
1 KB 38ms
35ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 0293 20 KB
8 KB 36ms
33ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0293 182 KB
57 KB 38ms
36ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame 0293 36 KB
15 KB 35ms
32ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A227 143 B
166 B 35ms
35ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1352
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:04:40 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 28AA 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d0c70f5970df0a88d335f99c0e5ce8643b8ecfd80497fd75fbfbe0415256c160

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 2076313506083323656
tpc.googlesyndication.com/simgad/16639438049605084452/ Frame F3C9 24 KB
25 KB 35ms
34ms Image
image/jpeg 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16639438049605084452/2076313506083323656

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1e17df928189d2fa8e41972d71e4b2c73a647f2cb2f5c304f333e52ff52dcde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:12:18 GMT
x-content-type-options: nosniff
age: 894
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25061
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 15:02:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 14:12:18 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/10025833206713060003/ Frame F3C9 3 KB
3 KB 34ms
33ms Image
image/png 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10025833206713060003/14763004658117789537?w=100&h=100

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d54b6c574ebf7edab9aeca0e9cc534879d93deef8f7de976a199bd92161e203

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:57:24 GMT
x-content-type-options: nosniff
age: 26988
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2804
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 15:03:15 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 06:57:24 GMT

GET
DATA 200
OK truncated
/ Frame F3C9 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame F3C9 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60dc36009f91fd4cb061954cbd64c6fb7ba5f31fc9dee0cadc7ebab61219dd2d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame 2CE4 37 KB
14 KB 32ms
32ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 02:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41849
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 22 Sep 2024 02:49:43 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 28AA
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C13OtvvUOZbqoLoiK_gSkh52YB73yrtpyjte_peIR1_yr4pUOEAEgz7WzKGDJ7o6LwKSMEKAByPTFxinIAQmpApBH9keM83g-qAMByAPLBKoE-AFP0OwJGjh-VZox_e6BwFm2wrGRMlmvXMl...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x8925d4...

0
0

51ms
48ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x8925d48e1ae1c6e80000000000000000%22,%224%22:%220xae0efa9e8299e94a0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%2216121160698027789128%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213148832468189437777%22}&andc=true

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0xa663210dc873fdf40000000000000000","3":"0x8925d48e1ae1c6e80000000000000000","4":"0xae0efa9e8299e94a0000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"16121160698027789128","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"13148832468189437777"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 23 Sep 2023 14:27:12 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0xa663210dc873fdf40000000000000000","3":"0x8925d48e1ae1c6e80000000000000000","4":"0xae0efa9e8299e94a0000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"16121160698027789128","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"13148832468189437777"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 60B8 37 KB
14 KB 32ms
32ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A227
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

41ms
40ms

Document
text/html

2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:12 GMT
expires: Sat, 23 Sep 2023 14:27:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 14:27:12 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 9FAB 37 KB
14 KB 32ms
31ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame F3C9
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CtprIvvUOZbmoLoiK_gSkh52YB8n8r9ty6Ijv7LoRw-Tz_QgQASDPtbMoYMnujovApIwQoAHI9MXGKcgBCakCkEf2R4zzeD6oAwHIA8sEqgT0AU_QX1gm05yIP3Elnz58U_08WfyIEfQsAWY...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x505d72...

0
0

50ms
48ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x505d723a32d3a7c0000000000000000%22,%224%22:%220x86e811dfa9fc5ebf0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%228548739894537787213%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2218397843124970589889%22}&andc=true

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0xa663210dc873fdf40000000000000000","3":"0x505d723a32d3a7c0000000000000000","4":"0x86e811dfa9fc5ebf0000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"8548739894537787213","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"18397843124970589889"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 23 Sep 2023 14:27:12 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0xa663210dc873fdf40000000000000000","3":"0x505d723a32d3a7c0000000000000000","4":"0x86e811dfa9fc5ebf0000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"8548739894537787213","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"18397843124970589889"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D95C 0
0 48ms
47ms Image
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230920&jk=2783619924376527&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 4316 37 KB
14 KB 34ms
33ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 3345 37 KB
14 KB 34ms
34ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: windowstechs.com
URL: https://windowstechs.com/wp/index.php/tag/browser-hijacker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 47ms
47ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 47ms
46ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220xa663210dc873fdf40000000000000000%22,%223%22:%220x505d723a32d3a7c0000000000000000%22,%224%22:%220x86e811dfa9fc5ebf0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%228548739894537787213%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2218397843124970589889%22}&andc=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 3FE7 2 KB
892 B 32ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=600&adk=2053324183&adf=1379365821&pi=t.aa~a.1287707200~rp.2&w=300&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=300x600&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1629&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250&nras=4&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=340&ady=1703&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=qIVdPYycIC&p=https%3A//windowstechs.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 3FE7 23 KB
9 KB 33ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 3FE7 3 KB
1 KB 32ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 3FE7 20 KB
8 KB 33ms
33ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3FE7 0
0 47ms
46ms Image
text/html 2607:f8b0:4004:c06::68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT2tpPOkXPBklEPMxPQGd8ljOQ20nKGcTxS_ngf4pGGbdXd4pOXS8J0O9cl_6BmlxKrp3ABTipbEmPS8_egbVQ5tfqpQQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=600&adk=2053324183&adf=1379365821&pi=t.aa~a.1287707200~rp.2&w=300&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=300x600&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1629&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250&nras=4&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=340&ady=1703&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=qIVdPYycIC&p=https%3A//windowstechs.com&dtd=14
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3FE7 182 KB
57 KB 37ms
36ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame 3FE7 36 KB
15 KB 33ms
33ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 5119 6 KB
706 B 48ms
47ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=250&adk=3990647781&adf=2778194034&pi=t.aa~a.749167770~rp.4&w=320&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=320x250&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280&nras=3&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=330&ady=1403&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=ZgJTXIdXA0&p=https%3A//windowstechs.com&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 12:29:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 5119 2 KB
892 B 32ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 5119 23 KB
9 KB 33ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 5119 3 KB
1 KB 34ms
33ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 5119 20 KB
8 KB 33ms
33ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5119 0
0 45ms
44ms Image
text/html 2607:f8b0:4004:c06::68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ7C018ITXMZBqNX6R1wsK9Pj_4muz4570BTzwj1avLo4gB31Gh_ErZNF-hYNcEaVU0lOMdOqNB4KzGMdDt7tSw7Krw9A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=250&adk=3990647781&adf=2778194034&pi=t.aa~a.749167770~rp.4&w=320&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=320x250&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280&nras=3&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=330&ady=1403&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=ZgJTXIdXA0&p=https%3A//windowstechs.com&dtd=6
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5119 182 KB
57 KB 40ms
39ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame 5119 36 KB
15 KB 35ms
34ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5149 1 KB
643 B 32ms
32ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 82086
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Sep 2023 15:39:06 GMT
etag: 48472445140208031
expires: Sat, 23 Sep 2023 15:39:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 31A9 1 KB
643 B 34ms
33ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 82086
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Sep 2023 15:39:06 GMT
etag: 48472445140208031
expires: Sat, 23 Sep 2023 15:39:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 91EE 4 KB
655 B 44ms
43ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=200&adk=3332155356&adf=1835424514&pi=t.aa~a.1779471494~rp.1&w=590&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=590x200&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250%2C300x600&nras=5&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=680&ady=4234&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=hHl5PAVTYW&p=https%3A//windowstechs.com&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Sep 2023 12:36:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 91EE 2 KB
892 B 34ms
34ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 08:55:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 08:55:29 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 91EE 23 KB
9 KB 35ms
33ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 91EE 3 KB
1 KB 37ms
35ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 06:44:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 07 Oct 2023 06:44:12 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 91EE 20 KB
8 KB 33ms
32ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 06 Oct 2023 17:27:16 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 91EE 0
0 47ms
44ms Image
text/html 2607:f8b0:4004:c06::68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRwWgDOr5E3vDukEl-5547SW4S8z22AAFk5exDkSXmrr-QzmlDpOGpj9hd-c5M9iYsL8qKmLFEMbdgsFXkv1eLwfhLnnA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=200&adk=3332155356&adf=1835424514&pi=t.aa~a.1779471494~rp.1&w=590&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=590x200&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250%2C300x600&nras=5&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=680&ady=4234&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=hHl5PAVTYW&p=https%3A//windowstechs.com&dtd=18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c06::68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 91EE 182 KB
57 KB 41ms
38ms Script
text/javascript 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9c , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 14:27:12 GMT

GET
H3 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame 91EE 36 KB
15 KB 36ms
33ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 05:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Dec 2023 05:43:04 GMT

GET
H3 200 8572588318216509527
tpc.googlesyndication.com/simgad/15410830595887015707/ Frame 5119 16 KB
16 KB 40ms
40ms Image
image/jpeg 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15410830595887015707/8572588318216509527?w=400&h=209

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48b656cd93739af0e39aa7e918f886f0376b9eb0d103f031cff4ec7879035c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16005
x-xss-protection: 0
last-modified: Mon, 21 Aug 2023 18:52:32 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 14:27:12 GMT

GET
DATA 200
OK truncated
/ Frame 5119 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 2178668043868567083
tpc.googlesyndication.com/daca_images/simgad/ Frame 3FE7 27 KB
27 KB 131ms
130ms Image
image/jpeg 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/2178668043868567083?w=360&h=720

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

528f4a3f40fd67b606bc0f47303c427409367986c800efe3fec1cd4f5f92d9ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27317
x-xss-protection: 0
last-modified: Sun, 20 Aug 2023 13:40:01 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 30 Sep 2023 14:27:12 GMT

GET
H3 200 8572588318216509527
tpc.googlesyndication.com/simgad/15410830595887015707/ Frame 91EE 16 KB
16 KB 36ms
34ms Image
image/jpeg 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15410830595887015707/8572588318216509527?w=400&h=209

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48b656cd93739af0e39aa7e918f886f0376b9eb0d103f031cff4ec7879035c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16005
x-xss-protection: 0
last-modified: Mon, 21 Aug 2023 18:52:32 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 14:27:12 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/4993217691887194574/ Frame 91EE 10 KB
10 KB 34ms
33ms Image
image/png 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4993217691887194574/14763004658117789537?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecb8bb5533707cbdf416db3ac037bab4e1211d72b4aaa46ae4dc3572c2d24572

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 09:16:45 GMT
x-content-type-options: nosniff
age: 18627
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10417
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 23:21:47 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 09:16:45 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0DCD 1 KB
643 B 31ms
31ms Document
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 82086
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Sep 2023 15:39:06 GMT
etag: 48472445140208031
expires: Sat, 23 Sep 2023 15:39:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 2CE4 0
11 B 31ms
31ms Image
text/plain 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?GK8dpQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c0b::84 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5149
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESEJLqfTSa9DDp_lPrRRfevyc&google_cver=1&google_push=AXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0Bc...
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs...
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0BcpHYdLY8-fwXIcfc9...

170 B
188 B

42ms
42ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0BcpHYdLY8-fwXIcfc98g52_c965IRLl5YcF3GE1T-VqKdZNHTThMciGA0&google_cver=1&google_gid=CAESEJLqfTSa9DDp_lPrRRfevyc&google_hm=UTc0ODc2NTYzMjE2MjE4MDE0NzU=

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 23 Sep 2023 14:27:13 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRZ0ymRBpKsa0I01K2WlWjFvzXhosEVsYVkayZ8CN6JyERH3CtA5Pwla9VCMQlHs94xx5MAXMdsItrcR-dKNxp3UMtUxOQSp0BcpHYdLY8-fwXIcfc98g52_c965IRLl5YcF3GE1T-VqKdZNHTThMciGA0&google_cver=1&google_gid=CAESEJLqfTSa9DDp_lPrRRfevyc&google_hm=UTc0ODc2NTYzMjE2MjE4MDE0NzU=
Content-Type: text/html
Cache-Control: max-age=62164
Connection: keep-alive
Content-Length: 154

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 5149
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3A...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE...

43 B
426 B

109ms
107ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80b37795bad64bc3-BUF
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 947
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTpAQljHMcaZiWhGu0DTLCofkN5rcd0TYs4Z-eSMY4ZI2c4auosPlh5sAqOniUWoRDyA26ASSpMFkBJHb0O1Vj_jjcKubE3AiIXJqQLubbEIiwuU2Y6XFSAMqwzoHBME6qtVlWZhq3YONaf9yygO_slJ3M%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80b37794facf4bc3-BUF
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5149
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEAwV6HvTi1_cIShKn2VSh-o&c_param1=AXcoOmTx8I7J1_VQaqDQVJ3JYKWk1fZH3qjpmwJmTZgvG5rmMtMNvuuCftR72jhcDefo3IM-ahD0VrjDBbCxrcBSVz38OzMn4ResvdGZAMDcIdOe3D8...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTx8I7J1_VQaqDQVJ3JYKWk1fZH3qjpmwJmTZgvG5rmMtMNvuuCftR72jhcDefo3IM-ahD0VrjDBbCxrcBSVz38OzMn4ResvdGZAMDcIdOe3D89af1-ut21qPRMdFmoD...

170 B
188 B

45ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTx8I7J1_VQaqDQVJ3JYKWk1fZH3qjpmwJmTZgvG5rmMtMNvuuCftR72jhcDefo3IM-ahD0VrjDBbCxrcBSVz38OzMn4ResvdGZAMDcIdOe3D89af1-ut21qPRMdFmoD8i2caAanm5rDn1Pkch6w7R4I6g

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTx8I7J1_VQaqDQVJ3JYKWk1fZH3qjpmwJmTZgvG5rmMtMNvuuCftR72jhcDefo3IM-ahD0VrjDBbCxrcBSVz38OzMn4ResvdGZAMDcIdOe3D89af1-ut21qPRMdFmoD8i2caAanm5rDn1Pkch6w7R4I6g
date: Sat, 23 Sep 2023 14:27:12 GMT
server: nginx/1.23.2
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5149
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEBwH7i3shtyjTI4UIli0H2g&google_cver=1&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEBwH7i3shtyjTI4UIli0H2g&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4efDPUD8ZdkS6pu5XrfGGMoU9_7nmRVbDkcJDMZVjTnjdzy...

170 B
232 B

43ms
42ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4efDPUD8ZdkS6pu5XrfGGMoU9_7nmRVbDkcJDMZVjTnjdzyzaLzzRpHkZX3QlamDIxxbw2j3H6g&google_hm=cEtQNFVtX3pPdTY2LTBvdHlyUEI=

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 23 Sep 2023 14:27:12 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRUdqD-LdRHqR-XNgUeGo4V9JtJhJW8c2ewB0_sbEnwO7DewayqvLPWHCk4MWLxeD6s2kDJkTZnejCh4efDPUD8ZdkS6pu5XrfGGMoU9_7nmRVbDkcJDMZVjTnjdzyzaLzzRpHkZX3QlamDIxxbw2j3H6g&google_hm=cEtQNFVtX3pPdTY2LTBvdHlyUEI=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 295
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5149
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESELcT4zDyCCbmNJUd88p6jOg&google_cver=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr3pRGfm...
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESELcT4zDyCCbmNJUd88p6jOg&google_cver=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=MFNukGctTEKsXg6R3x7-3g==&no_redirect=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3z...

170 B
188 B

44ms
43ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=MFNukGctTEKsXg6R3x7-3g==&no_redirect=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr3pRGfmLu_BqGuT1DbNbzBmBXc0awRyjWcKUBWIDdALWs999CgoX4KiRb5DAg0aNy_apHn1puv3O97FfIVSwkHoIqhR

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=MFNukGctTEKsXg6R3x7-3g==&no_redirect=1&google_push=AXcoOmSlOkE-Zq7e3ZNflDi14Hs2Fip0oVYSJvhe8dLUIX_kkhpz3zrdLWczTOFBfg6aqr3pRGfmLu_BqGuT1DbNbzBmBXc0awRyjWcKUBWIDdALWs999CgoX4KiRb5DAg0aNy_apHn1puv3O97FfIVSwkHoIqhR
date: Sat, 23 Sep 2023 14:27:12 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5149
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEHJ81Hifzsujrkkbej07qTg&google_cver=1&google_push=AXcoOmQKHfETUE_iT6lcDR74HUAEOKSebOJIz8q4RkLPPVMjCucsCmG1xPDNJEWnBg...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQKHfETUE_iT6lcDR74HUAEOKSebOJIz8q4RkLPPVMjCucsCmG1xPDNJEWnBgUx8F2LOSoe244RaCTAiAaN5htetRRa-aFPRWzniWHxJov9Ai...

170 B
232 B

46ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQKHfETUE_iT6lcDR74HUAEOKSebOJIz8q4RkLPPVMjCucsCmG1xPDNJEWnBgUx8F2LOSoe244RaCTAiAaN5htetRRa-aFPRWzniWHxJov9AiHIoZGVfHwZLDx9DCoyOQyFcUSTHJRWAEusHxk6ZA6yKViZ&google_hm=q4_MqugUQB2oxwRjL133RCM

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:11 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQKHfETUE_iT6lcDR74HUAEOKSebOJIz8q4RkLPPVMjCucsCmG1xPDNJEWnBgUx8F2LOSoe244RaCTAiAaN5htetRRa-aFPRWzniWHxJov9AiHIoZGVfHwZLDx9DCoyOQyFcUSTHJRWAEusHxk6ZA6yKViZ&google_hm=q4_MqugUQB2oxwRjL133RCM
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5149
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESEO2I3Ug4_47ZSU1Aw-CysSQ&google_cver=1&google_push=AXcoOmSCUMJ7C14r6yrXwi7qpU1d2kp8Iqjz5xp2ueTyBD76aNBKP4FWhhPiT6jz15PviOhoHZ8U9uQrMIncQJo58rDgqzIhJ...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSCUMJ7C14r6yrXwi7qpU1d2kp8Iqjz5xp2ueTyBD76aNBKP4FWhhPiT6jz15PviOhoHZ8U9uQrMIncQJo58rDgqzIhJlGckjPAPS868PljAiEowwhPZGsKW...

170 B
329 B

45ms
44ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSCUMJ7C14r6yrXwi7qpU1d2kp8Iqjz5xp2ueTyBD76aNBKP4FWhhPiT6jz15PviOhoHZ8U9uQrMIncQJo58rDgqzIhJlGckjPAPS868PljAiEowwhPZGsKWjnVR1knjJtpbXFq0EMqTUwzlqb5AmclqJg&google_hm=199e3e9bfc4b278f11xv8n00lmw4k4s5

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSCUMJ7C14r6yrXwi7qpU1d2kp8Iqjz5xp2ueTyBD76aNBKP4FWhhPiT6jz15PviOhoHZ8U9uQrMIncQJo58rDgqzIhJlGckjPAPS868PljAiEowwhPZGsKWjnVR1knjJtpbXFq0EMqTUwzlqb5AmclqJg&google_hm=199e3e9bfc4b278f11xv8n00lmw4k4s5
date: Sat, 23 Sep 2023 14:27:12 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 305
content-type: text/html; charset=utf-8

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 5149 0
40 B 111ms
42ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J7DP978ndIkov1aMnm7wbz-KUT5JBCazkN_fu82YDVggC_cVmVJW_xQGLLHM-Gg-ez3D9TmHR9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 5119 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 330fb64aab41dedaa02ff33081c0f4023fd6db203d3c13f99cf4e449a0bbd102

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 31A9 35 B
463 B 107ms
35ms Image
image/gif 2620:116:800b:21:b08a:1dc5:659b:4055
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBoGchiAedr4q42DPnJKQzk&google_cver=1&google_push=AXcoOmQrJLfXbGnZweyEq0Yo1SLpGYrFs1yI51Sifv-ZO81zzMOy6Vi0lI67NzygKV6C_j8E-2qf2A_B7ur4IrL7EhF1NhoeDcNw

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 31A9
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESELt37Ll0Bo79v7uNnC1EHps&google_cver=1&google_push=AXcoOmRqgyjjx2b2QEb-tC7SeO5FrK6S3veKsiO3tnVO_8PdilkaSXYh8pjnvXQ7R5ukbrQ6jSDJo...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRqgyjjx2b2QEb-tC7SeO5FrK6S3veKsiO3tnVO_8PdilkaSXYh8pjnvXQ7R5ukbrQ6jSDJo5MSQJ8Tr97ODpJNl72ddAY2og

170 B
232 B

43ms
43ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRqgyjjx2b2QEb-tC7SeO5FrK6S3veKsiO3tnVO_8PdilkaSXYh8pjnvXQ7R5ukbrQ6jSDJo5MSQJ8Tr97ODpJNl72ddAY2og

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 23 Sep 2023 14:27:12 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: EF16C9E5E99A49E1B53788D108C9F5E8 Ref B: NYCEDGE1320 Ref C: 2023-09-23T14:27:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRqgyjjx2b2QEb-tC7SeO5FrK6S3veKsiO3tnVO_8PdilkaSXYh8pjnvXQ7R5ukbrQ6jSDJo5MSQJ8Tr97ODpJNl72ddAY2og
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYGB4VmGKIzDwT+y367Rg==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 31A9
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmTiTrsaQVL0Ha3RjVaqTPO-4agwrKaqPG3BOgouF1GKhdYh3F1nUOWtdaDozXLybniIYXRmw4_mNVsFGihvQK...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmTiTrsaQVL0Ha3RjVaqTPO-4agwrKaqPG3BOgouF1GKhdYh3F1nUOWtdaDozXLybniIYXRmw4_mNVsFGihvQK...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e

170 B
188 B

45ms
44ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e
date: Sat, 23 Sep 2023 14:27:12 GMT
server: Kestrel
content-length: 423

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 31A9 0
173 B 89ms
33ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMUMfs6eLd_20U69Eskr-PY&google_cver=1&google_push=AXcoOmQaiyYSNtqfRqo2OVaZ96hvjrQBeteJnM1I7dUmpEocyRlgjUcHy8_RpV5TpzBqv1TAe7WcGSC_D7qvWWp0XV_D6Cvq4JYI5g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=250&adk=3990647781&adf=2778194034&pi=t.aa~a.749167770~rp.4&w=320&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=320x250&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280&nras=3&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=330&ady=1403&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=ZgJTXIdXA0&p=https%3A//windowstechs.com&dtd=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 31A9
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmSYif2FbKboRHHg8fHEsRlbwb1HKPkgKaRF_zwfFR51M3t81ccT3w_ex9yZjAGEtuZxsJgkHTvAYaMuNDTEoKBSZifC7e076yI&google_gid=CAESED6fTQJN5Q...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESED6fTQJN5QDZpYDidJy3zWg&google_hm=T1BVNTNjNmM4NzY1YWU1NGE2ZWE1NWY3ODE1ZmYzMWJhNWE&google_nid=opera_norway_as&google_push=AXcoOmSYif2F...

170 B
188 B

43ms
43ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESED6fTQJN5QDZpYDidJy3zWg&google_hm=T1BVNTNjNmM4NzY1YWU1NGE2ZWE1NWY3ODE1ZmYzMWJhNWE&google_nid=opera_norway_as&google_push=AXcoOmSYif2FbKboRHHg8fHEsRlbwb1HKPkgKaRF_zwfFR51M3t81ccT3w_ex9yZjAGEtuZxsJgkHTvAYaMuNDTEoKBSZifC7e076yI

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: Tengine
access-control-allow-methods: POST, GET
content-type: text/html; charset=utf-8
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESED6fTQJN5QDZpYDidJy3zWg&google_hm=T1BVNTNjNmM4NzY1YWU1NGE2ZWE1NWY3ODE1ZmYzMWJhNWE&google_nid=opera_norway_as&google_push=AXcoOmSYif2FbKboRHHg8fHEsRlbwb1HKPkgKaRF_zwfFR51M3t81ccT3w_ex9yZjAGEtuZxsJgkHTvAYaMuNDTEoKBSZifC7e076yI
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 327
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

report
sync.teads.tv/um/ Frame 31A9
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEFXPmzyUfYvW...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=MDhmYjFlZjktNDgyNS00ZDMzLWEwNmQtMjAyMTE4YTM1NDRm&google_push=AXcoOmTvmsKGQuy5X9u3xU2_jDk4GEHonS2crpTNohqluhGW9Ez-insSQvS9Kg7u3R176...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

35ms
35ms

Image
image/gif

104.112.20.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Protocol: H2
Server: 104.112.20.199 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-112-20-199.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

expires: Sat, 23 Sep 2023 14:27:12 GMT
pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 31A9
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESEO2I3Ug4_47ZSU1Aw-CysSQ&google_cver=1&google_push=AXcoOmQIJmZm6lhzbR-EqnsESQ5AzZMqinUrnI-U1QuvSbUOrcnye7GB_i3tgmLpHFqwaLm5DPq9Z5SNPqkrTBMdAGHG3dqE1...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQIJmZm6lhzbR-EqnsESQ5AzZMqinUrnI-U1QuvSbUOrcnye7GB_i3tgmLpHFqwaLm5DPq9Z5SNPqkrTBMdAGHG3dqE1Vmw6JU&google_hm=199e3e9bfc4...

170 B
232 B

46ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQIJmZm6lhzbR-EqnsESQ5AzZMqinUrnI-U1QuvSbUOrcnye7GB_i3tgmLpHFqwaLm5DPq9Z5SNPqkrTBMdAGHG3dqE1Vmw6JU&google_hm=199e3e9bfc4b278f1n3km500lmw4k4s5

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQIJmZm6lhzbR-EqnsESQ5AzZMqinUrnI-U1QuvSbUOrcnye7GB_i3tgmLpHFqwaLm5DPq9Z5SNPqkrTBMdAGHG3dqE1Vmw6JU&google_hm=199e3e9bfc4b278f1n3km500lmw4k4s5
date: Sat, 23 Sep 2023 14:27:12 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
content-type: text/html; charset=utf-8

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 31A9 0
130 B 52ms
41ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JPLHZVM7s5TMyc6TKn-Fkvl80-jBiS8SgDgMIqXI0ZClAewy9qWDXWZvl-neCVp8U7bKmMREGd

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DEDA 42 B
64 B 50ms
50ms Fetch
image/gif 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuwdIA5mifzZfDRwNkULzN3B4qOpEBAXRrWAHjhG1o4fLJ038kYcshB0r4wVYkjILNbMAWmAlDLcYjQ1ljXRuRk8wtw5_0ZSj2o31P4ItD_f1Ku-2dk-H7nIoN0CqGN4Aptwr_S-Xz6Vg&sai=AMfl-YQpaLJTk3s94iTX0WgqEF9UKuaKVHZB3NBfUXBMrTb8dfnLQfUUiPfTK29btBMs3Azv3ZdQm-Sg3Tu_&sig=Cg0ArKJSzAt8QAED5NJvEAE&cid=CAQSGwBpAlJWDqjXDSRQrpbY_qkJQ_cVKkNIOj7sQRgB&id=lidar2&mcvt=1067&p=0,0,280,1000&mtos=1067,1067,1067,1067,1067&tos=1067,0,0,0,0&v=20230920&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3796677708&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1695479230730&rpt=988&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 3FE7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 701cb2b5a0437be0d2dd737497593775d62c8b17990fe1e00c8e07f350e88181

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 91EE 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8aed47f9239a43dbbd7e2734d9eb828cdf2af87c71e3238b8385f0899c363030

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 91EE 16 KB
16 KB 35ms
32ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 10:26:49 GMT
x-content-type-options: nosniff
age: 14423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 10:26:49 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 91EE 15 KB
15 KB 39ms
38ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 17:44:41 GMT
x-content-type-options: nosniff
age: 74551
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 17:44:41 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 0DCD 35 B
462 B 36ms
34ms Image
image/gif 2620:116:800b:21:b08a:1dc5:659b:4055
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBoGchiAedr4q42DPnJKQzk&google_cver=1&google_push=AXcoOmSXIZyRv-cwjoF6BSZKqhnSITPLwaz-o_qKrdaBec35gR1AW-vyo8qbqI4jg1w9U4ZziDxaExKKIiPWryx75_0kXApjhKV16F2c

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 0DCD
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50v...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff5...

43 B
430 B

106ms
105ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80b37796aae44bc3-BUF
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 375
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEP63ISJHXRCtnW_thr4HQ10&google_cver=1&google_push=AXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSmqRHsyrgAoXch0_uEwX7zPymzyAzZ0h_XuIdK_OkoTHEtwFOwSBeAbP7jvwqs5CyjXweH6nf7TSJ3hm7aH969IcRDff50vrwW%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80b377956ad34bc3-BUF
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DCD
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmRa1T7KYDTMu22mPyHz0Vs4NXy-bo3AsHCzKHZGRwkjiwFbjqmch3KAwI4T2HaDMTv3JEuKXlvYYzmI7IfqEi...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEO1nSujLTz3_56deuy70cMI&google_cver=1&google_push=AXcoOmRa1T7KYDTMu22mPyHz0Vs4NXy-bo3AsHCzKHZGRwkjiwFbjqmch3KAwI4T2HaDMTv3JEuKXlvYYzmI7IfqEi...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e

170 B
188 B

44ms
44ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YjI4YjA3ZjAtOGRlMC00MzJlLTgxZWUtZTRmYjcxNjgxYzJl&google_push&gdpr=0&gdpr_consent=&ttd_tdid=b28b07f0-8de0-432e-81ee-e4fb71681c2e
date: Sat, 23 Sep 2023 14:27:12 GMT
server: Kestrel
content-length: 423

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 0DCD 0
119 B 35ms
32ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMUMfs6eLd_20U69Eskr-PY&google_cver=1&google_push=AXcoOmS2hL_l73xBNN30AZIzRhKOcGJTqkozt_QxlVmCf30jkB68bNBPIEoUDJvnh-WI-wkQEvLWPs8iJAnHZhdfL2Y1X2eXvwV2ExnP
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=200&adk=3332155356&adf=1835424514&pi=t.aa~a.1779471494~rp.1&w=590&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=590x200&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250%2C300x600&nras=5&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=680&ady=4234&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=hHl5PAVTYW&p=https%3A//windowstechs.com&dtd=18
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame 0DCD 0
35 B 127ms
41ms Image
text/plain 44.209.104.88
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEMbDdA3-qSIOQjykZ8VKuuA&google_cver=1&google_push=AXcoOmRYdVJBMcmYp4PkDv54RHeLJvngZUVUo7-_VglbT0Nb9TljKJD0JhPtQls-pUTm1zoJo4Q57-3aidz8dCq3oJTdoCD7sTakax0o
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5524449045609994&output=html&h=200&adk=3332155356&adf=1835424514&pi=t.aa~a.1779471494~rp.1&w=590&fwrn=4&fwrnh=100&lmt=1695515231&rafmt=1&to=qs&pwprc=2062561900&format=590x200&url=https%3A%2F%2Fwindowstechs.com%2Fwp%2Findex.php%2Ftag%2Fbrowser-hijacker%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695479231852&bpp=1&bdt=1628&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Def14c90c42128fd9-229f43220de4009c%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA&gpic=UID%3D00000d94a889b506%3AT%3D1695479230%3ART%3D1695479230%3AS%3DALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw&prev_fmts=0x0%2C1000x280%2C320x250%2C300x600&nras=5&correlator=8452531300305&frm=20&pv=1&ga_vid=426578663.1695479231&ga_sid=1695479231&ga_hid=234986973&ga_fc=0&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=680&ady=4234&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077970%2C42531706%2C44798934&oid=2&psts=AOrYGslOckaAJWW1QsmUrkqcKH-APh6hKe4St-QS7TsXIu5THBytTE9p-QyJXZ0GibrUOrBAdrJCioK9Kw6q6cu9Ls8D2HNy&pvsid=2783619924376527&tmod=254529592&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=hHl5PAVTYW&p=https%3A//windowstechs.com&dtd=18
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.104.88 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-104-88.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame 0DCD
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEDgV9_EYCDmP8AqP5Yvv71Y?ext-param=AXcoOmQHGG6wpqoyEfNSI3um08LxwW1NmCXFp_KIZ1e7Uhq7aPvLhstXDEK4VXskGn7YJmhEkHUDwhsWKwDrL_5cTAf1TFVNY1nmdHjC9g&partner-tag=yande...
https://an.yandex.ru/mapuid/google/CAESEDgV9_EYCDmP8AqP5Yvv71Y?redir-setuniq=1&ext-param=AXcoOmQHGG6wpqoyEfNSI3um08LxwW1NmCXFp_KIZ1e7Uhq7aPvLhstXDEK4VXskGn7YJmhEkHUDwhsWKwDrL_5cTAf1TFVNY1nmdHjC9g&p...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEDgV9_EYCDmP8AqP5Yvv71Y&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

178ms
178ms

Image
image/gif

2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:13 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 07 Sep 2024 14:27:13 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0DCD
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESEO2I3Ug4_47ZSU1Aw-CysSQ&google_cver=1&google_push=AXcoOmT679BmcFxWF8a6aPjC0JfYFs7U8c1pFhA86NcrthupVzDLjf5nCj7DWlQGBFqQWUjwNKp8ZinnFeg5LwoPiZNbjaiwC...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmT679BmcFxWF8a6aPjC0JfYFs7U8c1pFhA86NcrthupVzDLjf5nCj7DWlQGBFqQWUjwNKp8ZinnFeg5LwoPiZNbjaiwCQzB4HJ5UQ&google_hm=199e3e9b...

170 B
232 B

42ms
42ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmT679BmcFxWF8a6aPjC0JfYFs7U8c1pFhA86NcrthupVzDLjf5nCj7DWlQGBFqQWUjwNKp8ZinnFeg5LwoPiZNbjaiwCQzB4HJ5UQ&google_hm=199e3e9bfc4b278f1n3km500lmw4k4s5

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmT679BmcFxWF8a6aPjC0JfYFs7U8c1pFhA86NcrthupVzDLjf5nCj7DWlQGBFqQWUjwNKp8ZinnFeg5LwoPiZNbjaiwCQzB4HJ5UQ&google_hm=199e3e9bfc4b278f1n3km500lmw4k4s5
date: Sat, 23 Sep 2023 14:27:12 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 252
content-type: text/html; charset=utf-8

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 0DCD 0
40 B 43ms
41ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IXc7MY9wCqdj96-Amu0MEbrrg8dMI1MpGFU2ele1IxxxAE6liJmQu7-8uV_5PM9CHwGqvMSYc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 5119 15 KB
16 KB 33ms
33ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 18:49:23 GMT
x-content-type-options: nosniff
age: 70669
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 18:49:23 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 5119 15 KB
15 KB 39ms
39ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 05:06:03 GMT
x-content-type-options: nosniff
age: 33669
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:06:03 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 3FE7
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CnRq3v_UOZb--N8PhxtYPx7qG4AuJl9OOc5zOwra-EZulx9jUPxABIM-1syhgye6Oi8CkjBCgAcj0xcYpyAEBqQKQR_ZHjPN4PqgDAcgDy4SAgASqBPcBT9CpK2jtI5SU3uruNSsdgxlsM-D...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x4f32fd...

0
0

48ms
48ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x4f32fd3426edda2e0000000000000000%22,%224%22:%220x5c814367dae0836e0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%221953208686361328789%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216033081025340946257%22}&andc=true

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0x5edafad330b6ce9d0000000000000000","3":"0x4f32fd3426edda2e0000000000000000","4":"0x5c814367dae0836e0000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"1953208686361328789","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"16033081025340946257"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 23 Sep 2023 14:27:13 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x31f3251c90497b700000000000000000","2":"0x5edafad330b6ce9d0000000000000000","3":"0x4f32fd3426edda2e0000000000000000","4":"0x5c814367dae0836e0000000000000000","5":"0x96fde27e757dc0420000000000000000"},"debug_key":"1953208686361328789","debug_reporting":true,"destination":"https://foblue.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11153799752"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"16033081025340946257"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 34B0 37 KB
14 KB 32ms
32ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 91EE
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CVY1Iv_UOZe-vN-PlvPIP5_ayEPyHvIBzlJ-HxfMQ2tkeEAEgz7WzKGDJ7o6LwKSMEKAB84_7qSnIAQmpAmExRh9x37E-qAMByAPLBKoEggJP0I6r3rqQNcH6aetLK07ayOyZ6-2VQpddkw6...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5d...

0
0

49ms
49ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5dbdb48fa77e0000000000000000%22,%224%22:%220x103bb54aa01979b70000000000000000%22,%225%22:%220x8f58a660a6ff063b0000000000000000%22},%22debug_key%22:%2216903804563069940608%22,%22debug_reporting%22:true,%22destination%22:%22https://shofast.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093854195%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216994729001637751905%22}&andc=true

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xfc83808bcb9660450000000000000000","2":"0x99895775b73832a30000000000000000","3":"0x700f5dbdb48fa77e0000000000000000","4":"0x103bb54aa01979b70000000000000000","5":"0x8f58a660a6ff063b0000000000000000"},"debug_key":"16903804563069940608","debug_reporting":true,"destination":"https://shofast.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11093854195"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"16994729001637751905"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 23 Sep 2023 14:27:13 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xfc83808bcb9660450000000000000000","2":"0x99895775b73832a30000000000000000","3":"0x700f5dbdb48fa77e0000000000000000","4":"0x103bb54aa01979b70000000000000000","5":"0x8f58a660a6ff063b0000000000000000"},"debug_key":"16903804563069940608","debug_reporting":true,"destination":"https://shofast.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11093854195"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"16994729001637751905"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 9D9C 37 KB
14 KB 32ms
31ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 5119
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=Cdalbv_UOZdbENsHEvPIP67eGyAX8h7yAc5Sfh8XzENrZHhABIM-1syhgye6Oi8CkjBCgAfOP-6kpyAEJqQJhMUYfcd-xPqgDAcgDywSqBIICT9C4vMyOD4VBlDL9vlkCZy0-mLmIxh-8hmJ...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5d...

0
0

47ms
47ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5dbdb48fa77e0000000000000000%22,%224%22:%220x103bb54aa01979b70000000000000000%22,%225%22:%220x8f58a660a6ff063b0000000000000000%22},%22debug_key%22:%222152282685287216271%22,%22debug_reporting%22:true,%22destination%22:%22https://shofast.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093854195%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225424252820824690177%22}&andc=true

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 14:27:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xfc83808bcb9660450000000000000000","2":"0x99895775b73832a30000000000000000","3":"0x700f5dbdb48fa77e0000000000000000","4":"0x103bb54aa01979b70000000000000000","5":"0x8f58a660a6ff063b0000000000000000"},"debug_key":"2152282685287216271","debug_reporting":true,"destination":"https://shofast.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11093854195"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"5424252820824690177"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 23 Sep 2023 14:27:13 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 23 Sep 2023 14:27:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xfc83808bcb9660450000000000000000","2":"0x99895775b73832a30000000000000000","3":"0x700f5dbdb48fa77e0000000000000000","4":"0x103bb54aa01979b70000000000000000","5":"0x8f58a660a6ff063b0000000000000000"},"debug_key":"2152282685287216271","debug_reporting":true,"destination":"https://shofast.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11093854195"],"4":["09-23"],"6":["true"]},"priority":"500","source_event_id":"5424252820824690177"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 3FE9 37 KB
14 KB 33ms
33ms Script
text/javascript 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 18:42:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 18:42:14 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 47ms
46ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x31f3251c90497b700000000000000000%22,%222%22:%220x5edafad330b6ce9d0000000000000000%22,%223%22:%220x4f32fd3426edda2e0000000000000000%22,%224%22:%220x5c814367dae0836e0000000000000000%22,%225%22:%220x96fde27e757dc0420000000000000000%22},%22debug_key%22:%221953208686361328789%22,%22debug_reporting%22:true,%22destination%22:%22https://foblue.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211153799752%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2216033081025340946257%22}&andc=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 47ms
46ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 47ms
47ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xfc83808bcb9660450000000000000000%22,%222%22:%220x99895775b73832a30000000000000000%22,%223%22:%220x700f5dbdb48fa77e0000000000000000%22,%224%22:%220x103bb54aa01979b70000000000000000%22,%225%22:%220x8f58a660a6ff063b0000000000000000%22},%22debug_key%22:%222152282685287216271%22,%22debug_reporting%22:true,%22destination%22:%22https://shofast.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211093854195%22],%224%22:[%2209-23%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225424252820824690177%22}&andc=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 23 Sep 2023 14:27:13 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 28AA 42 B
64 B 50ms
49ms Fetch
image/gif 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvyYZ638d4VtniZ6BZf_krnHoLPZjOWvL8CWmzoKOQWYdlr6xCHalvjHvBKh2Xn6Rqk_IQe3nu2qPN7n5IVoy0MAIDyjhTOhg_36yOlFeAvbgeQ1-Erj8Pv7Ka5Kmy0Q3g08rYM3l4iJg&sai=AMfl-YSq8yCl36kbpETEvWQlE8l3A7H9l7jN5anc1rEy054hM_5duMOqtUpqiHplh72flI1Dws9cRa44Lnk-&sig=Cg0ArKJSzDqN7FoIczraEAE&cid=CAQSGwDICaaNVM1isnLYgAfqABDam4X15bf7Hv6N-xgB&id=lidar2&mcvt=1001&p=0,0,124,1005&mtos=100,701,1001,1008,1008&tos=100,601,300,7,0&v=20230920&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1695479231977&rpt=368&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F3C9 42 B
64 B 48ms
48ms Fetch
image/gif 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssKWFqVgO7atbIBGROUf0qUMvrZ9ottSNO3SSzeJoW41SqqfxePdZTiHZ58DU4Bbpd_bh-TgAe99rkXIQQeU-FxugogQv2vjAL8U9mb_jQkNxD27NNYG5brJxF1pAigk4-TpKtck8CcFw&sai=AMfl-YQQVgXDt2uecNYozhpAdmZ2jSf0P27N7bwUC_1LarpN6N6XQUnBdc2MdzEdITMz3j9hRtFTHTM1LP3q&sig=Cg0ArKJSzKEHMA4EZNicEAE&cid=CAQSGwDICaaNVM1isnLYgAfqABDam4X15bf7Hv6N-xgB&id=lidar2&mcvt=1004&p=0,0,600,200&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20230920&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1695479231976&rpt=340&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Sep 2023 14:27:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 49ms
48ms Image
text/html 2607:f8b0:4004:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230920&jk=2783619924376527&bg=!iYqlisXNAAYrDsWMCw47ADQBe5WfOMV66LVOKolbyKtR1N1o3mp3VGkIiHQ17_6KTsL9zdLhpUm43l3tV-vq8pNtXKhaAgAAAcBSAAAAB2gBBwoAWxBiHAhfXN51r59dVbDCSeo_3DG9C8hT2YJMhJpHBjer9PWfMPWGtKHk6jhZwTpFCW4ZXOa0rEhFw7NSXR2hfDEuJsMLu0AS8A8voAfTPD_jPR-9ngB9atgiUZ2ZAsSBtVrwwrp7Usm4UkzAOJdkbj7TwqikPWe1R0JKrTOAJoyACTxmHX0MacHQ4G-74vZ5FtUmGxMTMl78C8I6d6pOFbU7glki6GjXz3pMJL_9DifVm4YWdHIPTzbLOVLhxpkolIJxH7IMT4WovhSXu6f2j047OHmNQ9VCgNx-PYhnq_W39Qg86SBqEf2ZaWvHCSEci3WkwUxdSbtVlbpf3Ossk6BN7ivbsJG46EI88v_mAu5XzKPVVfgANrFXHz_mgmm2fm-ljfDIAupToHgML4ChbGUs_Bod7fiGaIDGlM8j4F5W4SAMeSSNgwKBcyqxHk93m80A4fJtLQsR8n1uASaRiP2Z2zhvlgGJ1kaGgz2kzVHkJH7VItFIsQiLOE0lFKjG795s4ZXn8CYjoVLZ8Vx73MXyR2AQGrvRWtqbM9Me1mebor9uSqmHxkJXwZzxsPuQryFKFxEgdwe6vaCilE8oE6k63IiKg3crqFuaojaHBlCad8-YS_cFa34W6eUm6tSoH3hihFTEbN-gTx2tY65adOyf_zyj5pdw2ZWqyOfhitT4zwCQ1iGvoB6EnxwW4UKlhMi1OQYe-37NY8dn05TP3fbjSrWvoVK5FdtTgi38sQWfl0c9xGX3uhtr-hfVV0SuVBnVVjYAoRQ_GUrnpRWOzd8k7WMKLL7-Ekmi4CVdkl9BlpCTs3RDnwqb1Qkxw2M0ihLsTN0Qg2I5JPe7USPvVaCRakfeKuHhNDl95twnpR0PUbofiZ_X7OIlgulQcmmXmzzU9A5VRAQRo3O__wAw5qgR4yB_Z3cwzbrjyMgpHnYtfhxyZQkxWRKjqL8EXBEw2xxwBmkQEmkRajkAJvZ90gXzaQnAthk5pPdoPGow4SEsk-k0DsMVIHgyYUF_mAphAUcC5OBmAM729StZsMioLxUH8BWkypWfqE1kfhnpagie3_c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c08::9b , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowstechs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sans.edu/	1970-01-20 23:43:10	Name: visid_incap_2188750 Value: Y+vmlVuwTxib68DovmPF/r31DmUAAAAAQUIPAAAAAADAkyYBgBabWuZawO+LRQ9s
.sans.edu/	1969-12-31 23:59:59	Name: incap_ses_1462_2188750 Value: spl4Swwc4BPHtXtl5hFKFL31DmUAAAAAVSeveam2xwFR1qwpe2Um3w==
.windowstechs.com/	1970-01-21 00:19:35	Name: __gads Value: ID=ef14c90c42128fd9-229f43220de4009c:T=1695479230:RT=1695479230:S=ALNI_MYHJmQNMDKI9LWJFkPulO9qUCr8qA
.windowstechs.com/	1970-01-21 00:19:35	Name: __gpi Value: UID=00000d94a889b506:T=1695479230:RT=1695479230:S=ALNI_MadN1H02s80pIPE5VdrWfOJIKzCOw
.doubleclick.net/	1970-01-21 00:33:59	Name: IDE Value: AHWqTUmh8DMb89f_VwCICd2pcKTaIgLuGsCMUhTwZkCoeuP_sHE3exKjFafeYWBy59E
.googleadservices.com/	1970-01-20 17:07:35	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-20 14:58:02	Name: DSID Value: NO_DATA
.ctnsnet.com/	1970-01-20 23:43:35	Name: gid_CAESEHJ81Hifzsujrkkbej07qTg Value: 1
.ctnsnet.com/	1970-01-20 23:43:35	Name: cid_ab8fccaae814401da8c704632f5df744 Value: 1
.mediago.io/	1970-01-20 23:43:35	Name: __mguid_ Value: 199e3e9bfc4b278f1n3km500lmw4k4s5
.zemanta.com/	1970-01-20 23:43:35	Name: zuid Value: pKP4Um_zOu66-0otyrPB
.mfadsrvr.com/	1970-01-21 00:33:59	Name: tuuid Value: 30536e90-672d-4c42-ac5e-0e91df1efede
.mfadsrvr.com/	1970-01-21 00:33:59	Name: c Value: 1695479232
.mfadsrvr.com/	1970-01-21 00:33:59	Name: tuuid_lu Value: 1695479232
.quantserve.com/	1970-01-20 17:07:35	Name: d Value: EDABCQGCKoEA
.blismedia.com/	1970-01-20 23:43:39	Name: b Value: 650EF5C0B773B04358D1A582BLIS
.quantserve.com/	1970-01-21 00:28:13	Name: mc Value: 650ef5c0-d549e-e0b11-ff24f
.linkedin.com/	1970-01-20 23:43:35	Name: bcookie Value: "v=2&f6c8de4a-698f-4853-8fe6-5a3ea6b71f0f"
.linkedin.com/	1970-01-20 14:59:25	Name: lidc Value: "b=VGST01:s=V:r=V:a=V:p=V:g=3002:u=1:x=1:i=1695479232:t=1695565632:v=2:sig=AQFRIc_0fdk-FqFrSzpkc2NpouzUME2L"
.teads.tv/	1970-01-20 23:42:08	Name: tt_viewer Value: 08fb1ef9-4825-4d33-a06d-202118a3544f
.mfadsrvr.com/	1970-01-21 00:33:59	Name: ssh Value: !google,1695479232
.adsrvr.org/	1970-01-20 23:45:01	Name: TDID Value: b28b07f0-8de0-432e-81ee-e4fb71681c2e
.owneriq.net/	1970-01-21 00:33:59	Name: si Value: Q7487656321621801475P
.owneriq.net/	1970-01-20 15:12:23	Name: p2 Value: gguuid
.owneriq.net/	1970-01-20 15:12:23	Name: gguuid Value: 1
.adsrvr.org/	1970-01-20 23:45:01	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsI7KmP4eaSnjwQBRgFIAEoAjILCKD-p439kp48EAU4AQ..
.uuidksinc.net/	1970-01-20 23:43:35	Name: jcsuuid Value: AQHAemJZFdpYmNAR7Bnh
.adx.opera.com/	1970-01-20 23:43:35	Name: UID Value: OPU53c6c8765ae54a6ea55f7815ff31ba5a
.tribalfusion.com/	1970-01-20 17:07:35	Name: ANON_ID Value: afnt6Zamge06ousnA6MvPAxdZcU3ZdHQ3DbuSD9XuY4aAOaUQKsG4QsaPwZaJF3Zdbs2KZcxSQU4Es6U203HXaZckKVkYPY9CMe
.yandex.ru/	1970-01-21 00:33:59	Name: yuidss Value: 7299441791695479233
.yandex.ru/	1970-01-21 00:33:59	Name: yandexuid Value: 7299441791695479233

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20110914/zrt_lookup.html?fsb=1#RS-1-&adk=1812271803&client=ca-pub-5524449045609994&fa=3&ifi=7&uci=a!7&btvi=4&xpc=KeXSIvzuYt&p=https%3A//windowstechs.com Message: The resource https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
an.yandex.ru
b1sync.zemanta.com
cm.g.doubleclick.net
cms.quantserve.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
isc.sans.edu
ius.ctnsnet.com
match.adsrvr.org
pagead2.googlesyndication.com
partner.googleadservices.com
px.ads.linkedin.com
px.owneriq.net
rtb.adentifi.com
rtb.mfadsrvr.com
s.tribalfusion.com
s.uuidksinc.net
sync.teads.tv
t.adx.opera.com
tpc.googlesyndication.com
tr.blismedia.com
trace.mediago.io
windowstechs.com
www.google.com
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
104.112.20.199
172.253.62.154
172.253.63.155
173.233.67.178
23.61.60.237
2606:4700::6812:19ad
2607:f8b0:4004:c06::5e
2607:f8b0:4004:c06::68
2607:f8b0:4004:c08::9b
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c0b::84
2607:f8b0:4004:c17::9a
2607:f8b0:4004:c17::9c
2607:f8b0:4004:c1d::5e
2620:116:800b:21:b08a:1dc5:659b:4055
2620:1ec:21::14
2a02:6b8::90
31.220.27.155
34.96.105.8
35.186.193.173
35.207.24.140
35.208.249.213
35.71.131.137
44.209.104.88
45.60.31.34
64.74.236.95
82.145.213.8
00526e46a0cd4e0849012e53b5a9a2d003af41042d22f7cd4d6e2aaeb38577fd
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
05c78d6a2624f38e659dfad31d402bbda31897361e2ea1a4ef04bd1e78d41b85
096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e
09c928c408b72a989d0252eb8a238c26a38cebd22443994f15a3026667a501f1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d54b6c574ebf7edab9aeca0e9cc534879d93deef8f7de976a199bd92161e203
13031d4ec04980984b56e9152739c608e15fcda23007e524117198f054385eb6
15325855b803d62fa5f7dd35c0919f350e3befcc5853f3d9099a7046ace201ca
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
1d7a8cca7b95aa4b5904e68166f93ee84356f964248d1ebfcca66518706aaf35
2398bec8a5b55282871253c7e6f1bd567df237f71378ffa140000707af4831b4
2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
325162e216f8db34e9275889cd5efbd4901bd975b2a2ef0aee0407a2ba5978ea
325454ac963cd976e55a14bdf3ce6358604ec1dbb2ce06cac64582ef2a8fbebb
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
330fb64aab41dedaa02ff33081c0f4023fd6db203d3c13f99cf4e449a0bbd102
33e2d1c754114357ff845782989f54c8a2107ab50a95395296db047d115bef11
391924fc2a29211c7905288b19ffec92326ed492e014eb14a05f40078a224307
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3db59e4fb00b04d1da0ea32f6ff0191aae083a130976f10420db8a40121a912e
3dcff6754ca06a924cb07278d75876cd327e1d9d34e747dc89e68763b6714a5b
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
463774833c268778806c2cbd8d297898d4fa0c9f2e55fde71b9a2b6c57c8ec50
48b656cd93739af0e39aa7e918f886f0376b9eb0d103f031cff4ec7879035c9c
4cf80393593908e0a01168329e38e06fdd547e13f09c31aa223859adbddbc57c
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
50f36c6941b3a0b755df6e1c1ba6919dc8eeab051a52504ff431c3564d4d791a
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
528f4a3f40fd67b606bc0f47303c427409367986c800efe3fec1cd4f5f92d9ff
53e5efbe2e24d4fb36be193ba451e8b1d5ed9e12d2d3368800d16b0979defddc
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
60dc36009f91fd4cb061954cbd64c6fb7ba5f31fc9dee0cadc7ebab61219dd2d
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
66c48dc6be21195324a58b3fb2e2aeb740f1d226a44e926e8c074e029a307013
67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694
6bd90a11f15a6e28af278037393b9041e3d8489a317f18baf60ac3c9b21c5fcf
6c4c167e0f4ff33820b6559de30b9adc0e9d196db6a0beb599725687d5229134
701cb2b5a0437be0d2dd737497593775d62c8b17990fe1e00c8e07f350e88181
732e8278fb82d947d82912b17919dc7c5a569317860b7c7380b2b025fc029efe
88a7f2522dd8c93c1f5007fcbcd059cff32a895cdab67e4d0398e94e950fbb65
8aed47f9239a43dbbd7e2734d9eb828cdf2af87c71e3238b8385f0899c363030
8e4c9716b25cf832b1d2ce7e4fea29b42980469edc763f31e79eac27bd0a429d
8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339
90cde8f1e3bef4f2ffed183ce33524190c7ad59894a6d50746b29e46904ee960
95963adb7571430676dc2c03206c0d61abc639cf0d1365d4fddf72318e763ee2
9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb
9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9f9cdf06fd1e1647c1f32abf021a37203153bf79a045505395699d306e44485e
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b0d850c9769da596686b6f4b2778d9fa0b6ea9308de03853a5e53520e08fa1c5
b1e17df928189d2fa8e41972d71e4b2c73a647f2cb2f5c304f333e52ff52dcde
b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87
b51f36642966599b936bc845f88be80f6a6e45bbb6a43abd0c01ed06950bdfd5
b656e989df5b75f36afbfbbaa2fc08931e8a1e479919434fed98c19924d4bd0f
ba6d8a3edb6fd7fcefbafd89c57b33e887f13fee69bfa87af416703498570852
bd91080d2c7f2120ad82727f5c07bbb439b810ed4035993ddb1825ca1611396b
bfcef2f50cfc9b946213c69d1ef23e23a59a3634f89fff32437523104d8be4fe
c4a15659b80c847cd26a45a5a94e9841b01f4b14f80cb4b173c9f2e4973f5bab
c6ece8077c8a8d8d057b5a03c892dcf1fed9da76ff1bc964cd17416008752c48
c70bf511d04c83aabcf124f35a69beff663f31dcfef25365851beffcb06ae849
cb8068c7715e850b7694c9ffbaab85b5fa9625ec627925d840c47f0b7089423f
ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b
d0c70f5970df0a88d335f99c0e5ce8643b8ecfd80497fd75fbfbe0415256c160
d9fdede283adf8e099526246143b63748b216083d702b586fd645f0cf5d18aae
da01907e24efa9fc8c829e78b8f8f5547a3a6f4b073b6f3a4dfb624a388558d0
e369d799b14f365dc7a0ce6d5a3a392e4260ecf38361d50253376cb8fd3b2308
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e87bcce4761b410d32df511bc602a89913a89bf460d121a7736175817d57552a
ecb8bb5533707cbdf416db3ac037bab4e1211d72b4aaa46ae4dc3572c2d24572
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

windowstechs.com Open in urlscan Pro 173.233.67.178 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

179 Requests

87 %HTTPS

44 %IPv6

24 Domains

29 Subdomains

19 IPs

4 Countries

2364 kBTransfer

5302 kBSize

31 Cookies

20 Outgoing links

Redirected requests

179 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

windowstechs.com Open in urlscan Pro
173.233.67.178 Public Scan

Screenshot
Live screenshot

Full Image

179
Requests

87 %
HTTPS

44 %
IPv6

24
Domains

29
Subdomains

19
IPs

4
Countries

2364 kB
Transfer

5302 kB
Size

31
Cookies

179 HTTP transactions
11 data transactions