prnt.sc Open in urlscan Pro
104.26.14.80 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://prnt.sc/14xb5pj
Effective URL:
https://prnt.sc/14xb5pj
Submission: On June 09 via manual (June 9th 2021, 9:28:57 pm UTC) from CO

Summary HTTP 140 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 36 IPs in 5 countries across 20 domains to perform 140 HTTP transactions. The main IP is 104.26.14.80, located in United States and belongs to CLOUDFLARENET, US. The main domain is prnt.sc.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2020. Valid for: a year.

This is the only time prnt.sc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	104.26.14.80 104.26.14.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	104.23.140.12 104.23.140.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.23.139.12 104.23.139.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:218... 2600:9000:218c:2200:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
2	151.139.242.3 151.139.242.3	33438 (HIGHWINDS2) (HIGHWINDS2)
10	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
2	192.207.255.147 192.207.255.147	62821 (AS-MNX) (AS-MNX)
1	2a00:1450:400... 2a00:1450:400c:c0a::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:215... 2600:9000:2156:c400:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
4	52.222.200.121 52.222.200.121	16509 (AMAZON-02) (AMAZON-02)
1	2.21.111.28 2.21.111.28	16625 (AKAMAI-AS) (AKAMAI-AS)
2	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400d:807::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
23	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
9 12	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
5 11	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
6 9	185.33.221.15 185.33.221.15	29990 (ASN-APPNEX) (ASN-APPNEX)
3	2a00:1450:400... 2a00:1450:4001:82a::2006	15169 (GOOGLE) (GOOGLE)
6	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
140	36

3 104.26.14.80 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

prnt.sc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.23.140.12 (United States)

ASN13335 (CLOUDFLARENET, US)

st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.23.139.12 (United States)

ASN13335 (CLOUDFLARENET, US)

image.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:218c:2200:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.242.3 (United States)

ASN33438 (HIGHWINDS2, US)

cdn.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.207.255.147 (United States)

ASN62821 (AS-MNX, US)
PTR: haproxy2.ad4game.com

ads.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0a::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:c400:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.8 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.222.200.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-200-121.cdg50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.111.28 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-111-28.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

scontent-frx5-2.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:807::2001 (Ireland)

ASN15169 (GOOGLE, US)

e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.185.226 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.18.234.21 (Frankfurt am Main, Germany) 5 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 185.33.221.15 (Amsterdam, Netherlands) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	googlesyndication.com e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	177 KB
27	doubleclick.net 9 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	193 KB
20	prntscr.com st.prntscr.com image.prntscr.com api.prntscr.com	95 KB
12	casalemedia.com 5 redirects htlb.casalemedia.com dsum-sec.casalemedia.com	11 KB
10	fbcdn.net static.xx.fbcdn.net scontent-frx5-2.xx.fbcdn.net	184 KB
9	adnxs.com 6 redirects ib.adnxs.com	9 KB
6	twitter.com platform.twitter.com syndication.twitter.com	148 KB
5	googletagservices.com www.googletagservices.com	160 KB
4	amazon-adsystem.com c.amazon-adsystem.com	36 KB
4	facebook.com www.facebook.com	15 KB
4	google.com www.google.com adservice.google.com	816 B
4	ad4game.com cdn.ad4game.com ads.ad4game.com	105 KB
3	2mdn.net s0.2mdn.net	196 KB
3	prnt.sc 1 redirects prnt.sc	21 KB
2	quantcount.com rules.quantcount.com pixel.quantcount.com	555 B
2	google.de www.google.de adservice.google.de	272 B
2	facebook.net connect.facebook.net	67 KB
2	consensu.org quantcast.mgr.consensu.org	61 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	quantserve.com secure.quantserve.com	9 KB
140	20

	Domain	Requested by
21	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com prnt.sc googleads.g.doubleclick.net www.googletagservices.com
17	st.prntscr.com	prnt.sc st.prntscr.com
14	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com prnt.sc googleads.g.doubleclick.net
12	cm.g.doubleclick.net	9 redirects googleads.g.doubleclick.net
11	dsum-sec.casalemedia.com	5 redirects googleads.g.doubleclick.net
9	ib.adnxs.com	6 redirects googleads.g.doubleclick.net
8	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
6	googleads.g.doubleclick.net	e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com prnt.sc
5	www.googletagservices.com	ads.ad4game.com securepubads.g.doubleclick.net e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com prnt.sc
4	c.amazon-adsystem.com	ads.ad4game.com c.amazon-adsystem.com
4	www.facebook.com	connect.facebook.net
4	platform.twitter.com	prnt.sc platform.twitter.com
3	s0.2mdn.net	googleads.g.doubleclick.net e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
3	e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	www.google.com	prnt.sc tpc.googlesyndication.com e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
3	prnt.sc	1 redirects prnt.sc
2	scontent-frx5-2.xx.fbcdn.net	www.facebook.com
2	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	syndication.twitter.com	platform.twitter.com prnt.sc
2	ads.ad4game.com	cdn.ad4game.com
2	connect.facebook.net	prnt.sc connect.facebook.net
2	api.prntscr.com	st.prntscr.com
2	cdn.ad4game.com	prnt.sc cdn.ad4game.com
2	quantcast.mgr.consensu.org	prnt.sc quantcast.mgr.consensu.org
2	www.google-analytics.com	prnt.sc www.google-analytics.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	htlb.casalemedia.com	cdn.ad4game.com
1	pixel.quantcount.com	prnt.sc
1	rules.quantcount.com	secure.quantserve.com
1	www.google.de	prnt.sc
1	stats.g.doubleclick.net	www.google-analytics.com
1	secure.quantserve.com	quantcast.mgr.consensu.org
1	image.prntscr.com	prnt.sc
140	35

This site contains links to these domains. Also see Links.

Domain
app.prntscr.com
prntscr.com
twitter.com
www.facebook.com
www.google.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-18` - `2021-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
quantcast.mgr.consensu.org Amazon	`2021-04-24` - `2022-05-23`	a year	crt.sh
*.ad4game.com Go Daddy Secure Certificate Authority - G2	`2019-11-17` - `2022-01-16`	2 years	crt.sh
*.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-05-26` - `2021-08-24`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-05-17` - `2021-08-09`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh

This page contains 19 frames:

Primary Page: https://prnt.sc/14xb5pj
Frame ID: 8B2FCBA3169934DA1296C074D162F9D5
Requests: 57 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fprnt.sc
Frame ID: 76EE0570BA10B3AFC0D638999F8032FA
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.06c6ee58c3810956b7509218508c7b56.en.html
Frame ID: 211E38E2034B977D17DABD073C524956
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df76d7e36b9264c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2F14xb5pj&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
Frame ID: 8A13AB27D7BFCD9AC59534F59C39106E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df39aa59f5e0c33%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2F14xb5pj&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=14xb5pj
Frame ID: BA96A6A0DB0984A153408A50057DE207
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29955c9653ffec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Frame ID: 2F865B4736B078D7F7E4B81396024AC3
Requests: 11 HTTP requests in this frame

Frame: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 998C8273CCDDD9F87FBA3E1968BB2763
Requests: 1 HTTP requests in this frame

Frame: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 2D71E3C36F47BC0BE4D51F20CD8B30D0
Requests: 1 HTTP requests in this frame

Frame: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 15D046F15D92A89F37976767244A9D87
Requests: 15 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: BD90C094E618644F98BBAE7117832C2E
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4EC9BAD4B36DE3984F7725C972722AF9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIY6s7aqQEwAQ&v=APEucNV4ekEmhWhGSaQawhU5XofTQKwQherPJTZMxMX4qv4TIWNC2k2_3lYRQE7e1zCoBH9Q0tdwmKYUWdV3EWwV1L7__ovAqn-cqLjBfyBkQR6XytetYQ2BLQORgVVQU2Ei8jas9zivtF-wiplxWK4AyWyV-1mpE--8rbv6Eraubmpu-imdgFU
Frame ID: 88F918B8D6C1A2CF8B5CDF2D267BA3BB
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIY5KeNqgEwAQ&v=APEucNW7L5vJISbncVJWnMUwkKhjeW_3gyRBdAFjuOSjHLuZcBujzL9jQtcM4kXIuyudHER0T5nT2I-AugDrjDAE9hhyhzD7xyI9tSWSi1d-pQ_ap-Zb9186mMsKgRI4rdifQSxkTYTBnPD3ibxceBsw1EudcvTbh-gf4-GW-4Z7nCuAiC1NzdY
Frame ID: 04B65D5C83AEF5B6F1504239C7B1F334
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BQoqlpQ8xHLUzlbGottMxWg3crxAPvw7lGQ149o7ihUu3QP7Gb9yiHlbHa7OAhOFn4-9cIIcSDReOgkCdaigdu-dQUddv5HgT2y3OKSraZOULvkEjIl9nlz8ZLrqm3QU6GyGrkVlZVytflS6cUBCnc3NluZg&dbm_d=AKAmf-ByzMugv1_Da4RNyYfvAEvQJGk5XMFnKsKweQsuZ73GBp48YCLOF8y1JGmoZ3F0Fniuose_fDcVMh1Eao9oG50h_rbJ8Buh8e8dc2Ob7ibJwXu0dnJAKfKHMvwzQzqT7BK4iUCczB3eWnrTgO3ha7EBtNWP3YLO2BZ2UKF0fN7Xlc9HtZhcLQWEk4ETqz8BKlNsp6ximYcBecTFCw57B2xGFjPFIXY4kn3lvM3F47xTMrbORk1aT0Y6Ww0VWw1FGTOChJGEG4w2PJVdjbTi_SR4Rdtdfj9Pvl0pKTQrUodAw3d78mr_TjINckgAhgIAeHIqWhra1gXxX6h7RgdMs_Y-MFr2e7HTbUfCISDOn_z3LrW3FTGKGlxFC5nDwc7umyifq16sgOajmnn6ytO87wq1JRrBgrc8EtQw5s0vWa-s5_dEmp2qJblTfIZ9E4sLb_IUAyGGmjJP7n-5RMtlq3KPW0HE9B1Ou5c8hd5Y7XaCR-TCWuQyuey5AQjXQq5nWLrUsQLb3LGuAbPl9W6fJFZ1mJm4T7ZFw5S8oyi6kijiO4OFPGyiVumQG4gxK01hEG6JAaoL-uAx0iKHtjUPTO6CJy1vG0NOxdMq-Wjh1V7lvIEEJoyd46ThHXsfvESAQwc4zG_rxqNugSGsBY-ypG2KakMw1_D9KPbC9t6dJ7UOLqdvDhmE2apNNYnkajf_TONMLsPBcolAsRy86dUcborq9IfyBYn9a6kG1PagPlLoNZcfAtWcjaP00TyElA0tI-4kkio_2OHkfUuDcLKreZSm_SGJlik5A71l37kJGxDNjxwgbRAqZ53eRfsNqPheUawFBVJHXDLGyo8bFVqNiOMFdmzGGve-d2ouJRSOSqPWBnjtXLw1w3qmiv8ckQ9nd8m5f5DyBV4Zwus-RzfK0Nlyci-uDjR7jhFgs7KLr_DVkFkYk1fwu19ijvSXyV2BEW8JVp7_E4HN3bKkzpb33E1sLqCeM4fxcqq1Tib6uN20kA14l2Ci4t98TrDtLC762dTlW0TKbpmoDaBc-h7ZYFHvuGA5yba4pMIfzslyJhOxgG30-jGcpe3ziVHh3xKyuptH4px2sLjuKew2xst1Am-IdH9YvExexM4FqMrooZTtosI38X9aP640PNIRjF5BR5IfvkoKrLFRLbsR3nFUlxHRpybssAg9ObQT7b3mnuRwu016KcdhSp4lxRU37ZtSKavK5SZwmll5biwaawzXO_ZEVyCV8MLkOIP79qtF0KoOi6s6LA_rRisXYg74BMOq4gjNo-Z6nZaA77yDFVCNGM6NsM5LftSVYERNjchNTiXAETs-TwMMDF0wd48gwQXpvsq2bvORP2bWtg0BdfNhS1J0UySCNiENDWxylPj8CFZj1O540HIK-yovhI4Zbix7S5fkUQFbX_u150syxaN_b4o3jcy_e20KU33Rw1jyD61QAoVfmk2O0C4GjM-n3bjcOXyTCrL4E-zFYdbDIQHhzVGmMMjrb1z8IzMVe8v7Hk1U4s4hcuP6iKL78M-pD73e4aUqkR3WR0azPPIOXLO2r3_-G87Do11nRk7NL9Lb80arTE2vFic-ueJAS4VBY00cQTxdMCv54X0oxgQV_BKw3cHxIOr5KYFbLaokZJepLppqql_vBsqrNRs_Kj9SVTNqAODTMdEuKzdUBMENMJPfnVemJPlW_s-eibjF64UHPZRAfBCsb3SCUjWf-RYkG6zKi87NeHQZEY7NzoVEKJtKWDXLgaEj7UspzJor_6PmaJ_wG3cpwoOiwxZDegmLgAm3Rfe9NXUbrqPHhOSXEfwoA_UckH5CKxFD0gX5nwuzMcm4QKL55Yvrl9OEfilcp4Cusrx0VRmI8V1xm_mSYiH5fsJzGm2otQ8wC54yaA0SwTHL21ZUZUmW1xks3P3tkj-UHz9dOL83c2NyXi9MqlupLa9Fa-VlXnKRWSnJGfJP4wnTHUnxbY7KByyTq_jyEQw9aAf-AOTi-plFBcrHazYJb4l0ohzPEhMYA0qGFrBSR9i7UhQBuqTJ6LlIVBZVocQcvOfTzi9Ni9ojCw8bw84GuBiP4B3lkZo68qgFOkcdZxdcxevVg-82w2XbSPhrnslSEs8ZMafRLVPh4GD1neHUy4W4fdeyrNowmd28DZK0q0Do2pY4YdWIe8wo0eiUxCvAdkvgJMRFVrCq0S-knB7hGbcywpC5QgKhLf0e_6zvr5-vZqr9wgwRGeggvAB_zn4zkZDolVcnJk0_Okthm5V0HWyow9hK4Ntq_ZBob_bGAq4lMcEmXgfmG6CcirknYOGo4gKeT-AYx44ELIkLn4THJitVqMsz9Vn4pgi4f5-DYJNCLTEZ1wS1fuTFUPbUs9S3SlAUqjBwr5Eyxcm7wB7NibCDakV8KdAXh5EwyR47dAQpzFvFefkLAgB2adyywkDk7EmYbSPY5VoyEZZ4vPARyTy2J7PAlj9JZbFK3PihGg7zFSprwETzmw5tmU8yBNKWk3x--7js0lpv5KneCmQJGhCtLUTyuRfjhoOgVBx_LBtLbNT0yWOchkANWXrhYeWKKKQANF6KI9McnJ35BXJxyr1Clh3SWDOM52pma3148XKrrvthoU1X_vr15UoGkAeKBOfLk-Iy1DksCtUQme8IsFjAAfgZ9Gserk-YFRPOo6spLTwUPq5R0cArKRh3FSLCo0VZFgM0jMd2xA-l5Bila_GLyoEOlL89UZj8VCMLR4t9MRcss2AUpXq1JEeLyS8GNaWddrOnm_ORzl5JjmjpGIv95FZqc1QJLjnEl1dLcwafjkDlpiuJh7403Os3LJeR0vkXEptnbRWfKLzzQLuFMtqNRWNfQ3thJ_odSLsmIwSZxhpwQI7NzdwP9BNSkkGkjhALl74HnJH-I7h68dSYD9QCbUymJOWswSaYswiN-q1b0GslVT4-VY_wpmsEEtmV4psEiYvGrEHly7-p6wocFoj8IFRxRQuZI2HE-AZW-Unadf-g0fQEoD54kpYxrWDpK4ErjpuQ9CcmpIex_4CxDWUi2lWYh3FiAxtQcP2HbcNhE3fowKmNfVOBtDOnteHEROKUIiGAbri2UHiMcBGQ_kcdAEDmZO9-_oOIctlpKw2NxFR1OBM&cid=CAASFeRomlsOAsnWdNZ1BJRvs9r2IWETQA&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240
Frame ID: 74FEB21D426F108AD8F46C5F0C5ADC5B
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIYgpmNqgEwAQ&v=APEucNUpTOSBaGfRkq7itbtHw77WIbUe7e6U-s3KDeV70Hz-dR2PEkOq93uRvfAuFTGk6fPdNUyUtA_niW2LIW5L-SbMEV_3nRx02PIwcMRXEJg_OZcgPpqgE6tom0yX0L8SAMOZLtxYyFkM_N8w-XvWLajL9O12-89mzx4SHAZKmPWtYHnEBzY
Frame ID: 418C81316CE6229D5BCF0CB711CC4331
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-APOMed0JfuQR_wIdz3B0O2ZTC7ENbVPI5Az2KxmLloAZCDbT42dyeNbxn_b5IaJ7jTLPHNOSEt0llLI6h6UMVY0Vq50ttgIMpQVvv9XLFRlRgT2RE383Ka0J_XvdkAViTxh6EQjmLHR2vGm8x25TwqFxi5ig&dbm_d=AKAmf-Bc2RUDiGEbZviZVB23vireAOAxc7BycAs3EMZDJ9LXPPu2RirC-bu5O36fVJUpwAUAVhaEuCezQmjMJ5o1PU3fsD99UwBazhh098Vse73FjSKEPwRZ20b7_SoA-kNZ2vnti8-2MaKZ_SdQQUIfKAdt87YZqvKgj_ESg4SXR9ico5hpr2Mn092yMg601E5ji0ajZwjYn_UlvWbVB3nB07LDm_WLylBA1pzs2SM0f85GBeSsW6TlUWfCsx_V9jYVEfQdDFncK7ZQneTGEN6LJopNP8DJQfcBsqnHoIVyC61WAueDP1HxUj68GgCOd81Rbk9_aCZn6DFO9SkrB1sAVDIYwgbAgjBvVBOUrd6L8Q1MIZWkEdw7RJvzpXe0_P3TjpiI625ysVlsmvRb9pc2F5Z3gd8BHGnCNmmSqw27f1nQfJlT_476ra9GkdL2e15RR76RuJlJ5LXi8kwn1u_lc7mAChqJ4_BPc9hnM2mXAV39GvhI9ZLFRNH6fVcvPFJv0z8sv_vH8Xg2Y6TIWDn1SkX4oOXB4r3i9NnurNV9d_HmZ6SR2SPfxy6MogfySlmyUMsbAkG35tRwHsUFVHpwmsF2gYMaBEx2VlRSyBSss8_OcDiNtsEhBVIMwu87-OVth76CCqO2f7jTQmrAsccYi9DJPUnL7wGApuCv6jARhOPiMiQ7BTtSD_rhzalbhcMus6vBFBZMgFQXCp1y9VzTSausO30Ezq66IdB9gqV5MXxHw8JR46rywbIcNF2_GMPkM2_987MesrruvBpNnaB_lvDi2GBXOym5FWuSxxkV5MXd9KU0LRTzSQdV7FhaUTm45i-V_sMZ8KQ4SauA1p1Nrd5SJDDDGTQw2kK4XR11aMIBy0x5O3rOxL2hxMaW44SLAA5auINb_kJlFwvX9vFf0e_My2qJ2FLxOojjgaFt2LbMnOY2aLh4rudEpmC3FH4IWSvXNluvftJePWk-Oz4SbrbhcgGI_Qk7Iv3a43OHRMnogBZtUMB3nVWTnFuYWlrhaxi3_0t_9-lJmQMUcPSWGULBknCLwmgNEK9Jnfw9hpqCi6lph95DN154hcLJvAEysr59f_sPr0tCQ5yZ6npI9Nhzuyxp0BH9abj0q-SNqrwQiiWOfDhd7DHOME7eIUH7hEBaZn2_F6Zt-ZHypIABQtgI7X8WKGYulE7B62-iqr-sCdT2xa4nCXk_qLtsvj0I7jmuH2bkVG75qj0HrVwSPJPyKf8Lq7BRHgYln400YU1t4r4QQ5IyiLzvbqlun1TxCd8Ck53nD-B7E_YR7MMeR5yV5EaHJbENkKS-yhrDQ7p6YwIHuv9qyb6DBpLkH9ewd7z-ftY5vUl2NuWR6qRVL7V2dH9iQ6iQP9jvMVPAauuzAbHREZwLihkCYzL8_rFMah0IXXG5xRY61nMerWXBfiQMfyxL1GP9642vi7ap1Gbww5JsMaGtZE703in0pXKX-xSVnrKLd5DOXBV_3x9di6r2TL29gWQLAiqFPVRLkFOjAwElQeHLqYyocOqsbyc98bg32y5IC77e6It5Utk1hKqlZciTeVUG7w_F_1DKetWO2P0vWZF5nK3WHCs8yd6On7hXIE0_Zx78IPcRZ9jUls1nf3Ntcq358AHT_mtv1_bebEZKDnyU9Ok-T3rClaVl_sIEtMqFkunystM2na3VviRWD_anZKikrNCNRUKvUH6Tq8_QlIBFiDLDVtGMX8SX4NXUalX467cfm1Bw7OdpviLHztUygATjUrivx8BmAfqv7qeNOlKIEA3vMuRT7X-sA5ff106jJ7ciPvb8AZkwuGeioIv3QOWcK379iYya4A_OoainwpbImxDIWw5o7YUWG4ZsZDGeZd1RwcCpM6Ft_zfGIIZ4zXr4CimWQHEFUUdP-nH2bk4S0FwMLCpWQcBwPdt4ZTmtVRDaaYB4LjpKMrH4zQ73Kay2Kh9ZHXelTj8i3S4SvUKyaYJCTiP_p66QMs3t9wXuTA1b2Y9YTpW0jjHJ1VkhPZCeiG9ueWpbbzktuejtEjB4pMsEzUptWU4b-MaBhi1CAI8QxCHfYEYySP5x5PVJ5d9A8J1h8oRxixOjlV6Z1B5Qm8cd09XaokmSpugknnpM9905skQaHwrIkWTHGagNIswXSlbfc_523_O5fIhYArBs-VrAFi7DerRhUhAGWrJnCEwRE1YCeWQRs273AdXoZt3YJxu7s29mBDa4P4zp4AoNj-JuqrydwdxiaUTch3QxdmyYAud3sSaWreGEfjQAj2jI-hRgTyk8-iNzlpFPKXX-18LqWWUBh-cQw__bEy_QfxxcPcPKb-KgS_zTt0uguHv9Lng5szKtSKYOowuz0LVbXL8k3lVPBMAUrjJJsVNoQaC95LvldnmLbGn0TrGdTgZWtal22gdbML2s_3aI2PA5sj-Pf8F95jsW4GnK6FRbi61R8cXPxd4_DBo7XMuHN0skoLs9vU63a6KKRT3I0idr-k-Qdvla2ZWpcTV6QDfWxLVfSRfDEVolpWNQ3TzvfJIWe_JF6rosjRK9a-2YyhefJW1cuWTzMnMhgNPZrjlouu0BzD6vdzAapWeZR_zyO8ncQtgkx0lPqJuSQ_I64VgKdXAk-JHMr4jI7slh9rVO43ONw5dfG0IOWtvw4P5yGA05tcpmLzaYYNA3ipurL5n23Mvo1yxYcVtmvRW10Pp0YSESQ6O8KXa9xzIF-8C95HOZU4uD0P0wyhZOlFdq149y2qTPIhcivJsmlisn2jiyFKwY1-wPUk77nXaGyv1X6wMZ4GKF2uMYWSE1ltlpG35yixmKw2wDfCheiFUF7M_ASlWuI0otpP3uSIti64RjA3oX4SItCtKpYVQH09ep_Chpiz58CHnAmxoyE79zaJlJLHOOr84Qy6TemW6KsELq6vdLrxAHJ5y7PpqVaQJrG_FysMCuvU98L6piBfZI3zYqJG90sagmSZtbxK6-wuBvpUE6Ke5J4uf4n3ZpduD00MN1PVXOKNXI_MEOIxWWZI7-Hz1Z1ptyTwLknDeSCFsBxI8jX10TgK19kZmGvPA2nV9cl6blQbtJ6A_YJ_WPrAeAa2DjCeJHp9blp9F46ieR8be_725Sm7K7nMp3ULBIADw&cid=CAASFeRo1MyVkqAr9Wn5zdt4uWEu2ZhSFw&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240
Frame ID: 61851DB973453A07B06D20B508AFDD94
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 330DEA4EF01CF74E3873522A37D54DBB
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 77B23AF4D3B46CC886E56FF7BBA7B9D5
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 32752C682FE06CF1C90F58CC4584A815
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://prnt.sc/14xb5pj HTTP 301
https://prnt.sc/14xb5pj Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

140
Requests

99 %
HTTPS

63 %
IPv6

20
Domains

35
Subdomains

36
IPs

5
Countries

1494 kB
Transfer

3942 kB
Size

3
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://app.prntscr.com/translate-lightshot.html
Title: Add your language

Search URL Search Domain Scan URL

URL: https://prntscr.com/gallery.html
Title: Sign in

Search URL Search Domain Scan URL

URL: https://twitter.com/Light_shot

Search URL Search Domain Scan URL

URL: http://www.facebook.com/Lighshot

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/
Title: Captured with Lightshot

Search URL Search Domain Scan URL

URL: http://www.google.com/searchbyimage?image_url=https://image.prntscr.com/image/lnLgfkhRTFKPVcgoPm-png.png
Title: find similar

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/download.html
Title: Download

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/tutorials.html
Title: Tutorials

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/faq.html
Title: FAQ

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/help.html
Title: Help

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/advertise.html
Title: Advertise

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://prnt.sc/14xb5pj HTTP 301
https://prnt.sc/14xb5pj Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 96

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIswEmp2GfiPC89YLUlRzpk&google_cver=1

Request Chain 97

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMEyidhi5Y814tpee4ePzAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

Request Chain 98

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEO-VQ_DOrdWkBxcTtAnUnHg&google_cver=1

Request Chain 99

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

Request Chain 105

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

Request Chain 106

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMEyidhi5Y814tpee4ePzAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

Request Chain 107

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1

Request Chain 108

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

Request Chain 109

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

Request Chain 110

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMEyidhi5Y814tpee4ePywAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

Request Chain 111

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1

Request Chain 112

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

140 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 14xb5pj Show response
prnt.sc/
Redirect Chain

http://prnt.sc/14xb5pj
https://prnt.sc/14xb5pj

16 KB
5 KB

181ms
166ms

Document
text/html

104.26.14.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.14.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a451bdd9ee2c9a779de9e9a85ab2e646ae64e70b04d20c0d9cb364e20e89d1c0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: prnt.sc
:scheme: https
:path: /14xb5pj
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
cf-request-id: 0a944679fc00004e6893991000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OG6TRXkICbpOh%2FiREQgxptOh8wCKqnemlcME0db32JDe8QiJds7SMPyUpV4gYzyxgd9Lryfet%2BIh17ZhvwOk0zSTbMTeexN17i4Y14d8G56AmBqZ"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65cd736ffe2b4e68-FRA
content-encoding: br

Redirect headers

Date: Wed, 09 Jun 2021 21:28:39 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://prnt.sc/14xb5pj
CF-Cache-Status: DYNAMIC
cf-request-id: 0a9446797e000096ce04243000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=6U27Y%2BPCgPZpYpw4t7iXJTUE5S09CLD5sYHfVci3%2FojWnbk7pfLyXtFmKrosT64u3NSZmaTKI4PHn8mIzj7d9lgLZqnVbE9%2BJ8jnLgZHwkAwDZde"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 65cd736f3d1d96ce-FRA

GET
H2 200 main.css
st.prntscr.com/2021/04/08/1538/css/ 57 KB
9 KB 45ms
29ms Stylesheet
text/css 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b67ae2416a166f4238581097d4ce984a69d9662aab12ecc4b2b881c45164e36

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 477
etag: W/"606f23b9-23b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1800
cf-ray: 65cd73712a88d6f5-FRA
cf-request-id: 0a94467ab70000d6f5bc81b000000001
expires: Wed, 09 Jun 2021 21:23:49 GMT

GET
H2 200 jquery.1.8.2.min.js Show response
st.prntscr.com/2021/04/08/1538/js/ 91 KB
32 KB 54ms
39ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.1.8.2.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 477
etag: W/"606f23b9-827c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65cd73712a8dd6f5-FRA
cf-request-id: 0a94467ab70000d6f5c7168000000001
expires: Wed, 09 Jun 2021 21:22:39 GMT

GET
H2 200 script.mix.js Show response
st.prntscr.com/2021/04/08/1538/js/ 69 KB
23 KB 56ms
40ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/script.mix.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45b8a13dcb32541a7703dec7eba4c4195cb62ed00029c2ea5a0b61fd16864b55

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 477
etag: W/"606f23b9-5e6a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65cd73712a8ad6f5-FRA
cf-request-id: 0a94467ab70000d6f528b92000000001
expires: Wed, 09 Jun 2021 21:24:37 GMT

GET
H2 200 lnLgfkhRTFKPVcgoPm-png.png
image.prntscr.com/image/ 11 KB
11 KB 47ms
29ms Image
image/webp 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.prntscr.com/image/lnLgfkhRTFKPVcgoPm-png.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Magic
Resource Hash: 0abf5e86ccd194d29086dda85c658093039d7bda4693dcd1816bc04cc665ecb3

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 6775
x-powered-by: Magic
content-disposition: inline; filename="lnLgfkhRTFKPVcgoPm-png.webp"
content-length: 10836
cf-request-id: 0a94467afe000016e644a87000000001
last-modified: Wed, 09 Jun 2021 17:29:52 GMT
server: cloudflare
etag: "9479cf318604471aa352d269223d6004"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
access-control-allow-methods: GET, OPTIONS
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
cf-polished: origFmt=png, origSize=21335
accept-ranges: bytes
cf-ray: 65cd73719f6516e6-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
cf-bgj: imgq:100,h2pri

GET
H2 200 14xb5pj
prnt.sc/ 16 KB
16 KB 106ms
104ms Image
text/html 104.26.14.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prnt.sc/14xb5pj

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.14.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /14xb5pj
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: prnt.sc
referer: https://prnt.sc/14xb5pj
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://prnt.sc/14xb5pj
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0PHJKGx8LLK%2Fo63G4R42Kf4zPGQ4NPrQGMrUDeYmU1n8FGCSY6TFOVXv177tUbwSlyRYIKLxQhN7M0Cz3Cx8FsDItEA3zP5fimVyGTHHZpPaMZhQ"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 65cd737179c94e68-FRA
cf-request-id: 0a94467aee00004e68c319a000000001

GET
H2 200 image-helper.js Show response
st.prntscr.com/2021/04/08/1538/js/ 3 KB
1 KB 25ms
25ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/image-helper.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83817752fb260ff66b3bca1471bb20dbb6a1e6a17174c657efe0912ad161b382

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:07 GMT
server: cloudflare
age: 387
etag: W/"606f239b-a2f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65cd73716af3d6f5-FRA
cf-request-id: 0a94467ae40000d6f5de28e000000001
expires: Wed, 09 Jun 2021 21:25:59 GMT

GET
H2 200 footer-logo.png
st.prntscr.com/2021/04/08/1538/img/ 630 B
833 B 23ms
21ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/footer-logo.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca2c1abcf4b76a46306bc7f1a607a459371ccf5e7213aae988c33b4dabb1758

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 380
cf-polished: origFmt=png, origSize=1848
content-disposition: inline; filename="footer-logo.webp"
content-length: 630
cf-request-id: 0a94467aee0000d6f5f52b5000000001
last-modified: Mon, 05 Sep 2016 15:49:19 GMT
server: cloudflare
etag: "57cd93ff-738"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:35:52 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73717b21d6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 jquery.smartbanner.css
st.prntscr.com/2021/04/08/1538/css/ 4 KB
1 KB 26ms
26ms Stylesheet
text/css 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/css/jquery.smartbanner.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d91d13fd8f9d253a8213aeee7ebaa7e073683fc600a3d82902c3c669b8ffdee7

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:31 GMT
server: cloudflare
age: 477
etag: W/"606f23b3-ef0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1800
cf-ray: 65cd73716b01d6f5-FRA
cf-request-id: 0a94467ae50000d6f51e83d000000001
expires: Wed, 09 Jun 2021 21:25:27 GMT

GET
H2 200 jquery.smartbanner.js Show response
st.prntscr.com/2021/04/08/1538/js/ 8 KB
3 KB 24ms
22ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.smartbanner.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b185d89e437f1591af8c51d5e6dad41d3666e22a81931ee9df22e2cfdacaddb

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
age: 417
etag: W/"606f23b9-aec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 65cd73717b20d6f5-FRA
cf-request-id: 0a94467aee0000d6f50b316000000001
expires: Wed, 09 Jun 2021 21:26:23 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5278
date: Wed, 09 Jun 2021 20:00:41 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Wed, 09 Jun 2021 22:00:41 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/ 3 KB
2 KB 84ms
33ms Script
application/javascript 2600:9000:218c:2200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:2200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: br
last-modified: Wed, 10 Feb 2021 21:13:06 GMT
server: AmazonS3
x-amz-cf-pop: CDG50-P1
etag: W/"9074c1a966aada274b63c92859c4a3ec"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 6a29b506c0dc975f5344fdc44215aa70.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-id: fsTxhRJUhLFMrSnuxjySyByshLhu71dC3gcwZU4cos6c7RaQ5Y-ICA==

GET
H2 200 page-bg.png
st.prntscr.com/2021/04/08/1538/img/ 5 KB
6 KB 19ms
19ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/page-bg.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86a1b8f94f48c4e82d2616d4c581f10a34ff447a2bd95be08714fa0d19ba3f51

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 257
cf-polished: origFmt=png, origSize=7116
content-disposition: inline; filename="page-bg.webp"
content-length: 5608
cf-request-id: 0a94467af10000d6f51d919000000001
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
etag: "606f23b9-1a7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:54:22 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73718b27d6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 header-logo.png
st.prntscr.com/2021/04/08/1538/img/ 4 KB
4 KB 19ms
19ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/header-logo.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40ec0b04019845302a5052b4689b5d3477c9717dca73243e5faf7cf98f3af564

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 257
cf-polished: origFmt=png, origSize=7995
content-disposition: inline; filename="header-logo.webp"
content-length: 4148
cf-request-id: 0a94467af10000d6f504970000000001
last-modified: Thu, 08 Apr 2021 15:39:37 GMT
server: cloudflare
etag: "606f23b9-1e52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:45:55 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73718b2ad6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 button-download.png
st.prntscr.com/2021/04/08/1538/img/ 314 B
491 B 21ms
20ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/button-download.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e926f30958d0c21d088e6a671d3356a3c3fab9cc6220b8e408f19d868a7dc5c8

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=1404
content-disposition: inline; filename="button-download.webp"
content-length: 314
cf-request-id: 0a94467af10000d6f53038f000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-57c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:51:42 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73718b2cd6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 button-icon-sep.png
st.prntscr.com/2021/04/08/1538/img/ 40 B
239 B 18ms
17ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/button-icon-sep.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a1120cc303b1c6ee6d548a5b418c2707b59de0c1f13c8ab870ca4e734b6acc

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 257
cf-polished: origFmt=png, origSize=928
content-disposition: inline; filename="button-icon-sep.webp"
content-length: 40
cf-request-id: 0a94467af20000d6f5f62e8000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-3a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:47:09 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73718b2ed6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-twitter_gscale.png
st.prntscr.com/2021/04/08/1538/img/ 374 B
560 B 20ms
20ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-twitter_gscale.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a3a63b2ac124cb9a194ec01ea1f0d3123e4019bf658c6f47a77b4faea84c079

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=1535
content-disposition: inline; filename="icon-twitter_gscale.webp"
content-length: 374
cf-request-id: 0a94467af20000d6f5e923a000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-5ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:52:18 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73718b30d6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-facebook_gscale.png
st.prntscr.com/2021/04/08/1538/img/ 296 B
476 B 22ms
22ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-facebook_gscale.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a093d2047e1a59b7103810b947780e5f94d865915cb923ebcaa7e50f557c2102

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 188
cf-polished: origFmt=png, origSize=1325
content-disposition: inline; filename="icon-facebook_gscale.webp"
content-length: 296
cf-request-id: 0a94467af30000d6f5d09a4000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-52d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:55:31 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd73718b31d6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 async-ajs.min.js Show response
cdn.ad4game.com/ 3 KB
2 KB 53ms
15ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/async-ajs.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Mon, 07 Jun 2021 11:21:33 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: "60be013d-ca8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes
content-length: 1451

GET
H2 200 icon-edit.png
st.prntscr.com/2021/04/08/1538/img/ 214 B
427 B 19ms
18ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-edit.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb09c3720b53d8651d6f5825cf643e6249aefbe82a1ba1417d230cdb9b36cba6

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 84
cf-polished: origFmt=png, origSize=3153
content-disposition: inline; filename="icon-edit.webp"
content-length: 214
cf-request-id: 0a94467b1d0000d6f528b98000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-c51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:57:15 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd7371cb95d6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-camera.png
st.prntscr.com/2021/04/08/1538/img/ 158 B
358 B 21ms
20ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-camera.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bfd2fa3b3b5924e3655bcf9f63427e792bd8572b7ed0992373bdb4b21c7cb89

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 118
cf-polished: origFmt=png, origSize=1089
content-disposition: inline; filename="icon-camera.webp"
content-length: 158
cf-request-id: 0a94467b1e0000d6f5ee0e1000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:33:57 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd7371cb96d6f5-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-abuse.png
st.prntscr.com/2021/04/08/1538/img/ 126 B
299 B 19ms
19ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/04/08/1538/img/icon-abuse.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2875a6fc4266fec00a383377cb4530b6407912897b0727e26249d89c6dfe0359

Request headers

Referer: https://st.prntscr.com/2021/04/08/1538/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
cf-cache-status: HIT
age: 84
cf-polished: origFmt=png, origSize=327
content-disposition: inline; filename="icon-abuse.webp"
content-length: 126
cf-request-id: 0a94467b1e0000d6f50b318000000001
last-modified: Thu, 08 Apr 2021 15:38:42 GMT
server: cloudflare
etag: "606f2382-147"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Wed, 09 Jun 2021 21:48:31 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 65cd7371cb98d6f5-FRA
cf-bgj: imgq:100,h2pri

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 29ms
14ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=238984568&t=pageview&_s=1&dl=https%3A%2F%2Fprnt.sc%2F14xb5pj&ul=en-us&de=UTF-8&dt=Screenshot%20by%20Lightshot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1798447798&gjid=1507580537&cid=126720193.1623274120&tid=UA-12353127-1&_gid=844240275.1623274120&_r=1&_slc=1&z=400201223

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
api.prntscr.com/v1/ Frame 0
0 349ms
347ms Preflight 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.prntscr.com/v1/
Protocol: H2
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://prnt.sc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-request-id: 0a94467b35000016e653883000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 65cd7371e81016e6-FRA

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 25ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d79d9c1b00fde236a4c9ed8bba65588d6c088b9cc2d57f9f68985d77ce1b283e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: NWE/YXNiF7AnRqoR0uv6sg==
cross-origin-resource-policy: cross-origin
expires: Wed, 09 Jun 2021 21:39:02 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1779
x-fb-rlafr: 0
x-fb-debug: srVdmz2QRJ7PcK86L4Hsv/R2UaMGQZ9JVeB5frI0Y523p4M/CytBkJqdHpg73C99UGAclFpOKuTidsesjgpr+Q==
x-fb-trip-id: 2052514463
x-fb-content-md5: 056346b0d9f6a27704ccc7621dba4705
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 09 Jun 2021 21:28:39 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "ae5f211c316ec3e7f6dc8aa7fdd9da3b"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 29ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/14xb5pj
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674D) /
Resource Hash: a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 09 Jun 2021 21:28:39 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 641
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28779
x-tw-cdn: VZ
Last-Modified: Wed, 28 Apr 2021 17:57:32 GMT
Server: ECS (frb/674D)
Etag: "9eb59e5602fef4b3ebf6090856ff21db+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

POST
H2 200 / Show response
api.prntscr.com/v1/ 92 B
327 B 383ms
383ms XHR
application/json 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.prntscr.com/v1/
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/js/jquery.1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c9935e1daafc929a9866a206e769e084cd83f19d436ca22887adc2798408646

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
cf-ray: 65cd737418b0d6f5-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-request-id: 0a94467c910000d6f52826a000000001

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 28ms
8ms Script
application/javascript 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Wed, 16 Jun 2021 21:28:40 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 234 KB
59 KB 27ms
27ms Script
text/javascript 2600:9000:218c:2200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:2200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2ddef05ee7b0caa6fd9be281a5b4e53ada42bff7814578d748144f2f9181e476

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:27:42 GMT
content-encoding: br
age: 58
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Thu, 13 May 2021 19:03:54 GMT
server: AmazonS3
etag: W/"2848b39634e3b71d7b4f01531f83807a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 6a29b506c0dc975f5344fdc44215aa70.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-pop: CDG50-P1
x-amz-cf-id: DP9BSGZPXgDH7Td38S2yZ8FS2yJYjbS_FKEMlj-Q_G_sFnkQJGPw3g==

GET
H3-29 200 all.js Show response
connect.facebook.net/en_US/ 221 KB
65 KB 15ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=151af7d87db37aa89a54d8bac95aede8&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ada6f258fe717047a5cf0799e877326641e3a8a63421159e7315c3e3d95c6e58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: uahU9OBdapR9zzulq80CSw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 66276
x-fb-rlafr: 0
x-fb-debug: 6leCjmOir1YKXgNRHrhI4LuDyH8webtgr5+xQOiVl3N33BCOOcsOIfg0q1BxeX8J1b4WoVWB4UHtXk7sPmuB+w==
x-fb-content-md5: 4ce9a11d88a2fc8a43fc0021ebd5a997
x-frame-options: DENY
date: Wed, 09 Jun 2021 21:28:40 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "452ff29cd4799802ec29353cd8b4ee61"
timing-allow-origin: *
priority: u=3,i
expires: Thu, 09 Jun 2022 20:22:21 GMT

GET
H2 200 prebid.js Show response
cdn.ad4game.com/ 261 KB
98 KB 17ms
17ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/prebid.js
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 733f44e4d42f00e0a8c267d516e9f6939d36f65ceb3bf851998475b9f6650d3f

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Fri, 28 May 2021 08:02:31 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: "60b0a397-412ac"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes
content-length: 99905

GET
H/1.1 200
OK async-ajs.php Show response
ads.ad4game.com/www/delivery/ 9 KB
3 KB 409ms
108ms Script
text/javascript 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g8410725&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F14xb5pj&c=UTF-8&z=60918,70076,60916&b=7&x=7
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: 93023edbec0bce9f3849ffcb8fd327757cf9992249495d63e43c2762e7cf1f3a

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-servername: ads.ad4game.com\ 80\ 81
Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:40 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="CUR ADM OUR NOR STA NID"
X-serveraddr: 10.100.0.151
Cache-Control: no-cache, no-store, must-revalidate
X-host: ads.ad4game.com
Connection: close
Content-Type: text/javascript; charset=UTF-8
Expires: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
82 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c0a::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-12353127-1&cid=126720193.1623274120&jid=1798447798&gjid=1507580537&_gid=844240275.1623274120&_u=IEBAAEAAAAAAAC~&z=111519849

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 09 Jun 2021 21:28:40 GMT
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK widget_iframe.06c6ee58c3810956b7509218508c7b56.html Show response
platform.twitter.com/widgets/ Frame 76EE 319 KB
103 KB 7ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fprnt.sc
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6760) /
Resource Hash: 5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 524435
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 09 Jun 2021 21:28:40 GMT
Etag: "dab7ee9ff99366614e06e117bab5e542+gzip"
Last-Modified: Wed, 28 Apr 2021 17:56:54 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6760)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105298

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
119 B 17ms
16ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-12353127-1&cid=126720193.1623274120&jid=1798447798&_u=IEBAAEAAAAAAAC~&z=146038192

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 17ms
17ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-12353127-1&cid=126720193.1623274120&jid=1798447798&_u=IEBAAEAAAAAAAC~&z=146038192

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-n-ZGqfdsg5894.js Show response
rules.quantcount.com/ 2 B
345 B 23ms
6ms Script
application/javascript 2600:9000:2156:c400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-n-ZGqfdsg5894.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:c400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:08:15 GMT
via: 1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront)
server: AmazonS3
age: 1225
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA50-C1
content-length: 2
x-amz-cf-id: T3gBDyH-_gY5tNMWyCDEr1OyFs_5hEq7ClftoZn39Aj1m5ZyvYcdRA==

GET
DATA 200
OK truncated
/ 29 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f238dd6e2eb271ea73d65954bda15ae86ed39caeb69c39ee03b8966002df23c6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 53ms
40ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=154822244543652&input_token&origin=1&redirect_uri=https%3A%2F%2Fprnt.sc%2F14xb5pj&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=151af7d87db37aa89a54d8bac95aede8&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: coSAFCBR83TOlQ6HjobuVCbNsDGfxpNGtHtF+WGM4+fvFK74t7xPH8EKycF/29cm43FKfcHnYStxpnIkOWP+JA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 09 Jun 2021 21:28:40 GMT
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pixel;r=131798903;source=choice;rf=0;a=p-n-ZGqfdsg5894;url=https%3A%2F%2Fprnt.sc%2F14xb5pj;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=1;gdpr_consent=;ref=;d=prnt.sc;je=0;sr=1600...
pixel.quantcount.com/ 35 B
210 B 10ms
9ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantcount.com/pixel;r=131798903;source=choice;rf=0;a=p-n-ZGqfdsg5894;url=https%3A%2F%2Fprnt.sc%2F14xb5pj;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=1;gdpr_consent=;ref=;d=prnt.sc;je=0;sr=1600x1200x24;dst=1;et=1623274120104;tzo=-120;ogl=site_name.Lightshot%2Ctitle.Screenshot%2Cimage.https%3A%2F%2Fimage%252Eprntscr%252Ecom%2Fimage%2FlnLgfkhRTFKPVcgoPm-png%252Epng%2Cdescription.Captured%20with%20Lightshot%2Curl.https%3A%2F%2Fprnt%252Esc%2F14xb5pj%2Ctype.website

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:40 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 76EE 256 B
441 B 124ms
110ms Fetch
application/json 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=3be266191f091ce6c4ae7b138ec996e6c5c9cd91

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Fprnt.sc

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:39 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 21:28:40 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: c1ccbd310f0313a88887637f22a7dfbae841bd68d865cf9149039a0d0c4e7c95
content-length: 176

GET
H/1.1 200
OK button.5573c974dc31bbdab5ea7923a0bd5cf3.js Show response
platform.twitter.com/js/ 7 KB
3 KB 6ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.5573c974dc31bbdab5ea7923a0bd5cf3.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674D) /
Resource Hash: e05edf2ae58e3a9f1d2a84d32a8b216fd0aece46f527b58dcbce75255989ea88

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 09 Jun 2021 21:28:40 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Apr 2021 17:56:41 GMT
Server: ECS (frb/674D)
Age: 524437
Etag: "382be2960021b88f6ce982d997cdbd01+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2294

GET
H/1.1 200
OK tweet_button.06c6ee58c3810956b7509218508c7b56.en.html Show response
platform.twitter.com/widgets/ Frame 211E 32 KB
12 KB 6ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.06c6ee58c3810956b7509218508c7b56.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674D) /
Resource Hash: 483cc9a5ece5c92d5a2f1ea6e92e7f8bc29844a6c06bf36c0349d70334685dc7

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 524435
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 09 Jun 2021 21:28:40 GMT
Etag: "a87932e0f094e1fb4cced05f7d97ab94+gzip"
Last-Modified: Wed, 28 Apr 2021 17:56:47 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/674D)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 12228

GET
DATA 200
OK truncated
/ Frame 211E 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
352 B 116ms
116ms Image
image/gif 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fprnt.sc%2F14xb5pj%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22light_shot%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1623274120396%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%2282e1070%3A1619632193066%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 09 Jun 2021 21:28:40 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c1ccbd310f0313a88887637f22a7dfbae841bd68d865cf9149039a0d0c4e7c95
x-transaction: f500ab57a42e4551
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 61 KB
21 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g8410725&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F14xb5pj&c=UTF-8&z=60918,70076,60916&b=7&x=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42230c47b07c6d451bf857c1e7345816f07a1d18071e416ea3d326449f28f08a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "898 / 113 of 1000 / last-modified: 1623267630"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21268
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:40 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 70ms
36ms Script
application/javascript 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g8410725&h=0&siteurl=https%3A%2F%2Fprnt.sc%2F14xb5pj&c=UTF-8&z=60918,70076,60916&b=7&x=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: Server /
Resource Hash: 5b6f3806c04b7c91d2ee5cf8f42b31343a9d33ea62ad9d0506cfa1be078477d3

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: E3YSXBJMjZlokKHa7.qL9ZqkRLiXb9jY
content-encoding: gzip
server: Server
x-amz-cf-pop: CDG50-P2
etag: 6bda376aea84df42909484ff0d20f22a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 f4582372b9151740be645b6db921848f.cloudfront.net (CloudFront)
cache-control: public, max-age=900
date: Wed, 09 Jun 2021 21:28:40 GMT
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: ZVhmrVA3XxAi2vJiQCYn7VyhN7AQhpb7MG0K3-nQQSW3-JZAZiCs9w==

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 24 B
366 B 29ms
12ms XHR
application/json 2.21.111.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=619471&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221018a18555e132%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fprnt.sc%2F14xb5pj%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A3%2C%22ren%22%3Afalse%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22indexexchange.com%22%2C%22sid%22%3A%22193578%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22215412d769b6a4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2235a05f69d9d93b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2248954a98c20aba%22%2C%22ext%22%3A%7B%22siteID%22%3A%22610018%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.111.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-111-28.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: af7379a0dfcaf397fb0f515f97c9e6139b570235f96ddeaf5581a02012fa937b

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[DE], RC:[SN], CN:[EU], CIP:[144.76.109.30], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://prnt.sc
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
x-ak-client-geo: 12
expires: Wed, 09 Jun 2021 21:28:40 GMT

GET
H/1.1 200
OK bid Show response
ads.ad4game.com/v1/ 5 KB
2 KB 510ms
312ms XHR
application/json 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/v1/bid?if=0&siteurl=https%3A%2F%2Fprnt.sc%2F14xb5pj&size=970x90%3B970x90%3B300x250&id=645f23f448178e%3B750c30ef7aefaa%3B804c8d423f3de3&zoneId=60918%3B70076%3B60916&gdpr=%5Bobject%20Object%5D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: b65bfbe401fe0ec72a7776a594a60c4234813227abf4710cf65b700c8ecc9001

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Jun 2021 21:28:40 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://prnt.sc
Transfer-Encoding: chunked
Connection: close
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
X-Application-Context: application:12061

GET
H2 200 pubads_impl_2021060801.js Show response
securepubads.g.doubleclick.net/gpt/ 318 KB
112 KB 35ms
14ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

8a19707bd88a29100f84e106852ddd5bfeebe1fe562960c4932d1347210d13a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Jun 2021 08:38:25 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114129
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:40 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
304 B 26ms
26ms XHR
text/plain 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=852e3ca3-c387-44e4-a5c1-67c46495a8c4&u=https%3A%2F%2Fprnt.sc%2F14xb5pj
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 18:45:51 GMT
via: 1.1 f4582372b9151740be645b6db921848f.cloudfront.net (CloudFront)
server: Server
age: 9769
x-cache: Hit from cloudfront
access-control-allow-origin: https://prnt.sc
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-pop: CDG50-P2
x-amz-cf-id: 2p-UU208u1BROfA6WIIPbdgFsB0RJSAl1ZRVxDiddgVDPj9noBb9RA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
366 B 40ms
40ms XHR
text/javascript 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fprnt.sc%2F14xb5pj&pid=8rZqE0QjcquM5&cb=0&ws=1600x1200&v=7.65.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F60918%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F70076%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F60257202%2F60916%22%7D%5D&cfgv=0&pubid=852e3ca3-c387-44e4-a5c1-67c46495a8c4&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
via: 1.1 f4582372b9151740be645b6db921848f.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CDG50-P2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: vq73-nWJXcVqVSONR-Xcn-5RxxMeH-bZGVY9N1elbdliTw_XXReEog==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 47ms
15ms XHR
application/javascript 52.222.200.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.200.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-200-121.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 13:06:27 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 30134
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 05:49:36 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: eEYYOb32LZFr6yGAi8hXG4401uAIPew2
via: 1.1 c9eda0567a1d169784ebe65d259cdee9.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: CDG50-P2
content-type: application/javascript
x-amz-cf-id: kNFujxSwO9wdPsSgirh47xa5macf5nBrvAldJ3ABmW7XDULhVZbaQQ==

GET
H3-29 200 like.php
www.facebook.com/plugins/ Frame 8A13 0
0 39ms
38ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df76d7e36b9264c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2F14xb5pj&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=151af7d87db37aa89a54d8bac95aede8&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df76d7e36b9264c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2F14xb5pj&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
content-type: text/html;charset=utf-8
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
x-fb-debug: hCaU7KnfsyESOCh7JzxMgmknPrJfaLsLl5eUmZoiat5qvy2pefIxd9EG1GTnHqo/19M5qfCqhXBq5I4N1nByJg==
content-length: 0
date: Wed, 09 Jun 2021 21:28:40 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3-29 200 comments.php
www.facebook.com/plugins/ Frame BA96 0
0 34ms
34ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df39aa59f5e0c33%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2F14xb5pj&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=14xb5pj

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=151af7d87db37aa89a54d8bac95aede8&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df39aa59f5e0c33%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2F14xb5pj&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=14xb5pj
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-xss-protection: 0
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
content-type: text/html;charset=utf-8
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
x-fb-debug: LY1Wi0kAZmmd4c9SUqIeaRWYtXnDckBjB0ViRGIbvp0aWADaumnMFucJBluImI48KjyATWDMWiYG1fVCEM/XWA==
content-length: 0
date: Wed, 09 Jun 2021 21:28:40 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H3-29 200 like_box.php Show response
www.facebook.com/plugins/ Frame 2F86 48 KB
15 KB 83ms
83ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29955c9653ffec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=151af7d87db37aa89a54d8bac95aede8&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bec12a29f78481199a046b8a7f8f6163d1b3c72f39bfa8ed7f9b25722ff208a0

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29955c9653ffec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
x-xss-protection: 0
content-encoding: br
x-content-type-options: nosniff
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}
strict-transport-security: max-age=15552000; preload
expires: Sat, 01 Jan 2000 00:00:00 GMT
vary: Accept-Encoding
pragma: no-cache
x-fb-rlafr: 0
content-type: text/html; charset="utf-8"
x-fb-debug: cF83UA3rr4GN77S5krS6ICTRyWeJJsIaeOay6xCF8hyvee0saRQhpVNq4//K7q55XwUce2NYCjtrSuOs60oc7g==
date: Wed, 09 Jun 2021 21:28:40 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 wEDRRiN3Jyh.css
static.xx.fbcdn.net/rsrc.php/v3/yE/l/0,cross/ Frame 2F86 17 KB
5 KB 22ms
6ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yE/l/0,cross/wEDRRiN3Jyh.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29955c9653ffec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b0a4b0023829c273fa1b16d7c24f9e5a9d235cf0b33b5a064bf1ee0e110e9db2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: obqFzRqgP52te8TPzNsJyA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4549
x-fb-rlafr: 0
x-fb-debug: 7M6oQWKgg/Fwiog/9uwtS7asEgDAh49k2e/fBz3q4zgRcinuy8S+EddpoqZGQn8U96LbMv7U7G9SB+KzwRhQTw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Thu, 09 Jun 2022 18:34:18 GMT

GET
H2 200 ggzcJLJkhSr.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ Frame 2F86 3 KB
1 KB 22ms
6ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ggzcJLJkhSr.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b3408a1b744ce1351e9554b861c45480f39e54c059f3b11f4e77f9f13564ba4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: ywe+5CCuBA6nTAXpv0OCFQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1102
x-fb-rlafr: 0
x-fb-debug: nl9zIMcqcteQnWOm3cQ7sSvnzT4T1EQ/zh1xCxE2tQPuCP1E32IlNYiD3mVPuxJmOolNmtWLYkElguw+6F0D+w==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 26 May 2022 21:31:49 GMT

GET
H2 200 mN8-gFiYmm3.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y0/r/ Frame 2F86 293 KB
80 KB 22ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/mN8-gFiYmm3.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

161d6a8c4bd0ecd29d2265fcc4c94184a0c0429630b1f086c00fdb1902a9c380

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: eswN4V6szo7JSf8Wt7HIzA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 81495
x-fb-rlafr: 0
x-fb-debug: VSz4toFqi5J4thw6NjMzs5Id9bMyCiFCJx5oPjJlbwIGsWIHVzokDLG+o22DeePnBQ169H9bQkBrJk6XDrGpYA==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 07 Jun 2022 23:19:11 GMT

GET
H2 200 IEOQM8FL8ot.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yr/r/ Frame 2F86 5 KB
2 KB 22ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yr/r/IEOQM8FL8ot.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

908edfa9f7ec9fd5cb6b2159b5cb305d9c2c88601c8bf00a23bb0e96fcea1e21

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: mrvV7Xg6Liq29ANLrbPdkw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1630
x-fb-rlafr: 0
x-fb-debug: CMH21b+5ZA/+PdaaN50C9WAP7g0K7OUlN9SDpzQSOjLwUiPFD5dIt1guG++IYd3hkoNDfgNUdetRQN/7udo16g==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Mon, 30 May 2022 19:19:45 GMT

GET
H2 200 LDIDWlUlAG9.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yd/r/ Frame 2F86 65 KB
20 KB 28ms
13ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/LDIDWlUlAG9.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

56766cebd19e526d59965412d4744818753abe2b9030407f0580eeaf029fff33

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: zCLO5QjrkLcH6FDlzNjdyg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 20222
x-fb-rlafr: 0
x-fb-debug: 2dh3ah+fi91frFYkWqnPB9ibq3zDGsGTLnSSra+icxys/wy7jkqZCEN1H0a6+cQRGet4hbx79Xgg+VJbuhlBUw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 03 Jun 2022 02:18:29 GMT

GET
H2 200 KRTAHo949Uf.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/ye/l/en_US/ Frame 2F86 126 KB
35 KB 28ms
14ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/ye/l/en_US/KRTAHo949Uf.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8e2bd46c24371461d74e358678ce7946839bae86e11e0764d4886db0e9ee7bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: iSHopIr7K5Bx7dU3nM5A4w==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 35938
x-fb-rlafr: 0
x-fb-debug: hDepZgluNuz/5ItpdeBWMovYehNNpqw0NPneeJxwU8RZMrAMUntqdOu12JDmrVdJ87W+UOIy+8ggs5j89C5Krg==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 08 Jun 2022 22:58:36 GMT

GET
H2 200 10380207_10152455232975761_8123100998967752904_o.png
scontent-frx5-2.xx.fbcdn.net/v/t31.18172-0/p130x130/ Frame 2F86 36 KB
37 KB 20ms
6ms Image
image/png 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frx5-2.xx.fbcdn.net/v/t31.18172-0/p130x130/10380207_10152455232975761_8123100998967752904_o.png?_nc_cat=1&ccb=1-3&_nc_sid=dd9801&_nc_ohc=j7Rq1o9V6B4AX9qJAoq&_nc_ht=scontent-frx5-2.xx&tp=30&oh=6b08affb5f5f0cb55a64e00896676d92&oe=60E8A064
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29955c9653ffec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 7f0c0d5e15ee4b3a06964f2256fc37be30934a62b0e0bf61a00eb0aa47969eb6

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 591433749
date: Wed, 09 Jun 2021 21:28:40 GMT
x-fb-trip-id: 917726464
last-modified: Thu, 22 May 2014 08:24:07 GMT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1994070467
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 37042

GET
H2 200 277895_10151200062570761_1904128644_o.jpg
scontent-frx5-2.xx.fbcdn.net/v/t31.18172-1/cp0/p50x50/ Frame 2F86 1 KB
1 KB 8ms
7ms Image
image/jpeg 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frx5-2.xx.fbcdn.net/v/t31.18172-1/cp0/p50x50/277895_10151200062570761_1904128644_o.jpg?_nc_cat=1&ccb=1-3&_nc_sid=dbb9e7&_nc_ohc=1uUmTXLoSlgAX9Hg0LT&_nc_ht=scontent-frx5-2.xx&tp=27&oh=1820736ad546eae5d31cd2900103e8f8&oe=60E733AD
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29955c9653ffec%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff1eb3d9edcb1e94%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: fe0b009af4d6be99bb24436d2b2c67706fa3698e059d8df3bfa9f9c8857b42ae

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 3015587832
date: Wed, 09 Jun 2021 21:28:40 GMT
x-fb-trip-id: 917726464
last-modified: Wed, 22 Aug 2012 00:00:00 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1162695912
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1288

GET
H3-29 200 ApcBOUT5FoS.png
static.xx.fbcdn.net/rsrc.php/v3/y_/r/ Frame 2F86 573 B
624 B 13ms
6ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y_/r/ApcBOUT5FoS.png

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

641e03dfeee60c05e0794bace5fc58d2fba409fee529a114459e44cee0d9d069

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: w/fMw0DrZxMGtf9Rccu7AJFTGyVkaSrXrJYBtFb9Rae0RW9TqOQo46iFEoGQpGDqHpN1xqeFzUfMy6Ol1QGAYg==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: Y/eW3MWFNJnkcpEqoXzG3Q==
date: Wed, 09 Jun 2021 21:28:40 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 573
x-fb-rlafr: 0
expires: Sat, 28 May 2022 23:34:54 GMT

GET
H3-29 200 IcaTm-jFAR8.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yP/r/ Frame 2F86 7 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yP/r/IcaTm-jFAR8.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/mN8-gFiYmm3.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6b26263e492d4334076354b0db27917b73fdf99ca6f24ecb267ddca57a40138b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: XfPy4s+vkyIdTYCGlL45zw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2240
x-fb-rlafr: 0
x-fb-debug: 7UcnL0z/DtadDgwJRqyW/pQfQEKyCwDZMkFGKE47Z0U7LjEsESDQ7eXFUYUlJmavN3AqfBj7Z2PbVwDQvH4A3A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 05 Jun 2022 19:01:29 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 21:28:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
16 KB 570ms
555ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3469460283076390&correlator=2831902725996889&output=ldjh&impl=fifs&eid=31061394%2C31061151&vrg=2021060801&ptt=17&gdpr=1&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210609&iu_parts=60257202%2C60918%2C70076%2C60916&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=970x90%2C970x90%2C300x250&prev_scp=amznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D970x90%26hb_pb_a4g%3D0.05%26hb_adid_a4g%3D645f23f448178e%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D970x90%26hb_pb%3D0.05%26hb_adid%3D645f23f448178e%26hb_bidder%3Da4g%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D300x250%26hb_pb_a4g%3D0.04%26hb_adid_a4g%3D804c8d423f3de3%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D300x250%26hb_pb%3D0.04%26hb_adid%3D804c8d423f3de3%26hb_bidder%3Da4g&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1623274120&dt=1623274120968&dlt=1623274119842&idt=666&frm=20&biw=1600&bih=1200&oid=3&adxs=315%2C315%2C315&adys=70%2C452%2C574&adks=1432691387%2C3120184932%2C4042975291&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fprnt.sc%2F14xb5pj&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x90%7C970x90%7C300x250&msz=970x-1%7C970x-1%7C300x-1&ga_vid=126720193.1623274120&ga_sid=1623274121&ga_hid=238984568&ga_fc=false&fws=0%2C0%2C0&ohw=0%2C0%2C0&btvi=0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

9b2841a0d5f25743e4ce77138f152bbb986e6f9b6d5801a89c2586ffd5bab8c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16122
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 998C 6 KB
3 KB 150ms
53ms Document
text/html 2a00:1450:400d:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Jun 2021 21:28:41 GMT
expires: Thu, 09 Jun 2022 21:28:41 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2D71 6 KB
3 KB 142ms
50ms Document
text/html 2a00:1450:400d:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Jun 2021 21:28:41 GMT
expires: Thu, 09 Jun 2022 21:28:41 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 15D0 6 KB
3 KB 138ms
51ms Document
text/html 2a00:1450:400d:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Jun 2021 21:28:41 GMT
expires: Thu, 09 Jun 2022 21:28:41 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066164336645"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 47ms
27ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a61668b6f1708e0fb28eb83c5335a444f68d2df5edd65c7a1694acbcdb45eb98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7946
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060801.js?31061394

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1622653785071769"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/223/ Frame BD90 12 KB
5 KB 15ms
13ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/223/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Wed, 09 Jun 2021 20:41:30 GMT
expires: Thu, 09 Jun 2022 20:41:30 GMT
last-modified: Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2831
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4EC9 783 B
532 B 32ms
31ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f3e6f9853dadc16ce421073bbe0405ded4563b19495ae0a5e8e0fa764ed8a94e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eec1v856lAzA0yv5uWBHvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://prnt.sc/

Response headers

expires: Wed, 09 Jun 2021 21:28:41 GMT
date: Wed, 09 Jun 2021 21:28:41 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-eec1v856lAzA0yv5uWBHvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js Show response
pagead2.googlesyndication.com/bg/ Frame BD90 14 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 00:21:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76050
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5768
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 00:21:11 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 88F9 624 B
592 B 17ms
16ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIY6s7aqQEwAQ&v=APEucNV4ekEmhWhGSaQawhU5XofTQKwQherPJTZMxMX4qv4TIWNC2k2_3lYRQE7e1zCoBH9Q0tdwmKYUWdV3EWwV1L7__ovAqn-cqLjBfyBkQR6XytetYQ2BLQORgVVQU2Ei8jas9zivtF-wiplxWK4AyWyV-1mpE--8rbv6Eraubmpu-imdgFU

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CICfxAEQ7KXQkAIY6s7aqQEwAQ&v=APEucNV4ekEmhWhGSaQawhU5XofTQKwQherPJTZMxMX4qv4TIWNC2k2_3lYRQE7e1zCoBH9Q0tdwmKYUWdV3EWwV1L7__ovAqn-cqLjBfyBkQR6XytetYQ2BLQORgVVQU2Ei8jas9zivtF-wiplxWK4AyWyV-1mpE--8rbv6Eraubmpu-imdgFU
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Jun 2021 21:28:41 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmW2g0jVsr2VeVYKEuUL6nbk3KeBKSlRMsLwbF0G6uZkKt7wXEUz0mtId1O; expires=Mon, 04-Jul-2022 21:28:41 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 15D0 39 KB
20 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CEA3BxwR4DX9X_q7rdJfVCJTPDjmdV3qzBcBrWAt7Rt4SIYVa4wkjK9e5vUIIdWHK6ixIj1Pnm9lIjBEkLZA-zDbIDU1yZal1zkpSNmiHakB7TG_OlateDGV_-BtitiIXwvlVrebvfVHlC4I7bzjFxkV-NBA&dbm_d=AKAmf-AY9UysH41lgZm44EVbDmE5-pAW9CwCDLwQPmpjqsc9nWOUovjgCzS6ieKX4dYSzNkV7XbfRxcmg4lL5NAyH73QCt_9DaqOd3Mxr-OHxnEEQF7hPIpP3pvFPh2cu7irXZa0Tx4wdNqLI9NNQhYf19gg8dUAKWF7XZqNg2yCIE4TkAyYjCaIt5WfkBh38sbLbsAb50Mh-XYmQVVSkjYhwyJU8ccNJ_rQ5FVIkrKHT838NQfnsbGoNcwrvvq3MeXwk4vsk-qJsaAtgi2suN5MxSfXLq0cSJbsCqvQyCvzvl_DURFz22BEng8sxewtL_i4dzPrDT_2_pXwssoaE5kzg2CRAOtHiwsssEbMzDFRxaSAZhNKvJ7o35JliKtYzZeWRtz2wio99b57cRd-OljG8JIyPJ0TVCI4GYKU0T7lO7eifPdgOTaw_W_Fh4hHqspXS_9gompCV8JWS1Q-8JNT7euBw59S03oybw6fikmGLtZLOz5vI-D5K_YwfDY6cKxQ9hWEx4xrpZnhn-7RudWdJZrW_ev61yhqxrySMu-u7hH5AAuQCRasAEQ32QjUa3DVGRTboq-rNfoFTVjUo95MTMjnOLSY1A85FKCEeQ8oRU4KHUH4FMJCQcKlrRF-oub5OmT4czeEniQFC3gkQd8D6qz10l6Sba72R7ryVkq2y58KzNDEE6HvPt5e7BauT5XkVPxrBprTWA9WGROtZA8WUq8exeqhYv9ith17d5EiEnV8xx-WR3kx_NIZEj8ZL-df6w718oHzUYBGmc4hm1o8_r1AkGEX5p5qa4qKbN6PXxIP9TwGCagazmQcVXYEo0c4S_yGjEDFnmppb6HrYF9l_FRHkf3qaT4Nwqll3MRrPyxIi6sGtFNBsvBOdAXUlN6eXzCcblhCcDKQcS9Yi2NRw4BrnqAL8h2BAwl6Vo0gAuOpCTOd2WxMxUUXDfnH_2hs38_hZkiR1NzWIu_NJBvKFujKgzejj7LFVd78oX3L2HEc-7ZOgxPvCOeUnIG09XGl0lnBbSIBAO-e6u9snNvZhlV7BgrbQ_eiE8jq2p3ukhRBiuc-UNnwoCC-trOtmOuaWua6xRhxujUpSBpP43Vs6YK2p76obbA4Yr-YGmeM9El5tsn90v9QZhfyQI1mCdBCZ0oqlcW-b-k5QickCZXuPUWaKShXCfA5eFk1RBH5lZY27ezbrqtE6iJmCUQAlyoI6be_VF8lE6hykrJNRwdevOoRy1f_FFtY49Fv37RTVaRjHDnTvTuX_JFdHhidj77qAZrrMek5gGT0qgFj7w1W4lD6owGDvLGSuNhESWJ4TkR8_wFi17IbzfXUAerywwslDVSYFOc7z2VwW_NDty5d3c_1drG5YVlI02LueuCee9R2i6y3IMye_s-Cr5WE2CRIA-pN1UM48QE33M-F_3DeBQwEhjjeeLgEG6sOJseZ_383Xr3j4IFndANHIs7Mp5mhZqM5aWXvi3ZhHsZUlefP07wUNCYD1VVB7SN_VWmRT_5Kh6-0JAUM4hva93VMZ1EVXzp1-RG10ObRHqQ5hWAOENMvHUGWoHL7xqdexsa0Ae5Fjw-YlFYwnSycy3CwZldBzNDHMJRd4H-e1i0y7H1_omo4GJ5boAqxWDq5Z39JjEZi7meyx2g2Wq-ykFq6I6aeOlegLh2CDZ5tU5_ceC3lJxmwWvm25B_dpd2Krv3Osi6fT8YWxYRYPkW8e6J4gF_IvEum-toxAqy05fymbRTk6abPs_D-wPbbVnnRTMUKcD6qunsX-ILUYDQxOJJPYOMIj-drCKAFZ--blKU58uxffcP6t07tOEuL_i__l2pSQ_foR_9EJFoBls9itAMlIlBfdh1-wkX7NdtKdYWtRL5C0YMYmVZmi0Ad8ZXtmaXnmkVCJ78m4f-adJydS4THSnDHWBPC_fi16ZxwlbCG9LHXJCCoq0hi6pJCZdUOfNp21nz8rRpUWKSKt--fKbOjIBNhowEb7JjyyVepXTSu3vaFWFTqHgOCN3bXr4pBWi4gairBfQ0B0Zs30Mdu0SjjSlz0vaIle9H11QdEQwmSepGRcixkZcF-E396XX5PaS1dBWvPmSc-vEaYGibcEpHVzqdHHP7LD04i5tV4M-8kS6wKxVLgclq97G5IXEjQEtTBnEn1IlR1owM4EXM0gKCJeVqvn3vrIBvs5irzxhtniEDWxP2NWsCz-wmKVaEJNZHDPPU4xgYViBlACHJaIjSmK8Fh-_K-1ctE-FYqXFJYxonKgNjNpWt39pEfXyTJiV8SekPjDWNr66I1AhyDscGHaB_v5jLSfpF5tCM-TwI3-CWK7mLO1h4NPOA5FEvAEru1d6_OXLle_2AD5anx5XdRoKzWz7GhlXuXtwhsTly-Ixt9O6fwhjiPDVOrxph4pjKjGLu6AJnzDcJtsDUJEZDya3icD3akGLl1zfl-V1gKRNkSB_0jJt4CgrSMnhThQ1MOgLWNpe-Z_K1CQc3LdtgSJXhmgLjhSqTEISDLLhXwOrr0vaAKmK1Vx87AlCeTxK3v62RnYlTIx3-V-t75MWFZPYpvMfMkKG4zT4wCPa1pyyCtKqZuRg31BF83jqjdLQuKoT4XEIkcmNUtumYGC-_efIzyMxpYFa1kEBVmvVcOzuC7iqI_ttNEBCSTn4mi4lzdYhLMbdiZdNVDuFVapaUsrzqcKj6eLT-72ZOYGYaV27IkpPMig7qwjlYQNGjVCpwbCYyx-IVJXNInN7lrFQJPbKIlsJlIXqJOoprsB6Yuv_Wnuf66ciZKSJ4pGnBraXsnPpIHn6JFNAbqaiiwK8yrHF1qWDFpjoolqmD1-vuCTC2MOuxizGr3Wu6tZjXc74i31JVIJ3_FlI2wIC5w0AzAFjWklDNRabHlS8DvvsfjCPONXZCY9rAMaVP5Av1Wy23XJJDE2gqx_k9ltuQE25tCEGbpZnLQTr2DRtEIql3mzo6xbYaU8WknMKGyQfEhYDex4_nYa2M2SgXuDoM1ofG7sKIgcAxN1acsLorVMZQThu8qJgcBGXijB9iD_n9dHlxvKElQ9fQHuaDY95fl_RBqh_GWv0MjPx4lygNHR92_gU6tQsfXnspwiAwiqX1ag72grIQuNPyklYr4fsRWW9NFG1BPjMwoI1wumyqke5Zpcr1pSuYIx2qXXw&cid=CAASFeRoId6P63Bqho2pji2sCB2aCXaZrw&rfl=1%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a72e1dbb08d86df0dc420ae5213c7a64f45901c84a7c09eecd462910db67a0c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19737
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15D0 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DxiWPLDdsJFui_1tdO1A95THqMsnMHM61wSbqJ2WWjNh3neFfBjljW1_chkwYMbIPK03hpJ0Eu5u9aeqiEtuQKpn5kBWJGvVXG10tg_nE3gkpqJwI

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 15D0 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:26:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:26:03 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 15D0 122 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 15D0 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:28:23 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 15D0 0
0 17ms
16ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRq-dhX4rxaSGU1jdNHMQ2sjZJ9kjV3vi4TQXOj1gys2ogpa8rD4Touszln4tRLyKm8SYmy2Fc8lCspjQ60mF1NV54yTg
Requested by: Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 04B6 624 B
557 B 20ms
17ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIY5KeNqgEwAQ&v=APEucNW7L5vJISbncVJWnMUwkKhjeW_3gyRBdAFjuOSjHLuZcBujzL9jQtcM4kXIuyudHER0T5nT2I-AugDrjDAE9hhyhzD7xyI9tSWSi1d-pQ_ap-Zb9186mMsKgRI4rdifQSxkTYTBnPD3ibxceBsw1EudcvTbh-gf4-GW-4Z7nCuAiC1NzdY

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CMXlgQEQg-LRwAIY5KeNqgEwAQ&v=APEucNW7L5vJISbncVJWnMUwkKhjeW_3gyRBdAFjuOSjHLuZcBujzL9jQtcM4kXIuyudHER0T5nT2I-AugDrjDAE9hhyhzD7xyI9tSWSi1d-pQ_ap-Zb9186mMsKgRI4rdifQSxkTYTBnPD3ibxceBsw1EudcvTbh-gf4-GW-4Z7nCuAiC1NzdY
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Jun 2021 21:28:41 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUn0aierdnp-5Qpc2nhq4-nNhCNzdepjywfXNyaHz1sY_8VEnv_606V88Smh; expires=Mon, 04-Jul-2022 21:28:41 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 74FE 43 KB
21 KB 50ms
47ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BQoqlpQ8xHLUzlbGottMxWg3crxAPvw7lGQ149o7ihUu3QP7Gb9yiHlbHa7OAhOFn4-9cIIcSDReOgkCdaigdu-dQUddv5HgT2y3OKSraZOULvkEjIl9nlz8ZLrqm3QU6GyGrkVlZVytflS6cUBCnc3NluZg&dbm_d=AKAmf-ByzMugv1_Da4RNyYfvAEvQJGk5XMFnKsKweQsuZ73GBp48YCLOF8y1JGmoZ3F0Fniuose_fDcVMh1Eao9oG50h_rbJ8Buh8e8dc2Ob7ibJwXu0dnJAKfKHMvwzQzqT7BK4iUCczB3eWnrTgO3ha7EBtNWP3YLO2BZ2UKF0fN7Xlc9HtZhcLQWEk4ETqz8BKlNsp6ximYcBecTFCw57B2xGFjPFIXY4kn3lvM3F47xTMrbORk1aT0Y6Ww0VWw1FGTOChJGEG4w2PJVdjbTi_SR4Rdtdfj9Pvl0pKTQrUodAw3d78mr_TjINckgAhgIAeHIqWhra1gXxX6h7RgdMs_Y-MFr2e7HTbUfCISDOn_z3LrW3FTGKGlxFC5nDwc7umyifq16sgOajmnn6ytO87wq1JRrBgrc8EtQw5s0vWa-s5_dEmp2qJblTfIZ9E4sLb_IUAyGGmjJP7n-5RMtlq3KPW0HE9B1Ou5c8hd5Y7XaCR-TCWuQyuey5AQjXQq5nWLrUsQLb3LGuAbPl9W6fJFZ1mJm4T7ZFw5S8oyi6kijiO4OFPGyiVumQG4gxK01hEG6JAaoL-uAx0iKHtjUPTO6CJy1vG0NOxdMq-Wjh1V7lvIEEJoyd46ThHXsfvESAQwc4zG_rxqNugSGsBY-ypG2KakMw1_D9KPbC9t6dJ7UOLqdvDhmE2apNNYnkajf_TONMLsPBcolAsRy86dUcborq9IfyBYn9a6kG1PagPlLoNZcfAtWcjaP00TyElA0tI-4kkio_2OHkfUuDcLKreZSm_SGJlik5A71l37kJGxDNjxwgbRAqZ53eRfsNqPheUawFBVJHXDLGyo8bFVqNiOMFdmzGGve-d2ouJRSOSqPWBnjtXLw1w3qmiv8ckQ9nd8m5f5DyBV4Zwus-RzfK0Nlyci-uDjR7jhFgs7KLr_DVkFkYk1fwu19ijvSXyV2BEW8JVp7_E4HN3bKkzpb33E1sLqCeM4fxcqq1Tib6uN20kA14l2Ci4t98TrDtLC762dTlW0TKbpmoDaBc-h7ZYFHvuGA5yba4pMIfzslyJhOxgG30-jGcpe3ziVHh3xKyuptH4px2sLjuKew2xst1Am-IdH9YvExexM4FqMrooZTtosI38X9aP640PNIRjF5BR5IfvkoKrLFRLbsR3nFUlxHRpybssAg9ObQT7b3mnuRwu016KcdhSp4lxRU37ZtSKavK5SZwmll5biwaawzXO_ZEVyCV8MLkOIP79qtF0KoOi6s6LA_rRisXYg74BMOq4gjNo-Z6nZaA77yDFVCNGM6NsM5LftSVYERNjchNTiXAETs-TwMMDF0wd48gwQXpvsq2bvORP2bWtg0BdfNhS1J0UySCNiENDWxylPj8CFZj1O540HIK-yovhI4Zbix7S5fkUQFbX_u150syxaN_b4o3jcy_e20KU33Rw1jyD61QAoVfmk2O0C4GjM-n3bjcOXyTCrL4E-zFYdbDIQHhzVGmMMjrb1z8IzMVe8v7Hk1U4s4hcuP6iKL78M-pD73e4aUqkR3WR0azPPIOXLO2r3_-G87Do11nRk7NL9Lb80arTE2vFic-ueJAS4VBY00cQTxdMCv54X0oxgQV_BKw3cHxIOr5KYFbLaokZJepLppqql_vBsqrNRs_Kj9SVTNqAODTMdEuKzdUBMENMJPfnVemJPlW_s-eibjF64UHPZRAfBCsb3SCUjWf-RYkG6zKi87NeHQZEY7NzoVEKJtKWDXLgaEj7UspzJor_6PmaJ_wG3cpwoOiwxZDegmLgAm3Rfe9NXUbrqPHhOSXEfwoA_UckH5CKxFD0gX5nwuzMcm4QKL55Yvrl9OEfilcp4Cusrx0VRmI8V1xm_mSYiH5fsJzGm2otQ8wC54yaA0SwTHL21ZUZUmW1xks3P3tkj-UHz9dOL83c2NyXi9MqlupLa9Fa-VlXnKRWSnJGfJP4wnTHUnxbY7KByyTq_jyEQw9aAf-AOTi-plFBcrHazYJb4l0ohzPEhMYA0qGFrBSR9i7UhQBuqTJ6LlIVBZVocQcvOfTzi9Ni9ojCw8bw84GuBiP4B3lkZo68qgFOkcdZxdcxevVg-82w2XbSPhrnslSEs8ZMafRLVPh4GD1neHUy4W4fdeyrNowmd28DZK0q0Do2pY4YdWIe8wo0eiUxCvAdkvgJMRFVrCq0S-knB7hGbcywpC5QgKhLf0e_6zvr5-vZqr9wgwRGeggvAB_zn4zkZDolVcnJk0_Okthm5V0HWyow9hK4Ntq_ZBob_bGAq4lMcEmXgfmG6CcirknYOGo4gKeT-AYx44ELIkLn4THJitVqMsz9Vn4pgi4f5-DYJNCLTEZ1wS1fuTFUPbUs9S3SlAUqjBwr5Eyxcm7wB7NibCDakV8KdAXh5EwyR47dAQpzFvFefkLAgB2adyywkDk7EmYbSPY5VoyEZZ4vPARyTy2J7PAlj9JZbFK3PihGg7zFSprwETzmw5tmU8yBNKWk3x--7js0lpv5KneCmQJGhCtLUTyuRfjhoOgVBx_LBtLbNT0yWOchkANWXrhYeWKKKQANF6KI9McnJ35BXJxyr1Clh3SWDOM52pma3148XKrrvthoU1X_vr15UoGkAeKBOfLk-Iy1DksCtUQme8IsFjAAfgZ9Gserk-YFRPOo6spLTwUPq5R0cArKRh3FSLCo0VZFgM0jMd2xA-l5Bila_GLyoEOlL89UZj8VCMLR4t9MRcss2AUpXq1JEeLyS8GNaWddrOnm_ORzl5JjmjpGIv95FZqc1QJLjnEl1dLcwafjkDlpiuJh7403Os3LJeR0vkXEptnbRWfKLzzQLuFMtqNRWNfQ3thJ_odSLsmIwSZxhpwQI7NzdwP9BNSkkGkjhALl74HnJH-I7h68dSYD9QCbUymJOWswSaYswiN-q1b0GslVT4-VY_wpmsEEtmV4psEiYvGrEHly7-p6wocFoj8IFRxRQuZI2HE-AZW-Unadf-g0fQEoD54kpYxrWDpK4ErjpuQ9CcmpIex_4CxDWUi2lWYh3FiAxtQcP2HbcNhE3fowKmNfVOBtDOnteHEROKUIiGAbri2UHiMcBGQ_kcdAEDmZO9-_oOIctlpKw2NxFR1OBM&cid=CAASFeRomlsOAsnWdNZ1BJRvs9r2IWETQA&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bebecc4adf8ecf2f1a6707df64bca412aa19a6d00ff65ac3d41e2d6f7fd643f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21354
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 74FE 2 KB
1 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:26:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:26:03 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 74FE 122 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 74FE 13 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:28:23 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74FE 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A6eS3r4H-mysawze9lxcE_V2qXhqhEtsqGQWJilxVLHYG9jQaziXr49b0zoZPXRXmVmwZgIwQ0GwABTXfBkgbitiEF1E50i4cpJmzgTHCb_43etXs

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 418C 624 B
300 B 23ms
16ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIYgpmNqgEwAQ&v=APEucNUpTOSBaGfRkq7itbtHw77WIbUe7e6U-s3KDeV70Hz-dR2PEkOq93uRvfAuFTGk6fPdNUyUtA_niW2LIW5L-SbMEV_3nRx02PIwcMRXEJg_OZcgPpqgE6tom0yX0L8SAMOZLtxYyFkM_N8w-XvWLajL9O12-89mzx4SHAZKmPWtYHnEBzY

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CMXlgQEQg-LRwAIYgpmNqgEwAQ&v=APEucNUpTOSBaGfRkq7itbtHw77WIbUe7e6U-s3KDeV70Hz-dR2PEkOq93uRvfAuFTGk6fPdNUyUtA_niW2LIW5L-SbMEV_3nRx02PIwcMRXEJg_OZcgPpqgE6tom0yX0L8SAMOZLtxYyFkM_N8w-XvWLajL9O12-89mzx4SHAZKmPWtYHnEBzY
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Jun 2021 21:28:41 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUnvq0PZObzzSjrxgX3_d9No0UbWPtnQglrEuXVq5F68or0RFb1ahp3CqecP; expires=Mon, 04-Jul-2022 21:28:41 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6185 43 KB
21 KB 40ms
33ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-APOMed0JfuQR_wIdz3B0O2ZTC7ENbVPI5Az2KxmLloAZCDbT42dyeNbxn_b5IaJ7jTLPHNOSEt0llLI6h6UMVY0Vq50ttgIMpQVvv9XLFRlRgT2RE383Ka0J_XvdkAViTxh6EQjmLHR2vGm8x25TwqFxi5ig&dbm_d=AKAmf-Bc2RUDiGEbZviZVB23vireAOAxc7BycAs3EMZDJ9LXPPu2RirC-bu5O36fVJUpwAUAVhaEuCezQmjMJ5o1PU3fsD99UwBazhh098Vse73FjSKEPwRZ20b7_SoA-kNZ2vnti8-2MaKZ_SdQQUIfKAdt87YZqvKgj_ESg4SXR9ico5hpr2Mn092yMg601E5ji0ajZwjYn_UlvWbVB3nB07LDm_WLylBA1pzs2SM0f85GBeSsW6TlUWfCsx_V9jYVEfQdDFncK7ZQneTGEN6LJopNP8DJQfcBsqnHoIVyC61WAueDP1HxUj68GgCOd81Rbk9_aCZn6DFO9SkrB1sAVDIYwgbAgjBvVBOUrd6L8Q1MIZWkEdw7RJvzpXe0_P3TjpiI625ysVlsmvRb9pc2F5Z3gd8BHGnCNmmSqw27f1nQfJlT_476ra9GkdL2e15RR76RuJlJ5LXi8kwn1u_lc7mAChqJ4_BPc9hnM2mXAV39GvhI9ZLFRNH6fVcvPFJv0z8sv_vH8Xg2Y6TIWDn1SkX4oOXB4r3i9NnurNV9d_HmZ6SR2SPfxy6MogfySlmyUMsbAkG35tRwHsUFVHpwmsF2gYMaBEx2VlRSyBSss8_OcDiNtsEhBVIMwu87-OVth76CCqO2f7jTQmrAsccYi9DJPUnL7wGApuCv6jARhOPiMiQ7BTtSD_rhzalbhcMus6vBFBZMgFQXCp1y9VzTSausO30Ezq66IdB9gqV5MXxHw8JR46rywbIcNF2_GMPkM2_987MesrruvBpNnaB_lvDi2GBXOym5FWuSxxkV5MXd9KU0LRTzSQdV7FhaUTm45i-V_sMZ8KQ4SauA1p1Nrd5SJDDDGTQw2kK4XR11aMIBy0x5O3rOxL2hxMaW44SLAA5auINb_kJlFwvX9vFf0e_My2qJ2FLxOojjgaFt2LbMnOY2aLh4rudEpmC3FH4IWSvXNluvftJePWk-Oz4SbrbhcgGI_Qk7Iv3a43OHRMnogBZtUMB3nVWTnFuYWlrhaxi3_0t_9-lJmQMUcPSWGULBknCLwmgNEK9Jnfw9hpqCi6lph95DN154hcLJvAEysr59f_sPr0tCQ5yZ6npI9Nhzuyxp0BH9abj0q-SNqrwQiiWOfDhd7DHOME7eIUH7hEBaZn2_F6Zt-ZHypIABQtgI7X8WKGYulE7B62-iqr-sCdT2xa4nCXk_qLtsvj0I7jmuH2bkVG75qj0HrVwSPJPyKf8Lq7BRHgYln400YU1t4r4QQ5IyiLzvbqlun1TxCd8Ck53nD-B7E_YR7MMeR5yV5EaHJbENkKS-yhrDQ7p6YwIHuv9qyb6DBpLkH9ewd7z-ftY5vUl2NuWR6qRVL7V2dH9iQ6iQP9jvMVPAauuzAbHREZwLihkCYzL8_rFMah0IXXG5xRY61nMerWXBfiQMfyxL1GP9642vi7ap1Gbww5JsMaGtZE703in0pXKX-xSVnrKLd5DOXBV_3x9di6r2TL29gWQLAiqFPVRLkFOjAwElQeHLqYyocOqsbyc98bg32y5IC77e6It5Utk1hKqlZciTeVUG7w_F_1DKetWO2P0vWZF5nK3WHCs8yd6On7hXIE0_Zx78IPcRZ9jUls1nf3Ntcq358AHT_mtv1_bebEZKDnyU9Ok-T3rClaVl_sIEtMqFkunystM2na3VviRWD_anZKikrNCNRUKvUH6Tq8_QlIBFiDLDVtGMX8SX4NXUalX467cfm1Bw7OdpviLHztUygATjUrivx8BmAfqv7qeNOlKIEA3vMuRT7X-sA5ff106jJ7ciPvb8AZkwuGeioIv3QOWcK379iYya4A_OoainwpbImxDIWw5o7YUWG4ZsZDGeZd1RwcCpM6Ft_zfGIIZ4zXr4CimWQHEFUUdP-nH2bk4S0FwMLCpWQcBwPdt4ZTmtVRDaaYB4LjpKMrH4zQ73Kay2Kh9ZHXelTj8i3S4SvUKyaYJCTiP_p66QMs3t9wXuTA1b2Y9YTpW0jjHJ1VkhPZCeiG9ueWpbbzktuejtEjB4pMsEzUptWU4b-MaBhi1CAI8QxCHfYEYySP5x5PVJ5d9A8J1h8oRxixOjlV6Z1B5Qm8cd09XaokmSpugknnpM9905skQaHwrIkWTHGagNIswXSlbfc_523_O5fIhYArBs-VrAFi7DerRhUhAGWrJnCEwRE1YCeWQRs273AdXoZt3YJxu7s29mBDa4P4zp4AoNj-JuqrydwdxiaUTch3QxdmyYAud3sSaWreGEfjQAj2jI-hRgTyk8-iNzlpFPKXX-18LqWWUBh-cQw__bEy_QfxxcPcPKb-KgS_zTt0uguHv9Lng5szKtSKYOowuz0LVbXL8k3lVPBMAUrjJJsVNoQaC95LvldnmLbGn0TrGdTgZWtal22gdbML2s_3aI2PA5sj-Pf8F95jsW4GnK6FRbi61R8cXPxd4_DBo7XMuHN0skoLs9vU63a6KKRT3I0idr-k-Qdvla2ZWpcTV6QDfWxLVfSRfDEVolpWNQ3TzvfJIWe_JF6rosjRK9a-2YyhefJW1cuWTzMnMhgNPZrjlouu0BzD6vdzAapWeZR_zyO8ncQtgkx0lPqJuSQ_I64VgKdXAk-JHMr4jI7slh9rVO43ONw5dfG0IOWtvw4P5yGA05tcpmLzaYYNA3ipurL5n23Mvo1yxYcVtmvRW10Pp0YSESQ6O8KXa9xzIF-8C95HOZU4uD0P0wyhZOlFdq149y2qTPIhcivJsmlisn2jiyFKwY1-wPUk77nXaGyv1X6wMZ4GKF2uMYWSE1ltlpG35yixmKw2wDfCheiFUF7M_ASlWuI0otpP3uSIti64RjA3oX4SItCtKpYVQH09ep_Chpiz58CHnAmxoyE79zaJlJLHOOr84Qy6TemW6KsELq6vdLrxAHJ5y7PpqVaQJrG_FysMCuvU98L6piBfZI3zYqJG90sagmSZtbxK6-wuBvpUE6Ke5J4uf4n3ZpduD00MN1PVXOKNXI_MEOIxWWZI7-Hz1Z1ptyTwLknDeSCFsBxI8jX10TgK19kZmGvPA2nV9cl6blQbtJ6A_YJ_WPrAeAa2DjCeJHp9blp9F46ieR8be_725Sm7K7nMp3ULBIADw&cid=CAASFeRo1MyVkqAr9Wn5zdt4uWEu2ZhSFw&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a63d4516a26000f63b58959048d5710741fcb791c077974c08115cb66beefea5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21172
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 6185 2 KB
1 KB 9ms
5ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:26:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:26:03 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6185 122 KB
37 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:41 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Wed, 09 Jun 2021 21:28:41 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/ Frame 6185 13 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210607/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:28:23 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6185 42 B
63 B 43ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DHCvuHQp0KNshWpN5oxs0kWCBw-0Y6GGvZJRX067WSurgXZD4R5k3uXRHgoYkZRmyaSsaEDxaV1qEkWNVK9fJ-_H26gpfdHpbbKKukhfOZZglLHMU

Requested by

Host: prnt.sc
URL: https://prnt.sc/14xb5pj

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 88F9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIswEmp2GfiPC89YLUlRzpk&google_cver=1

43 B
894 B

15ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIswEmp2GfiPC89YLUlRzpk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIY6s7aqQEwAQ&v=APEucNV4ekEmhWhGSaQawhU5XofTQKwQherPJTZMxMX4qv4TIWNC2k2_3lYRQE7e1zCoBH9Q0tdwmKYUWdV3EWwV1L7__ovAqn-cqLjBfyBkQR6XytetYQ2BLQORgVVQU2Ei8jas9zivtF-wiplxWK4AyWyV-1mpE--8rbv6Eraubmpu-imdgFU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 21:28:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIswEmp2GfiPC89YLUlRzpk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 88F9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMEyidhi5Y814tpee4ePzAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

43 B
1014 B

30ms
29ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIY6s7aqQEwAQ&v=APEucNV4ekEmhWhGSaQawhU5XofTQKwQherPJTZMxMX4qv4TIWNC2k2_3lYRQE7e1zCoBH9Q0tdwmKYUWdV3EWwV1L7__ovAqn-cqLjBfyBkQR6XytetYQ2BLQORgVVQU2Ei8jas9zivtF-wiplxWK4AyWyV-1mpE--8rbv6Eraubmpu-imdgFU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 21:28:42 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 88F9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEO-VQ_DOrdWkBxcTtAnUnHg&google_cver=1

43 B
1021 B

47ms
22ms

Image
image/gif

185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEO-VQ_DOrdWkBxcTtAnUnHg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICfxAEQ7KXQkAIY6s7aqQEwAQ&v=APEucNV4ekEmhWhGSaQawhU5XofTQKwQherPJTZMxMX4qv4TIWNC2k2_3lYRQE7e1zCoBH9Q0tdwmKYUWdV3EWwV1L7__ovAqn-cqLjBfyBkQR6XytetYQ2BLQORgVVQU2Ei8jas9zivtF-wiplxWK4AyWyV-1mpE--8rbv6Eraubmpu-imdgFU

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.38:80
AN-X-Request-Uuid: 719dd459-3aac-4378-97ca-246a2647a8d2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEO-VQ_DOrdWkBxcTtAnUnHg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 88F9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.238:80
AN-X-Request-Uuid: 54727a1b-6d90-41b0-aa26-f500005cb93a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame 15D0 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CEA3BxwR4DX9X_q7rdJfVCJTPDjmdV3qzBcBrWAt7Rt4SIYVa4wkjK9e5vUIIdWHK6ixIj1Pnm9lIjBEkLZA-zDbIDU1yZal1zkpSNmiHakB7TG_OlateDGV_-BtitiIXwvlVrebvfVHlC4I7bzjFxkV-NBA&dbm_d=AKAmf-AY9UysH41lgZm44EVbDmE5-pAW9CwCDLwQPmpjqsc9nWOUovjgCzS6ieKX4dYSzNkV7XbfRxcmg4lL5NAyH73QCt_9DaqOd3Mxr-OHxnEEQF7hPIpP3pvFPh2cu7irXZa0Tx4wdNqLI9NNQhYf19gg8dUAKWF7XZqNg2yCIE4TkAyYjCaIt5WfkBh38sbLbsAb50Mh-XYmQVVSkjYhwyJU8ccNJ_rQ5FVIkrKHT838NQfnsbGoNcwrvvq3MeXwk4vsk-qJsaAtgi2suN5MxSfXLq0cSJbsCqvQyCvzvl_DURFz22BEng8sxewtL_i4dzPrDT_2_pXwssoaE5kzg2CRAOtHiwsssEbMzDFRxaSAZhNKvJ7o35JliKtYzZeWRtz2wio99b57cRd-OljG8JIyPJ0TVCI4GYKU0T7lO7eifPdgOTaw_W_Fh4hHqspXS_9gompCV8JWS1Q-8JNT7euBw59S03oybw6fikmGLtZLOz5vI-D5K_YwfDY6cKxQ9hWEx4xrpZnhn-7RudWdJZrW_ev61yhqxrySMu-u7hH5AAuQCRasAEQ32QjUa3DVGRTboq-rNfoFTVjUo95MTMjnOLSY1A85FKCEeQ8oRU4KHUH4FMJCQcKlrRF-oub5OmT4czeEniQFC3gkQd8D6qz10l6Sba72R7ryVkq2y58KzNDEE6HvPt5e7BauT5XkVPxrBprTWA9WGROtZA8WUq8exeqhYv9ith17d5EiEnV8xx-WR3kx_NIZEj8ZL-df6w718oHzUYBGmc4hm1o8_r1AkGEX5p5qa4qKbN6PXxIP9TwGCagazmQcVXYEo0c4S_yGjEDFnmppb6HrYF9l_FRHkf3qaT4Nwqll3MRrPyxIi6sGtFNBsvBOdAXUlN6eXzCcblhCcDKQcS9Yi2NRw4BrnqAL8h2BAwl6Vo0gAuOpCTOd2WxMxUUXDfnH_2hs38_hZkiR1NzWIu_NJBvKFujKgzejj7LFVd78oX3L2HEc-7ZOgxPvCOeUnIG09XGl0lnBbSIBAO-e6u9snNvZhlV7BgrbQ_eiE8jq2p3ukhRBiuc-UNnwoCC-trOtmOuaWua6xRhxujUpSBpP43Vs6YK2p76obbA4Yr-YGmeM9El5tsn90v9QZhfyQI1mCdBCZ0oqlcW-b-k5QickCZXuPUWaKShXCfA5eFk1RBH5lZY27ezbrqtE6iJmCUQAlyoI6be_VF8lE6hykrJNRwdevOoRy1f_FFtY49Fv37RTVaRjHDnTvTuX_JFdHhidj77qAZrrMek5gGT0qgFj7w1W4lD6owGDvLGSuNhESWJ4TkR8_wFi17IbzfXUAerywwslDVSYFOc7z2VwW_NDty5d3c_1drG5YVlI02LueuCee9R2i6y3IMye_s-Cr5WE2CRIA-pN1UM48QE33M-F_3DeBQwEhjjeeLgEG6sOJseZ_383Xr3j4IFndANHIs7Mp5mhZqM5aWXvi3ZhHsZUlefP07wUNCYD1VVB7SN_VWmRT_5Kh6-0JAUM4hva93VMZ1EVXzp1-RG10ObRHqQ5hWAOENMvHUGWoHL7xqdexsa0Ae5Fjw-YlFYwnSycy3CwZldBzNDHMJRd4H-e1i0y7H1_omo4GJ5boAqxWDq5Z39JjEZi7meyx2g2Wq-ykFq6I6aeOlegLh2CDZ5tU5_ceC3lJxmwWvm25B_dpd2Krv3Osi6fT8YWxYRYPkW8e6J4gF_IvEum-toxAqy05fymbRTk6abPs_D-wPbbVnnRTMUKcD6qunsX-ILUYDQxOJJPYOMIj-drCKAFZ--blKU58uxffcP6t07tOEuL_i__l2pSQ_foR_9EJFoBls9itAMlIlBfdh1-wkX7NdtKdYWtRL5C0YMYmVZmi0Ad8ZXtmaXnmkVCJ78m4f-adJydS4THSnDHWBPC_fi16ZxwlbCG9LHXJCCoq0hi6pJCZdUOfNp21nz8rRpUWKSKt--fKbOjIBNhowEb7JjyyVepXTSu3vaFWFTqHgOCN3bXr4pBWi4gairBfQ0B0Zs30Mdu0SjjSlz0vaIle9H11QdEQwmSepGRcixkZcF-E396XX5PaS1dBWvPmSc-vEaYGibcEpHVzqdHHP7LD04i5tV4M-8kS6wKxVLgclq97G5IXEjQEtTBnEn1IlR1owM4EXM0gKCJeVqvn3vrIBvs5irzxhtniEDWxP2NWsCz-wmKVaEJNZHDPPU4xgYViBlACHJaIjSmK8Fh-_K-1ctE-FYqXFJYxonKgNjNpWt39pEfXyTJiV8SekPjDWNr66I1AhyDscGHaB_v5jLSfpF5tCM-TwI3-CWK7mLO1h4NPOA5FEvAEru1d6_OXLle_2AD5anx5XdRoKzWz7GhlXuXtwhsTly-Ixt9O6fwhjiPDVOrxph4pjKjGLu6AJnzDcJtsDUJEZDya3icD3akGLl1zfl-V1gKRNkSB_0jJt4CgrSMnhThQ1MOgLWNpe-Z_K1CQc3LdtgSJXhmgLjhSqTEISDLLhXwOrr0vaAKmK1Vx87AlCeTxK3v62RnYlTIx3-V-t75MWFZPYpvMfMkKG4zT4wCPa1pyyCtKqZuRg31BF83jqjdLQuKoT4XEIkcmNUtumYGC-_efIzyMxpYFa1kEBVmvVcOzuC7iqI_ttNEBCSTn4mi4lzdYhLMbdiZdNVDuFVapaUsrzqcKj6eLT-72ZOYGYaV27IkpPMig7qwjlYQNGjVCpwbCYyx-IVJXNInN7lrFQJPbKIlsJlIXqJOoprsB6Yuv_Wnuf66ciZKSJ4pGnBraXsnPpIHn6JFNAbqaiiwK8yrHF1qWDFpjoolqmD1-vuCTC2MOuxizGr3Wu6tZjXc74i31JVIJ3_FlI2wIC5w0AzAFjWklDNRabHlS8DvvsfjCPONXZCY9rAMaVP5Av1Wy23XJJDE2gqx_k9ltuQE25tCEGbpZnLQTr2DRtEIql3mzo6xbYaU8WknMKGyQfEhYDex4_nYa2M2SgXuDoM1ofG7sKIgcAxN1acsLorVMZQThu8qJgcBGXijB9iD_n9dHlxvKElQ9fQHuaDY95fl_RBqh_GWv0MjPx4lygNHR92_gU6tQsfXnspwiAwiqX1ag72grIQuNPyklYr4fsRWW9NFG1BPjMwoI1wumyqke5Zpcr1pSuYIx2qXXw&cid=CAASFeRoId6P63Bqho2pji2sCB2aCXaZrw&rfl=1%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:25:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:25:58 GMT

GET
H2 200 deuskDE-EU-WoW-Classic-BurningCruisade-Launch-Darkportal-Playnow-STD-300x250-0.jpg
s0.2mdn.net/10176009/ Frame 15D0 90 KB
90 KB 28ms
8ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10176009/deuskDE-EU-WoW-Classic-BurningCruisade-Launch-Darkportal-Playnow-STD-300x250-0.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67d89433ac978f10ff5ca9d5fb1a6bba002ebce9911fa0f9617a20f0a4480984

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 06:16:43 GMT
x-content-type-options: nosniff
last-modified: Mon, 31 May 2021 14:05:13 GMT
server: sffe
age: 54718
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91893
x-xss-protection: 0
expires: Thu, 10 Jun 2021 06:16:43 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame 15D0 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:26:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:26:08 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 15D0 0
592 B 70ms
48ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsst0yTxsc51-SaJIqrW8HvBRbJVhNY2dGTrzaYXqtNjZsMpHrWMzEgG4_LQ3DJEhGmTnGmoyL7Ly1JGCTs5CW1B9HPheku826cjMPMDoO18P6TTU5k9PQyHMl0IrhqrOFkuwU_T87P_TQVynfBwlrZBbRzZsi6Ta9CmZo6gDvXrDwesrQCeh3jIuooJGpCdBeOSTlVC5T6jVgVowS9dnNunFcA07-IUmG7AV2Fk5iD2YV7akNNwvKSH7P81-d2juDH8sRCZCLWM80bRow7cBvBt78L2hFcjo8eXRLaj7dNOTthZm0ObONcT2nN-_BELXZX6wnKyhaKR-O_5PLiBJh7mrwJO3gaApXbP-AWwY-RHUXZJjVRpRDE2o50B4zQ3VaTD525fn0tgev9iiabWHR0oWW3uqoB7e2tp7woPnvQJhPwSeTADUKpY6H_PoUPqO5cxEI7OCFYwO63fu2B8GAHTYPAy2HdliicbMo9KOIuzQskVNVRO03b60cFWTejw5n-3T0OhHAX7vbaZCBCjFv7pNVaEUAXffz_ILGvFHDHPQTQffyww2R1vXadPeJmSq-4HynjgvVZDRGPNsI3DzGljdQWkthxSIMUS3a-HmPiE3i6JT_Ie2VKvU7Q056pdCWOVS7oOsfNNuioOtHJxVGuC-02Kdohz9CNy4x_3zwNeAPSVuTtJfJaSeGgH_oPNXt0nG7-x0RlZykXdYuQL_vS2DO5t75f4i9U47zECpZwhGBKIqT2WQLpcDEzgm2ybxgOPOccRVjCz1GKqRlUF2OyiCtL1g2eY9s6fnRYLVkzD8foxB4-CJxnjAS8TufdHveSSOTzBwGO-QF_dfps8ymeizlQAKxH8P-769KKMMq6jmGOeP28XxgnoueAEw1LIkq2p_44lmneurPZultjysbgYP3FxUVMp5_sZ4HA7I9rFTlWcDnlaWpZY-KRLnEJfcgzPqOtHkoS3pp4YA5DBnHi5zRMXwZwYCpqqTpOEscjm3-7vCDQ9MrXWtf23tELNTvfryJN0XYeGIwOH9mqSvl0v_us3M4oYZ5segzlacjPE_AsNwexcHIYpWzDcdAfWk9Thbtf4LZIQT6FetvWPP_YXPFilH-UNtFt-yAlqY9Zxt1sGX4IGd8jmi7mgp3Z1xsSmIoXdg9auLrFV85YSefBzVemG&sai=AMfl-YTfkWbgY4s20TGKsDdWG91iye2dcOTrw7K_lvpTrmytveZ5ZHkwL_5Iuq4qy8b4kiow62TOzpFe9pbthrmlCIEUvv-UgpeVsgn4ceGDoelil3HnC1_nJhihx6ZV_tyrtraREoPpjrbTTIy-7nxxtvR-8tBk380qBbn3ZOo&sig=Cg0ArKJSzJUDVHMGbp2yEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210607.69367&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Jun 2021 21:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 15D0 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 15:07:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22869
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jun 2022 15:07:32 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 04B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

43 B
894 B

20ms
18ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIY5KeNqgEwAQ&v=APEucNW7L5vJISbncVJWnMUwkKhjeW_3gyRBdAFjuOSjHLuZcBujzL9jQtcM4kXIuyudHER0T5nT2I-AugDrjDAE9hhyhzD7xyI9tSWSi1d-pQ_ap-Zb9186mMsKgRI4rdifQSxkTYTBnPD3ibxceBsw1EudcvTbh-gf4-GW-4Z7nCuAiC1NzdY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 21:28:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 04B6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMEyidhi5Y814tpee4ePzAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

43 B
1014 B

35ms
35ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIY5KeNqgEwAQ&v=APEucNW7L5vJISbncVJWnMUwkKhjeW_3gyRBdAFjuOSjHLuZcBujzL9jQtcM4kXIuyudHER0T5nT2I-AugDrjDAE9hhyhzD7xyI9tSWSi1d-pQ_ap-Zb9186mMsKgRI4rdifQSxkTYTBnPD3ibxceBsw1EudcvTbh-gf4-GW-4Z7nCuAiC1NzdY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 21:28:42 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 04B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1

43 B
1022 B

42ms
19ms

Image
image/gif

185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIY5KeNqgEwAQ&v=APEucNW7L5vJISbncVJWnMUwkKhjeW_3gyRBdAFjuOSjHLuZcBujzL9jQtcM4kXIuyudHER0T5nT2I-AugDrjDAE9hhyhzD7xyI9tSWSi1d-pQ_ap-Zb9186mMsKgRI4rdifQSxkTYTBnPD3ibxceBsw1EudcvTbh-gf4-GW-4Z7nCuAiC1NzdY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.183:80
AN-X-Request-Uuid: e199df55-9a6f-457f-b6d5-ce35b0f0e749
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 04B6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.55:80
AN-X-Request-Uuid: 40244ad6-a9bf-4899-a74c-069be4f2f028
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 418C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

43 B
894 B

14ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIYgpmNqgEwAQ&v=APEucNUpTOSBaGfRkq7itbtHw77WIbUe7e6U-s3KDeV70Hz-dR2PEkOq93uRvfAuFTGk6fPdNUyUtA_niW2LIW5L-SbMEV_3nRx02PIwcMRXEJg_OZcgPpqgE6tom0yX0L8SAMOZLtxYyFkM_N8w-XvWLajL9O12-89mzx4SHAZKmPWtYHnEBzY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 21:28:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 418C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YMEyidhi5Y814tpee4ePywAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1

43 B
1014 B

66ms
66ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIYgpmNqgEwAQ&v=APEucNUpTOSBaGfRkq7itbtHw77WIbUe7e6U-s3KDeV70Hz-dR2PEkOq93uRvfAuFTGk6fPdNUyUtA_niW2LIW5L-SbMEV_3nRx02PIwcMRXEJg_OZcgPpqgE6tom0yX0L8SAMOZLtxYyFkM_N8w-XvWLajL9O12-89mzx4SHAZKmPWtYHnEBzY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Jun 2021 21:28:42 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGbOmMsi2xyLax1KKRwId88&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 418C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1

43 B
1021 B

18ms
17ms

Image
image/gif

185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQg-LRwAIYgpmNqgEwAQ&v=APEucNUpTOSBaGfRkq7itbtHw77WIbUe7e6U-s3KDeV70Hz-dR2PEkOq93uRvfAuFTGk6fPdNUyUtA_niW2LIW5L-SbMEV_3nRx02PIwcMRXEJg_OZcgPpqgE6tom0yX0L8SAMOZLtxYyFkM_N8w-XvWLajL9O12-89mzx4SHAZKmPWtYHnEBzY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.77:80
AN-X-Request-Uuid: ea888eb8-0249-4d4f-b27c-28354e8b232e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIlPSTLnbtRGapitlLgEE4Y&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 418C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

170 B
188 B

15ms
15ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Jun 2021 21:28:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.101:80
AN-X-Request-Uuid: 71fa7d06-c593-4254-ad19-294a1ac36d80
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMzY5NzUzOTE5NjIxMDE4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame 6185 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-APOMed0JfuQR_wIdz3B0O2ZTC7ENbVPI5Az2KxmLloAZCDbT42dyeNbxn_b5IaJ7jTLPHNOSEt0llLI6h6UMVY0Vq50ttgIMpQVvv9XLFRlRgT2RE383Ka0J_XvdkAViTxh6EQjmLHR2vGm8x25TwqFxi5ig&dbm_d=AKAmf-Bc2RUDiGEbZviZVB23vireAOAxc7BycAs3EMZDJ9LXPPu2RirC-bu5O36fVJUpwAUAVhaEuCezQmjMJ5o1PU3fsD99UwBazhh098Vse73FjSKEPwRZ20b7_SoA-kNZ2vnti8-2MaKZ_SdQQUIfKAdt87YZqvKgj_ESg4SXR9ico5hpr2Mn092yMg601E5ji0ajZwjYn_UlvWbVB3nB07LDm_WLylBA1pzs2SM0f85GBeSsW6TlUWfCsx_V9jYVEfQdDFncK7ZQneTGEN6LJopNP8DJQfcBsqnHoIVyC61WAueDP1HxUj68GgCOd81Rbk9_aCZn6DFO9SkrB1sAVDIYwgbAgjBvVBOUrd6L8Q1MIZWkEdw7RJvzpXe0_P3TjpiI625ysVlsmvRb9pc2F5Z3gd8BHGnCNmmSqw27f1nQfJlT_476ra9GkdL2e15RR76RuJlJ5LXi8kwn1u_lc7mAChqJ4_BPc9hnM2mXAV39GvhI9ZLFRNH6fVcvPFJv0z8sv_vH8Xg2Y6TIWDn1SkX4oOXB4r3i9NnurNV9d_HmZ6SR2SPfxy6MogfySlmyUMsbAkG35tRwHsUFVHpwmsF2gYMaBEx2VlRSyBSss8_OcDiNtsEhBVIMwu87-OVth76CCqO2f7jTQmrAsccYi9DJPUnL7wGApuCv6jARhOPiMiQ7BTtSD_rhzalbhcMus6vBFBZMgFQXCp1y9VzTSausO30Ezq66IdB9gqV5MXxHw8JR46rywbIcNF2_GMPkM2_987MesrruvBpNnaB_lvDi2GBXOym5FWuSxxkV5MXd9KU0LRTzSQdV7FhaUTm45i-V_sMZ8KQ4SauA1p1Nrd5SJDDDGTQw2kK4XR11aMIBy0x5O3rOxL2hxMaW44SLAA5auINb_kJlFwvX9vFf0e_My2qJ2FLxOojjgaFt2LbMnOY2aLh4rudEpmC3FH4IWSvXNluvftJePWk-Oz4SbrbhcgGI_Qk7Iv3a43OHRMnogBZtUMB3nVWTnFuYWlrhaxi3_0t_9-lJmQMUcPSWGULBknCLwmgNEK9Jnfw9hpqCi6lph95DN154hcLJvAEysr59f_sPr0tCQ5yZ6npI9Nhzuyxp0BH9abj0q-SNqrwQiiWOfDhd7DHOME7eIUH7hEBaZn2_F6Zt-ZHypIABQtgI7X8WKGYulE7B62-iqr-sCdT2xa4nCXk_qLtsvj0I7jmuH2bkVG75qj0HrVwSPJPyKf8Lq7BRHgYln400YU1t4r4QQ5IyiLzvbqlun1TxCd8Ck53nD-B7E_YR7MMeR5yV5EaHJbENkKS-yhrDQ7p6YwIHuv9qyb6DBpLkH9ewd7z-ftY5vUl2NuWR6qRVL7V2dH9iQ6iQP9jvMVPAauuzAbHREZwLihkCYzL8_rFMah0IXXG5xRY61nMerWXBfiQMfyxL1GP9642vi7ap1Gbww5JsMaGtZE703in0pXKX-xSVnrKLd5DOXBV_3x9di6r2TL29gWQLAiqFPVRLkFOjAwElQeHLqYyocOqsbyc98bg32y5IC77e6It5Utk1hKqlZciTeVUG7w_F_1DKetWO2P0vWZF5nK3WHCs8yd6On7hXIE0_Zx78IPcRZ9jUls1nf3Ntcq358AHT_mtv1_bebEZKDnyU9Ok-T3rClaVl_sIEtMqFkunystM2na3VviRWD_anZKikrNCNRUKvUH6Tq8_QlIBFiDLDVtGMX8SX4NXUalX467cfm1Bw7OdpviLHztUygATjUrivx8BmAfqv7qeNOlKIEA3vMuRT7X-sA5ff106jJ7ciPvb8AZkwuGeioIv3QOWcK379iYya4A_OoainwpbImxDIWw5o7YUWG4ZsZDGeZd1RwcCpM6Ft_zfGIIZ4zXr4CimWQHEFUUdP-nH2bk4S0FwMLCpWQcBwPdt4ZTmtVRDaaYB4LjpKMrH4zQ73Kay2Kh9ZHXelTj8i3S4SvUKyaYJCTiP_p66QMs3t9wXuTA1b2Y9YTpW0jjHJ1VkhPZCeiG9ueWpbbzktuejtEjB4pMsEzUptWU4b-MaBhi1CAI8QxCHfYEYySP5x5PVJ5d9A8J1h8oRxixOjlV6Z1B5Qm8cd09XaokmSpugknnpM9905skQaHwrIkWTHGagNIswXSlbfc_523_O5fIhYArBs-VrAFi7DerRhUhAGWrJnCEwRE1YCeWQRs273AdXoZt3YJxu7s29mBDa4P4zp4AoNj-JuqrydwdxiaUTch3QxdmyYAud3sSaWreGEfjQAj2jI-hRgTyk8-iNzlpFPKXX-18LqWWUBh-cQw__bEy_QfxxcPcPKb-KgS_zTt0uguHv9Lng5szKtSKYOowuz0LVbXL8k3lVPBMAUrjJJsVNoQaC95LvldnmLbGn0TrGdTgZWtal22gdbML2s_3aI2PA5sj-Pf8F95jsW4GnK6FRbi61R8cXPxd4_DBo7XMuHN0skoLs9vU63a6KKRT3I0idr-k-Qdvla2ZWpcTV6QDfWxLVfSRfDEVolpWNQ3TzvfJIWe_JF6rosjRK9a-2YyhefJW1cuWTzMnMhgNPZrjlouu0BzD6vdzAapWeZR_zyO8ncQtgkx0lPqJuSQ_I64VgKdXAk-JHMr4jI7slh9rVO43ONw5dfG0IOWtvw4P5yGA05tcpmLzaYYNA3ipurL5n23Mvo1yxYcVtmvRW10Pp0YSESQ6O8KXa9xzIF-8C95HOZU4uD0P0wyhZOlFdq149y2qTPIhcivJsmlisn2jiyFKwY1-wPUk77nXaGyv1X6wMZ4GKF2uMYWSE1ltlpG35yixmKw2wDfCheiFUF7M_ASlWuI0otpP3uSIti64RjA3oX4SItCtKpYVQH09ep_Chpiz58CHnAmxoyE79zaJlJLHOOr84Qy6TemW6KsELq6vdLrxAHJ5y7PpqVaQJrG_FysMCuvU98L6piBfZI3zYqJG90sagmSZtbxK6-wuBvpUE6Ke5J4uf4n3ZpduD00MN1PVXOKNXI_MEOIxWWZI7-Hz1Z1ptyTwLknDeSCFsBxI8jX10TgK19kZmGvPA2nV9cl6blQbtJ6A_YJ_WPrAeAa2DjCeJHp9blp9F46ieR8be_725Sm7K7nMp3ULBIADw&cid=CAASFeRo1MyVkqAr9Wn5zdt4uWEu2ZhSFw&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:25:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:25:58 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame 6185 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:26:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:26:08 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6185 0
61 B 49ms
48ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstgqq0Ix9GKW17Zb9SXjQj9-bmBvaBiPdRvfWQZtzBHI_NJhw_yajW6B9aXr_228KnmJsk7wBPQ1-VSHRBCfeO9IzRGtLb0cgz1CP7K9tRB_ulbXuEq3a8wBJKbT3cNwYAhOSPyj9SZZVCMMfq9oKkI1Gk5tduoLJDKAIWyv8wYB7RtvuV1PMdFXNeIPX-irMfh9sfH3zX_wSv8waTHfPoNfru08I9tHE4FO03X4RtxMMc5oFVAItAVMvqaWcLjvJZXLqQXHP4sRTuSJaVeBU9NwalDF-kV2tlwijxBwg5zAnEcaepM7XPJ1wVO2ZnPFPMms0wCBY7WKl7Wb5AqifBL0VdYUuw9ueH0yK9CeBnEfEnLj-xdlQLHhW-Ki-VNkfyf8NbJt6ZN9_4lqATljsL6K27T09CT02xKH0AlzqvU9aiAfF2wSmyaMB7OLcJyDTnIa0AZLKaL40rxXpOT2034Fi8M2HXqJDmArL1m-l-G_VX3oNA7PaJq_L0_G18n72rIMyG0npD4ZYZ2-idtVC_2AG00UwLJz0s66cGKifMxk_cX9WFfJ4A0c9qWJZ34Oy51gZL5bPTmQyN8kITOibNEFfucrhOITua_aLBUNdwww4ZB5QQ6CZdtsizEYBOjpvxY2ZQTWynJIDV0iQgs2-GEX8BhYfIupAiHcSGed8sya2mwK_fJXgBpTSzW34se1Myd34UpVY-6qNNjDNCWwICQoQxE3xgVdTICYUukBI0zjRGEKnziqqqmHvDYnNcRsnV8id6mZFix4Z5LU-HdDfLVtGoNF1yMfK1fY-mOMVqF9Lsi2zV_9pRB5KmCU4Y3F0wuCbOtskhkTC22r8vYKVxxQu6msX_ppCPDQ_3KooxOQOCalc0-Ws6X1mgZMZanlpR8VXuxjD9v1Azd-393xeBTmIqIvRYh2VQvEKRtHmUmxEDn9dH0LBlr6OMS1SQj2mMmnGFsLF2WzLMHRVcTo8UTZAhN2mFKsAPW41dNjWOohXgmecJTWa-HnX1Jcb8OO69VxB0GBp1-eEQMQefdcHUT_1ZyLrWoB0vO5X5n-3DAvj35z4uiG2jpnbfs_MLIjoy-YjoXLTBgs-7972lqKI-GzSqUcyjsTs3mpcs0C0ylGNMkWrkSK_Fw0f3aQB0SwjSZcp2ka9-kcbnAslb5ApdKQ_bK&sai=AMfl-YSiNXoS4-HEjsGwgyv1kV5eWSHTRzOZ--OcQpoPCISorQDmZ3c4mkolSAK07KaWCP7_j-2CREyfRjNedfrXZG6exJ1mhOYhkMYfLk_dES2ZmtySPEZtfl-bnBtvg3St200FixmT6QHd5dpz4I8j5iioBxYmDlMlIsOaVeY&sig=Cg0ArKJSzI4NFfSnJamVEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210607.99431&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Jun 2021 21:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6185 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 15:07:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22869
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jun 2022 15:07:32 GMT

GET
H3-29 200 PAY-CR-696_CoM_Summer_Campaign_Q2_Banner_728x90_MMOGA.gif
s0.2mdn.net/8264868/ Frame 6185 52 KB
52 KB 25ms
10ms Image
image/gif 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8264868/PAY-CR-696_CoM_Summer_Campaign_Q2_Banner_728x90_MMOGA.gif

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a599b2c9cf9de65a5e5f072dec412cc5b8857a66434317d1ab4252efeba38a48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 16:09:02 GMT
x-content-type-options: nosniff
last-modified: Thu, 20 May 2021 07:45:34 GMT
server: sffe
age: 19179
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53198
x-xss-protection: 0
expires: Thu, 10 Jun 2021 16:09:02 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/ Frame 74FE 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BQoqlpQ8xHLUzlbGottMxWg3crxAPvw7lGQ149o7ihUu3QP7Gb9yiHlbHa7OAhOFn4-9cIIcSDReOgkCdaigdu-dQUddv5HgT2y3OKSraZOULvkEjIl9nlz8ZLrqm3QU6GyGrkVlZVytflS6cUBCnc3NluZg&dbm_d=AKAmf-ByzMugv1_Da4RNyYfvAEvQJGk5XMFnKsKweQsuZ73GBp48YCLOF8y1JGmoZ3F0Fniuose_fDcVMh1Eao9oG50h_rbJ8Buh8e8dc2Ob7ibJwXu0dnJAKfKHMvwzQzqT7BK4iUCczB3eWnrTgO3ha7EBtNWP3YLO2BZ2UKF0fN7Xlc9HtZhcLQWEk4ETqz8BKlNsp6ximYcBecTFCw57B2xGFjPFIXY4kn3lvM3F47xTMrbORk1aT0Y6Ww0VWw1FGTOChJGEG4w2PJVdjbTi_SR4Rdtdfj9Pvl0pKTQrUodAw3d78mr_TjINckgAhgIAeHIqWhra1gXxX6h7RgdMs_Y-MFr2e7HTbUfCISDOn_z3LrW3FTGKGlxFC5nDwc7umyifq16sgOajmnn6ytO87wq1JRrBgrc8EtQw5s0vWa-s5_dEmp2qJblTfIZ9E4sLb_IUAyGGmjJP7n-5RMtlq3KPW0HE9B1Ou5c8hd5Y7XaCR-TCWuQyuey5AQjXQq5nWLrUsQLb3LGuAbPl9W6fJFZ1mJm4T7ZFw5S8oyi6kijiO4OFPGyiVumQG4gxK01hEG6JAaoL-uAx0iKHtjUPTO6CJy1vG0NOxdMq-Wjh1V7lvIEEJoyd46ThHXsfvESAQwc4zG_rxqNugSGsBY-ypG2KakMw1_D9KPbC9t6dJ7UOLqdvDhmE2apNNYnkajf_TONMLsPBcolAsRy86dUcborq9IfyBYn9a6kG1PagPlLoNZcfAtWcjaP00TyElA0tI-4kkio_2OHkfUuDcLKreZSm_SGJlik5A71l37kJGxDNjxwgbRAqZ53eRfsNqPheUawFBVJHXDLGyo8bFVqNiOMFdmzGGve-d2ouJRSOSqPWBnjtXLw1w3qmiv8ckQ9nd8m5f5DyBV4Zwus-RzfK0Nlyci-uDjR7jhFgs7KLr_DVkFkYk1fwu19ijvSXyV2BEW8JVp7_E4HN3bKkzpb33E1sLqCeM4fxcqq1Tib6uN20kA14l2Ci4t98TrDtLC762dTlW0TKbpmoDaBc-h7ZYFHvuGA5yba4pMIfzslyJhOxgG30-jGcpe3ziVHh3xKyuptH4px2sLjuKew2xst1Am-IdH9YvExexM4FqMrooZTtosI38X9aP640PNIRjF5BR5IfvkoKrLFRLbsR3nFUlxHRpybssAg9ObQT7b3mnuRwu016KcdhSp4lxRU37ZtSKavK5SZwmll5biwaawzXO_ZEVyCV8MLkOIP79qtF0KoOi6s6LA_rRisXYg74BMOq4gjNo-Z6nZaA77yDFVCNGM6NsM5LftSVYERNjchNTiXAETs-TwMMDF0wd48gwQXpvsq2bvORP2bWtg0BdfNhS1J0UySCNiENDWxylPj8CFZj1O540HIK-yovhI4Zbix7S5fkUQFbX_u150syxaN_b4o3jcy_e20KU33Rw1jyD61QAoVfmk2O0C4GjM-n3bjcOXyTCrL4E-zFYdbDIQHhzVGmMMjrb1z8IzMVe8v7Hk1U4s4hcuP6iKL78M-pD73e4aUqkR3WR0azPPIOXLO2r3_-G87Do11nRk7NL9Lb80arTE2vFic-ueJAS4VBY00cQTxdMCv54X0oxgQV_BKw3cHxIOr5KYFbLaokZJepLppqql_vBsqrNRs_Kj9SVTNqAODTMdEuKzdUBMENMJPfnVemJPlW_s-eibjF64UHPZRAfBCsb3SCUjWf-RYkG6zKi87NeHQZEY7NzoVEKJtKWDXLgaEj7UspzJor_6PmaJ_wG3cpwoOiwxZDegmLgAm3Rfe9NXUbrqPHhOSXEfwoA_UckH5CKxFD0gX5nwuzMcm4QKL55Yvrl9OEfilcp4Cusrx0VRmI8V1xm_mSYiH5fsJzGm2otQ8wC54yaA0SwTHL21ZUZUmW1xks3P3tkj-UHz9dOL83c2NyXi9MqlupLa9Fa-VlXnKRWSnJGfJP4wnTHUnxbY7KByyTq_jyEQw9aAf-AOTi-plFBcrHazYJb4l0ohzPEhMYA0qGFrBSR9i7UhQBuqTJ6LlIVBZVocQcvOfTzi9Ni9ojCw8bw84GuBiP4B3lkZo68qgFOkcdZxdcxevVg-82w2XbSPhrnslSEs8ZMafRLVPh4GD1neHUy4W4fdeyrNowmd28DZK0q0Do2pY4YdWIe8wo0eiUxCvAdkvgJMRFVrCq0S-knB7hGbcywpC5QgKhLf0e_6zvr5-vZqr9wgwRGeggvAB_zn4zkZDolVcnJk0_Okthm5V0HWyow9hK4Ntq_ZBob_bGAq4lMcEmXgfmG6CcirknYOGo4gKeT-AYx44ELIkLn4THJitVqMsz9Vn4pgi4f5-DYJNCLTEZ1wS1fuTFUPbUs9S3SlAUqjBwr5Eyxcm7wB7NibCDakV8KdAXh5EwyR47dAQpzFvFefkLAgB2adyywkDk7EmYbSPY5VoyEZZ4vPARyTy2J7PAlj9JZbFK3PihGg7zFSprwETzmw5tmU8yBNKWk3x--7js0lpv5KneCmQJGhCtLUTyuRfjhoOgVBx_LBtLbNT0yWOchkANWXrhYeWKKKQANF6KI9McnJ35BXJxyr1Clh3SWDOM52pma3148XKrrvthoU1X_vr15UoGkAeKBOfLk-Iy1DksCtUQme8IsFjAAfgZ9Gserk-YFRPOo6spLTwUPq5R0cArKRh3FSLCo0VZFgM0jMd2xA-l5Bila_GLyoEOlL89UZj8VCMLR4t9MRcss2AUpXq1JEeLyS8GNaWddrOnm_ORzl5JjmjpGIv95FZqc1QJLjnEl1dLcwafjkDlpiuJh7403Os3LJeR0vkXEptnbRWfKLzzQLuFMtqNRWNfQ3thJ_odSLsmIwSZxhpwQI7NzdwP9BNSkkGkjhALl74HnJH-I7h68dSYD9QCbUymJOWswSaYswiN-q1b0GslVT4-VY_wpmsEEtmV4psEiYvGrEHly7-p6wocFoj8IFRxRQuZI2HE-AZW-Unadf-g0fQEoD54kpYxrWDpK4ErjpuQ9CcmpIex_4CxDWUi2lWYh3FiAxtQcP2HbcNhE3fowKmNfVOBtDOnteHEROKUIiGAbri2UHiMcBGQ_kcdAEDmZO9-_oOIctlpKw2NxFR1OBM&cid=CAASFeRomlsOAsnWdNZ1BJRvs9r2IWETQA&rfl=2%2Chttps%253A%252F%252Fprnt.sc%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:25:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 18280575870105241958
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:25:58 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/ Frame 74FE 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210607/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:26:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 153
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Jun 2021 21:26:08 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 74FE 0
61 B 47ms
46ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst8GsqEdIjfB_dGcSF9R-o68CfR7wv24XnQn_RvVKiDzYhqn0hxRg42qkqpw5kzi1AzsDvxfK1TTc16swlFIhmoW30h0RRrzhn4_H31DRKqmLS_H5RICgW_zSOLRsvTxP1UWc2AR9Y2iWYUsiqml00PxZr2pdR1qA2wJQEXIHosf-KUPONK1apS1ib4lbJOG-EV9Zvkd7Alxxx0ObelKyh2yJUvAXj0vrffLTU-R0b3XaSvSpo_BCZF2k_hgJeOxivWRsJDuYEaHywXXjfi2xrfmZws_jhy7T-4AR13cVVXegEih4_Lq3FxD4IythviiHX7iV2h_LBHnqLm_9Yb_O_Hw7QBItTIs1dPY5U2ug06HBVP8-V1FBdETjGttIqQ4mWUD-aZyHddluWZFnaBl2rAbtGgxD6VtrBK1TPnFsV6BNaleqI7jUCJ0uEN_I-rZyzqTr8_eTb5SESoPukmNFBXCkc0fD9vHeOzBW1C3CyEGORwYFYhqB23G92QRXYo_MHfLfnYI1yiKNT4hNMZ3EZg1kBwo6IAc-bgT6tmG-4vpHM8d9mg6WjN1t7N9SF8Zvemqyy77u1KPYw8TJsmHoQqaqq2_F7N3oZfsY_0M1CmcxUM-HTsz_95Z7skxs1VoL96Q6_pUZefS-IILC4_1t-hBsqXj-5niySgGs6NWY0t11sw0c0mjpIci5w1-buZBV_71xJT09JPRvZoLp58yTD2KLOoAra4oSL1IfcYSW7vxOnOZqEfkjJx2F3JadS8t9UfGyjNVf9hDREPWLyNO048ysQJfjH3rnGv0eVkFLcfozUpBF9LS2lEKhwjNjCopOV0xYbkiasOGZo-7IRxZV10KjX9-_KsnxvPi_RpmK1dB9dG5p4tB-8ot0rl0X6f70_CBPWkum5TxCD4BsUuDEcZT52TmPqyu7gpNaSrG0si724qbFh7iFbD8Xm_ZUSFs_UoBsaR9k4vQesVqJJbREV_C1n-CaRdZn4iOydNV7sXiHLnQldxhpkRZpFUX18kwz8NIvHEzeX3xVIwTrYHSqxADO7p1I8xMpxqXR8xMTnVIi9O2I7UzFhN3JyZhLpXK99ikt9gOndjQUnQhJ-SFl4BGqSmHrVQstFVZhJTDqU92s-eh8xv9XHKcX-rMqbBD-CxRyPHWhlyP_t88lb5Aw__0oioTSZynw&sai=AMfl-YRZT1f4QjBtGjYWKFp4vSGSIFUUjS9XRSmbcyNgzLqIT-c88ku8LRsQOP4auphc06iZWIgWaqcLylj2ib5NGpVDagGHLBMEe7Ffx9tkVJv_fyXvxLewMZv5hvyQ-V7yILvQdOynIclPPpp51vQS4C949ihUKjS5zz3BSDg&sig=Cg0ArKJSzHJt_9DcY4-zEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210607.79385&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Jun 2021 21:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 74FE 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 15:07:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22869
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Jun 2022 15:07:32 GMT

GET
H3-29 200 PAY-CR-696_CoM_Summer_Campaign_Q2_Banner_728x90_HelloFresh.gif
s0.2mdn.net/8264868/ Frame 74FE 54 KB
54 KB 11ms
11ms Image
image/gif 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8264868/PAY-CR-696_CoM_Summer_Campaign_Q2_Banner_728x90_HelloFresh.gif

Requested by

Host: e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
URL: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f07cb9b5036cb531b6b8176176ce85b8ae2b5ef0f7db5d79e7fb8ab57492423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 05:59:30 GMT
x-content-type-options: nosniff
last-modified: Thu, 20 May 2021 07:45:38 GMT
server: sffe
age: 55751
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55197
x-xss-protection: 0
expires: Thu, 10 Jun 2021 05:59:30 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 330D 22 KB
8 KB 7ms
5ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 09 Jun 2021 15:09:26 GMT
expires: Thu, 09 Jun 2022 15:09:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 22755
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 15D0 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 46f0c473d1873986d918bdade9e2d111a927db126eeeec135fe2b0dd5e0a91ee

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 6185 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e117f7080decd87848dbb35b256f19c52b7a428edb492d33819af723bc0c1744

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6185 0
23 B 57ms
43ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 74FE 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 70ca5be517c20d93b39fd9558c0e2d98db50ea5cbb106766e92766a93793bb32

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 15D0 0
23 B 43ms
42ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 74FE 0
23 B 42ms
41ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 77B2 22 KB
8 KB 6ms
5ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 09 Jun 2021 15:09:26 GMT
expires: Thu, 09 Jun 2022 15:09:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 22756
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3275 22 KB
8 KB 6ms
5ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Wed, 09 Jun 2021 15:09:26 GMT
expires: Thu, 09 Jun 2022 15:09:26 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 22756
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js Show response
pagead2.googlesyndication.com/bg/ Frame 330D 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 00:21:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76051
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5768
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 00:21:11 GMT

GET
H3-29 200 wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js Show response
pagead2.googlesyndication.com/bg/ Frame 77B2 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 00:21:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76051
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5768
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 00:21:11 GMT

GET
H3-29 200 wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js Show response
pagead2.googlesyndication.com/bg/ Frame 3275 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 00:21:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76051
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5768
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Jun 2022 00:21:11 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gpt_2021060801&jk=3469460283076390&bg=!rq2lrenNAAY6sG-_OrA7ACkAdvg8WpxCbSeRkioxxoTWQf9Ld_8CbKsUzfB0c6PNqfmjPIpGS1uZbgIAAAFFUgAAAD5oAQcKADrHLB01KIVRn-axJtnQpcog-aUv4ZPY3TSc1YtQZUydqu-zUHRuXZr90ElOTPpzKwl6N_PwLGXR8Yl2mQJk0uStayUF4uMktel0MNsGqoARuAYXG8Yk8aLXVuOpy0TZAb5zt84zMXLO_SIeDvR8Et9FOZNU-yazzVGznUmjFycZgRAs_8tkDBVzbWGq1gy57fvqJ2WqCjxDLwcU6VFk1zeKfFgt0M79AE8NZB6zmDdXzCUNoDoYrdS3_SuZokd7SclhxgTSVJMjTs6l9tDS88vsMCex7HmLs4ozMitRLkvRg-YYJ8W6S1azoZ17R07pzoOekP3NRO0r4NmYfXtfe176MJ3OJLZ24KI087wTg_r5Navg9pYt-DBOEE9KSRs6g402tMv2RrdjzjDifLgyspBR8LSJO6m60J0zHY3vO_WEWLdDsB0Y5cbPtXcUHUAPzt4V6NqwJJCGxZ_ygp22bttxKjvS-ZIeQjsKKp_ec_BEmIi8tgvCOSxJ1HG9lPvcQw3UUK6_BfzC-ib2DC039o2CP14cMWp-murrkPQvT2FXFW5ihKGohNxuvdhFCVugfpMwjZa6737XQbTKdgA7P5gkUPVSElVIhTTVF5VRYPV0q8Whh64PwQA1e6YvN3z0fYLI7DJgzD_TBgc7qYSPQpYXboPnNWBnIyf7pHmXuFVDNn45nwpkgOFq-PD7IeWuppggLWxvyu9IEIg-y6o6Je6BV9RN1OpKfhrcAR9jNwIYJHY_ZIRX9vrpsgJXoj_sw6rdWzvPOI7f6c9_p8FtCmqh1gltWJ-76upigwPn4WB8JD0mZ3AgPiSrH0QLttvKER9LZS198QhG4Gl9UqHsoAKRn7ImxvXLLA3ubmq86WLYBX-75ws0gQtmX3Sptc0hBDIJ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 330D 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BkHchiTLBYOrvLoHO3gPHnYLYBwAAAAA4AeAEAg&bg=!NTalNnLNAAY6sG-_OrA7ACkAdvg8Wmd_yA67Oq0wI0taaQfpXVDJtPYh57J0wSBayYbhYbJbxOpVGwIAAACzUgAAACxoAQcKAI6AbjpuJhCquMucbwE4pCMcnjm0zfxhwZtY-Y5aBxGqQxqzBzYRo-2VGxqr0vMQXW2WHwGAkMVm2oBGWDRygz2Qp5YT9aLmw2VJ3SvxXBvnfqAGM9NXdY2NO0Fy1mz47bdNeH_pP58k7-ozA_FfiDllT3rBAygtCOdZAAk_Q330V_euoTkYcggEGngScUlNmQK6KRN4FQJ611HTPdmrQ_XOwQCXOM2SB2advjNt47RsOeN9brHByHSmo8X-Gp5tw2MROCkvHa_-asdBTx4Th0hYwLkQb8qGlbrLgKkDHucF8m6NGNX_83w_FJHl0senKAoD5GdotaKravPhaNitnBr0yt9c25csfcF2lwvWaq4bW4sBe3rcBnJTuMWNwZsDoL5fb3CkcV29jd1GdiP7f2oZPOtjw6p4KLW6aKser1U4VxDqsgRDVaBXh0pBLGS75jDO_E_dt3HsvHV-VMJWzu5DZWF6jRa8PFAoYraMgcxXthPq1Xf6k4FaSDcXDUMRb9eOfF_MdKhS8miH7yIEfRqPqarbw_43zZ_ilK2aOCx0zaWWOlT2mCCrkH6TJD6pdnpxfMduq1UTko2zvQqgKhQi3MMnqVOSLl7Xpd-CjXC7GAge5cDCTxT5c2PclVYxy23du2X1ZAj0NurCdpXkUCQdSEt7YCp_nQgMK-1EA1wFJMbDrWIRoW-KyRrjqQuJ_e6OD0cqigqhSbJ5PeZx462hlnLYsfNIdq2ogVdFagqzoQWXDucMW6mTwsSs0jdgEoPZmX4Yb9oQPZtBMEbqvJJNV4ZX1l7OwASINTclo8Zm4iNoGdNuy1DAK85g1uaCrxkOBAHiTfbbwTKkc4ZcGVazS7vjCpr2XGCrtQahMAUAgypf7pwJtKYxQL_bOQyA_C8gHq5CcqErDG2cyhk7YZMVRfCc50ana7MAc7x9VWL2pTPdvmtzi2G3w5eiwlKxqeYiX5dtuMKlkzjR6l7-w0wQQOXoTKhsdUAZg2PjysxQHrSuNuLTAROCK8v-Lm8fc3Y02RqoDDKKYQ87wZsG9SOIH_X2g9G99VEh-DaQVuDPDwfMbOTYIOYTP4nkp3S58zhO1fkOjWCTJKziQz3F-buXy9tO5RegxoJ3aVk

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3275 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BixZxiTLBYKLoL-qNjuwPl8O-iA0AAAAAOAHgBAI&bg=!-vml-b3NAAY6sG-_OrA7ACkAdvg8WlP5ozQ9dh7XwQyT7Ez1beu9YCCuvPOk1FVrMIsD4t3L0NF6AAIAAAC1UgAAAAxoAQeZAwMyelK2cSMKKHVfK1c0XlouiTGba3FKiJwcgCNwhR_m-LpBdUndeMXzyD3ZE9GBkYnFZl0zwc1FFnWAPeCTr0AgejvYZiocwoSa0mVLstDdJGW0h3Fwm4qrfNOgcx5She_gykeekwr_p7IkvHh01cQ-8gdy_RZoKKc4bTR2Fi9rutxgwj5FzNQ9h0qdSTqEqhnNUiKgetAXeN28koUdDqwJ3Ula5UfYK6iLzc93UWce9jz0CdMREwte-YoW9G_oUIeaHuPKs8aatQMM5FQ_U6POVOc_MogFEQ0Mjc0u2NrwFZMSjgcuCEYnUCWxoeTY2oqOqRn21bxcT046zKBNjI-b_ckGIZwwice21wIrWuHJ9G4i8HyPvRz1fdb52gpU9TcVmJkgWH2jFOHTMYerz4UYcr1Mv6CQJtTYxi-agBGGRzwgDSJFGtamiQ9QOIsQk8CQlXyF20e7Dj2lmUfBYtaqlqrjef5nMfx4iWOHLCzO_r2aA27ULSmguXCcaHpM1s0lJSQnd6oVbJ3am7gCNV4H6_wmXO0eU38yWLpD6NcfQcVwC935Mv9gAIbKb9xOAuTcpMzUUOQmMA4Hwsb4oMui8n07dn5S7BF5jPkJkxufizyFSdfB63y99UMTgBAzXkx-HbkcVHKF13X690xPrJ3RTtCJEafBvKkmphnDys-dY5QmsqAiP8r75esgJnPohrGVCOK9pmKD6wOdw0X3v5Dyb3lXVR45yQ8Mm5g-KuB8vq6_LA2XMHK1Z_YhhltGwgW9LRvwLTLHzNA0SX1l_Q4xo6aD7MYlPmFHdHOp-V05PyuwgvWGDMEh8A6HfewGEpcuwy9mlMZZwsSixj_Wz7d2hg8PuXtjpa7pRPzi1MajTlO-NDFwYrxyEihaHdIUCekgE94m9mmfJLQmdCOO65xAUIAtuMPN6xJJTLaFo4ZsmsFemqL5XCHx2p9nEJOP7S3Vyf6uxDr499U7934CWpeIq3Ynic-tnBPWF-epuUEgRB1Br6ktCPPexFdbXC3rK0jUeqU

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 77B2 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BMcGNiTLBYIiRMJHt3wPEn5HoBwAAAAA4AeAEAg&bg=!YWKlYibNAAY6sG-_OrA7ACkAdvg8Wlo0UMmtDeMHf1SN0lrvzFegyLvsJf114Sb33pcsUiPXyigAjAIAAADPUgAAAAxoAQcKAJjm73IDqBhUGUSJW6wYJ3nTncO-03vb0M-PeBm0VtDAad_VpE1pK4WxlPE1yHzXGJ4SvkwD1C5OaCyzWxL-YJ1ovxzCo3piqBPxz83CtXZqtS3niaAai2dMrRd1sFxmmqCVSOoValEUbSSwmIHkv1cUr8JjT2sPj16otYdG1wNSs2yQPmx9-4Tncqn7Hw5mXL0M2al39p8OnZkC9n1VvdjlWzNzN5_gmTYp2XZVMweyQRfmnW4f-okPLaidV81GVUmx3nShAyB0cEWsoVC2UFDB3bWMhcYzoiNPWurrrfXOiCatx9K_pDvylwZF7G1tXzAUdYiiI34Oc5H0ihuodBmesb8cI4oGpLKsd4mkcar4qLjzEHQdDDNLVSb2MYZQHvB6a98CS9mEkf5niUgus3uvhvZqwwrsB6XUr0gd5UEwJ-T9QU3ScrizECVbqMwZzGwWuymRJEGLccOYzRQB7tQS9vZWRJj03vk_8MsurYxS0o7Yb7krU4xBRkXmsjt7fxZ1yTVT-Moq1p6GieP3C9rtmI1nCgPBjycNeh_IWOJTKuuAG_5ltbWOXmvtzMKRqF7Sh_odi8HOVw4b0P7k6e9X7YBsc87mNMC8tSXvo_EZjHJN5ZQ8glbMzHzyoTNvM-Mld8x4jW_QdzBU6347bQq9rQVVpjkXZXa0ooV7t-c3EKbJloDkHFjyPBmAp0v5oD0IvUcd_YaJBlAf5kGETOb4IYV7PoYTC1EK99Cw2_SpHH-5srTTGFCGZ_Jbrv3_SdJPeKe8NPWocCSdFGID_pVP0uM0an5e2FdeXTsk8ShA5svjZ6IRdunF6Otase0hZZUN3BhtBWC-Epmbq3sR5v7PFL21T1MukQ7q_pWR-oj8Im9e0Bi0-hnuINyz6Tj6zr83vVboYfc_FDMW6BUv1vg2yYmgW1Ef4GZj74IdGtyrRn3ExwkcZbm5rqWUa0W_mK0X9hrCJPRo5OBzbwsdLC6RTc962GkwvLR-UxNgCd49MhvHMCo9pkOxXOfUJQhjgK8fDr1PQANAt2Uhylc72N6e5vhcFiFp4ZwfWG8yRvBhrXuGQPrUMET6vBTKJ-gC8aXgBJpiH5C1SF4EXZ4EfAUJiB_OBn4nlpe9rCbEK5pOvUJEn1n61idv8U8A2gSIlC8wyF1GOCVGzTAOltMKPs66oTHjvUEZGa0nqNw96XCUPTPivMzgIvlbaewN0tcXNzfG

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 15D0 42 B
64 B 48ms
47ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstb63zxPV_PSNBlx1oaJ_yNOMwcgXQBdMBBmuLgG_ep7To4I-so97Rod_8LKSE4Z_yrbfje0CeKLbmC6QlbDC1cTzmOGdUWPR6d-FwBdb-Bzwwgru6QKKoiU70PNg&sai=AMfl-YT7OVuBe0MjjLQSfZ7nrPcePjqEvMuYiRAkrgRAOoNXq8-YD0AZ0KsR9hevbpPei_-u2EjPdm2BNWwWI1DOijSYT0iVOylQPsn4ZpTr4CsD0do3lWHydA5vyWsCzIxd&sig=Cg0ArKJSzMduHP2NOpX9EAE&cid=CAASFeRoId6P63Bqho2pji2sCB2aCXaZrw&id=lidar2&mcvt=1000&p=574,315,828,615&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210607&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=4042975291&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623274121585&dlt=146&rpt=52&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6185 42 B
64 B 41ms
40ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstQlkniRZ5EotU2A5j86PXsd-GozLo9VqASaaaUmHgseZTNKRb5ljMX0wYAfajHEgjXgPuWA6J5YzqgoGcLYZpACw26YtUcNcLuQdS2FXpES_BD_xkVVFa7YVPpew&sai=AMfl-YRCdWPvZWAulhfaCox83XQ5JwDvk36zJ09gsSOFD_1-3XmnO0SEFVmcW9BEYzhgpDUYJb9XnYlHkidrjk_kaBfln84Om9gpm7blUlqgv1v1sq6uwJawxVHQ_mvuK_Ar&sig=Cg0ArKJSzNjgkt1vGO0AEAE&cid=CAASFeRo1MyVkqAr9Wn5zdt4uWEu2ZhSFw&id=lidar2&mcvt=1000&p=70,315,164,1043&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210607&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=1432691387&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623274121583&dlt=182&rpt=56&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 worker.nude.js Show response
st.prntscr.com/2021/04/08/1538/js/ 3 KB
1 KB 19ms
19ms XHR
application/javascript 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/04/08/1538/js/worker.nude.js
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/04/08/1538/js/script.mix.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 21:28:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 08 Apr 2021 15:39:30 GMT
server: cloudflare
age: 287
etag: W/"606f23b2-ad9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://prnt.sc
cache-control: max-age=1800
cf-ray: 65cd7384bb3416e6-FRA
cf-request-id: 0a944686f7000016e6668d4000000001
expires: Wed, 09 Jun 2021 21:37:24 GMT

GET
BLOB 200
OK 0d4e3937-df4b-4849-ad0b-c8d66d10442c
https://prnt.sc/ 3 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prnt.sc/0d4e3937-df4b-4849-ad0b-c8d66d10442c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 2777
Content-Type: text/javascript

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 74FE 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuSPRUtIA8HRd-tWANqqfbPr8vpXp4nQ8qFKbJh4UTDO1qrgkghef7XydN9Aw-g3bbUesHzDxRrQKQUAGhb3mh2eKu6THZdfHbeC35fiAvUPU6gtIzsTkQvMnjq9A&sai=AMfl-YQQ97e2AtyEfSswluyU671ug7dGUA9E878ySPUZOFndnb71v5HNgBAHZgQuE0X5N26jlRmxKAgyu2id0zgnWxpg2PsbEoPzkNA_vuYe-I_gcFdZm0CpnZYgrZ7fLsdb&sig=Cg0ArKJSzCoPeuYtnzcoEAE&cid=CAASFeRomlsOAsnWdNZ1BJRvs9r2IWETQA&id=lidar2&mcvt=1000&p=452,315,546,1043&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210607&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=3120184932&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623274121585&dlt=173&rpt=48&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Jun 2021 21:28:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

118 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.prnt.sc/	1970-01-19 18:54:34	Name: _gat Value: 1
.prnt.sc/	1970-01-19 18:56:00	Name: _gid Value: GA1.2.844240275.1623274120
.prnt.sc/	1970-01-20 12:25:46	Name: _ga Value: GA1.2.126720193.1623274120

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc(Line 1) Message: TypeError: Cannot read property 'getItem' of null
console-api	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/mN8-gFiYmm3.js?_nc_x=Ij3Wp8lg5Kz(Line 56) Message: ErrorUtils caught an error: Minified invariant #11797; Params: 113 [Caught in: Module "VisibilityListener"] Subsequent non-fatal errors won't be logged; see https://fburl.com/debugjs.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.ad4game.com
adservice.google.com
adservice.google.de
api.prntscr.com
c.amazon-adsystem.com
cdn.ad4game.com
cm.g.doubleclick.net
connect.facebook.net
dsum-sec.casalemedia.com
e3cd590020318c851740bc3a9c33472e.safeframe.googlesyndication.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
htlb.casalemedia.com
ib.adnxs.com
image.prntscr.com
pagead2.googlesyndication.com
pixel.quantcount.com
platform.twitter.com
prnt.sc
quantcast.mgr.consensu.org
rules.quantcount.com
s0.2mdn.net
scontent-frx5-2.xx.fbcdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
st.prntscr.com
static.xx.fbcdn.net
stats.g.doubleclick.net
syndication.twitter.com
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
104.23.139.12
104.23.140.12
104.244.42.8
104.26.14.80
142.250.184.194
142.250.185.226
142.250.185.66
151.139.242.3
185.33.221.15
192.207.255.147
2.18.234.21
2.21.111.28
2600:9000:2156:c400:6:44e3:f8c0:93a1
2600:9000:218c:2200:9:46dc:4700:93a1
2606:2800:234:59:254c:406:2366:268c
2620:116:800d:21:5a23:9c4e:e774:96c1
2a00:1450:4001:802::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2001
2a00:1450:4001:811::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:813::200e
2a00:1450:4001:827::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2006
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2004
2a00:1450:400c:c0a::9d
2a00:1450:400d:807::2001
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
52.222.200.121
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0abf5e86ccd194d29086dda85c658093039d7bda4693dcd1816bc04cc665ecb3
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bebecc4adf8ecf2f1a6707df64bca412aa19a6d00ff65ac3d41e2d6f7fd643f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
161d6a8c4bd0ecd29d2265fcc4c94184a0c0429630b1f086c00fdb1902a9c380
1b185d89e437f1591af8c51d5e6dad41d3666e22a81931ee9df22e2cfdacaddb
1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d
2875a6fc4266fec00a383377cb4530b6407912897b0727e26249d89c6dfe0359
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2ddef05ee7b0caa6fd9be281a5b4e53ada42bff7814578d748144f2f9181e476
2f07cb9b5036cb531b6b8176176ce85b8ae2b5ef0f7db5d79e7fb8ab57492423
2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec
3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820
40ec0b04019845302a5052b4689b5d3477c9717dca73243e5faf7cf98f3af564
42230c47b07c6d451bf857c1e7345816f07a1d18071e416ea3d326449f28f08a
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45b8a13dcb32541a7703dec7eba4c4195cb62ed00029c2ea5a0b61fd16864b55
46f0c473d1873986d918bdade9e2d111a927db126eeeec135fe2b0dd5e0a91ee
483cc9a5ece5c92d5a2f1ea6e92e7f8bc29844a6c06bf36c0349d70334685dc7
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
56766cebd19e526d59965412d4744818753abe2b9030407f0580eeaf029fff33
5a3a63b2ac124cb9a194ec01ea1f0d3123e4019bf658c6f47a77b4faea84c079
5b6f3806c04b7c91d2ee5cf8f42b31343a9d33ea62ad9d0506cfa1be078477d3
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3
641e03dfeee60c05e0794bace5fc58d2fba409fee529a114459e44cee0d9d069
67d89433ac978f10ff5ca9d5fb1a6bba002ebce9911fa0f9617a20f0a4480984
6b26263e492d4334076354b0db27917b73fdf99ca6f24ecb267ddca57a40138b
70ca5be517c20d93b39fd9558c0e2d98db50ea5cbb106766e92766a93793bb32
733f44e4d42f00e0a8c267d516e9f6939d36f65ceb3bf851998475b9f6650d3f
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7b67ae2416a166f4238581097d4ce984a69d9662aab12ecc4b2b881c45164e36
7f0c0d5e15ee4b3a06964f2256fc37be30934a62b0e0bf61a00eb0aa47969eb6
83817752fb260ff66b3bca1471bb20dbb6a1e6a17174c657efe0912ad161b382
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86a1b8f94f48c4e82d2616d4c581f10a34ff447a2bd95be08714fa0d19ba3f51
8a19707bd88a29100f84e106852ddd5bfeebe1fe562960c4932d1347210d13a1
8bfd2fa3b3b5924e3655bcf9f63427e792bd8572b7ed0992373bdb4b21c7cb89
8e2bd46c24371461d74e358678ce7946839bae86e11e0764d4886db0e9ee7bf5
908edfa9f7ec9fd5cb6b2159b5cb305d9c2c88601c8bf00a23bb0e96fcea1e21
93023edbec0bce9f3849ffcb8fd327757cf9992249495d63e43c2762e7cf1f3a
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
9b2841a0d5f25743e4ce77138f152bbb986e6f9b6d5801a89c2586ffd5bab8c3
9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964
9c9935e1daafc929a9866a206e769e084cd83f19d436ca22887adc2798408646
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a093d2047e1a59b7103810b947780e5f94d865915cb923ebcaa7e50f557c2102
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19
a451bdd9ee2c9a779de9e9a85ab2e646ae64e70b04d20c0d9cb364e20e89d1c0
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a599b2c9cf9de65a5e5f072dec412cc5b8857a66434317d1ab4252efeba38a48
a61668b6f1708e0fb28eb83c5335a444f68d2df5edd65c7a1694acbcdb45eb98
a63d4516a26000f63b58959048d5710741fcb791c077974c08115cb66beefea5
a72e1dbb08d86df0dc420ae5213c7a64f45901c84a7c09eecd462910db67a0c4
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ada6f258fe717047a5cf0799e877326641e3a8a63421159e7315c3e3d95c6e58
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af7379a0dfcaf397fb0f515f97c9e6139b570235f96ddeaf5581a02012fa937b
b0a4b0023829c273fa1b16d7c24f9e5a9d235cf0b33b5a064bf1ee0e110e9db2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3408a1b744ce1351e9554b861c45480f39e54c059f3b11f4e77f9f13564ba4f
b65bfbe401fe0ec72a7776a594a60c4234813227abf4710cf65b700c8ecc9001
b6a1120cc303b1c6ee6d548a5b418c2707b59de0c1f13c8ab870ca4e734b6acc
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bca2c1abcf4b76a46306bc7f1a607a459371ccf5e7213aae988c33b4dabb1758
bec12a29f78481199a046b8a7f8f6163d1b3c72f39bfa8ed7f9b25722ff208a0
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6
c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916
cabbde8502a6598896a3c812c89ecd99ecfb3e9ca68f632c8c9b3f2a7f6e0046
cb09c3720b53d8651d6f5825cf643e6249aefbe82a1ba1417d230cdb9b36cba6
d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5
d79d9c1b00fde236a4c9ed8bba65588d6c088b9cc2d57f9f68985d77ce1b283e
d91d13fd8f9d253a8213aeee7ebaa7e073683fc600a3d82902c3c669b8ffdee7
dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
e05edf2ae58e3a9f1d2a84d32a8b216fd0aece46f527b58dcbce75255989ea88
e117f7080decd87848dbb35b256f19c52b7a428edb492d33819af723bc0c1744
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e926f30958d0c21d088e6a671d3356a3c3fab9cc6220b8e408f19d868a7dc5c8
ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f238dd6e2eb271ea73d65954bda15ae86ed39caeb69c39ee03b8966002df23c6
f3e6f9853dadc16ce421073bbe0405ded4563b19495ae0a5e8e0fa764ed8a94e
f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729
fe0b009af4d6be99bb24436d2b2c67706fa3698e059d8df3bfa9f9c8857b42ae

prnt.sc Open in urlscan Pro 104.26.14.80 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

140 Requests

99 %HTTPS

63 %IPv6

20 Domains

35 Subdomains

36 IPs

5 Countries

1494 kBTransfer

3942 kBSize

3 Cookies

12 Outgoing links

Page URL History

Redirected requests

140 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

prnt.sc Open in urlscan Pro
104.26.14.80 Public Scan

Screenshot
Live screenshot

Full Image

140
Requests

99 %
HTTPS

63 %
IPv6

20
Domains

35
Subdomains

36
IPs

5
Countries

1494 kB
Transfer

3942 kB
Size

3
Cookies

140 HTTP transactions
5 data transactions