lfmzzinoaalrihihcirihdf.bitly.ws Open in urlscan Pro
185.11.100.204 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lfmzzinoaalrihihcirihdf.bitly.ws/
Submission: On December 04 via api (December 4th 2023, 1:58:08 pm UTC) from US — Scanned from US

Summary HTTP 129 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 21 IPs in 2 countries across 14 domains to perform 129 HTTP transactions. The main IP is 185.11.100.204, located in Poland and belongs to CF-KRK, PL. The main domain is lfmzzinoaalrihihcirihdf.bitly.ws.
TLS certificate: Issued by R3 on June 28th 2023. Valid for: 3 months.

This is the only time lfmzzinoaalrihihcirihdf.bitly.ws was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	185.11.100.204 185.11.100.204	29522 (CF-KRK) (CF-KRK)
10	2607:f8b0:400... 2607:f8b0:4006:80a::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:809::2008	15169 (GOOGLE) (GOOGLE)
17	2607:f8b0:400... 2607:f8b0:4006:81d::200e	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:822::200a	15169 (GOOGLE) (GOOGLE)
1	192.229.210.155 192.229.210.155	15133 (EDGECAST) (EDGECAST)
3	2607:f8b0:400... 2607:f8b0:4006:806::2003	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:4006:81e::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::178	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4006:81d::2001	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80b::2002	15169 (GOOGLE) (GOOGLE)
2	2620:100:a001... 2620:100:a001::24	19750 (AS-CRITEO) (AS-CRITEO)
2	2620:100:a001::3 2620:100:a001::3	19750 (AS-CRITEO) (AS-CRITEO)
16	2620:100:a001::4 2620:100:a001::4	19750 (AS-CRITEO) (AS-CRITEO)
2	74.119.119.147 74.119.119.147	19750 (AS-CRITEO) (AS-CRITEO)
2	2600:9000:251... 2600:9000:2514:3800:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
41	2620:100:a001::9 2620:100:a001::9	19750 (AS-CRITEO) (AS-CRITEO)
4	2620:100:a001... 2620:100:a001::16	19750 (AS-CRITEO) (AS-CRITEO)
1	2607:f8b0:400... 2607:f8b0:4006:81e::2004	15169 (GOOGLE) (GOOGLE)
129	21

8 185.11.100.204 (Poland)

ASN29522 (CF-KRK, PL)
PTR: v5103.vps.ogicom.net

lfmzzinoaalrihihcirihdf.bitly.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bitly.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:80a::2002 (United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2607:f8b0:4006:81d::200e (United States)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:822::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.210.155 (United States)

ASN15133 (EDGECAST, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:806::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:81e::2002 (United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:81d::2001 (United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80b::2002 (United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:100:a001::24 (United States)

ASN19750 (AS-CRITEO, US)

ads.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:100:a001::3 (United States)

ASN19750 (AS-CRITEO, US)

rtb.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.119.119.147 (United States)

ASN19750 (AS-CRITEO, US)

cat.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2514:3800:19:fc2c:a140:93a1 (United States)

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2620:100:a001::9 (United States)

ASN19750 (AS-CRITEO, US)

imageproxy.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:100:a001::16 (United States)

ASN19750 (AS-CRITEO, US)

csm.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
61	criteo.net static.criteo.net — Cisco Umbrella Rank: 631 imageproxy.us.criteo.net — Cisco Umbrella Rank: 2739 csm.us.criteo.net — Cisco Umbrella Rank: 2825	385 KB
18	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1404 www.google.com — Cisco Umbrella Rank: 2	130 KB
17	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 148	322 KB
8	bitly.ws lfmzzinoaalrihihcirihdf.bitly.ws bitly.ws — Cisco Umbrella Rank: 163545	27 KB
6	criteo.com ads.us.criteo.com — Cisco Umbrella Rank: 2708 rtb.va.us.criteo.com — Cisco Umbrella Rank: 6039 cat.va.us.criteo.com — Cisco Umbrella Rank: 2896	120 KB
6	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	42 KB
3	gstatic.com fonts.gstatic.com	48 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	10 KB
2	agkn.com d.agkn.com — Cisco Umbrella Rank: 686	1 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	128 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	257 B
1	paypalobjects.com www.paypalobjects.com — Cisco Umbrella Rank: 1965	441 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	78 KB
129	14

	Domain	Requested by
41	imageproxy.us.criteo.net	ads.us.criteo.com
17	fundingchoicesmessages.google.com	lfmzzinoaalrihihcirihdf.bitly.ws pagead2.googlesyndication.com
16	static.criteo.net	ads.us.criteo.com
10	pagead2.googlesyndication.com	lfmzzinoaalrihihcirihdf.bitly.ws pagead2.googlesyndication.com www.googletagservices.com tpc.googlesyndication.com
7	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
6	lfmzzinoaalrihihcirihdf.bitly.ws	lfmzzinoaalrihihcirihdf.bitly.ws
4	csm.us.criteo.net	ads.us.criteo.com
3	fonts.gstatic.com	fonts.googleapis.com
2	cdnjs.cloudflare.com	ads.us.criteo.com
2	d.agkn.com	ads.us.criteo.com
2	cat.va.us.criteo.com	ads.us.criteo.com
2	rtb.va.us.criteo.com	googleads.g.doubleclick.net
2	ads.us.criteo.com	googleads.g.doubleclick.net
2	www.googletagservices.com	googleads.g.doubleclick.net
2	bitly.ws	lfmzzinoaalrihihcirihdf.bitly.ws
1	www.google.com	tpc.googlesyndication.com
1	www.google-analytics.com	www.googletagmanager.com
1	www.paypalobjects.com	lfmzzinoaalrihihcirihdf.bitly.ws
1	fonts.googleapis.com	lfmzzinoaalrihihcirihdf.bitly.ws
1	www.googletagmanager.com	lfmzzinoaalrihihcirihdf.bitly.ws
129	21

This site contains links to these domains. Also see Links.

Domain
bitly.ws
xy2.eu
tinyurl.mobi
www.buymeacoffee.com
buy.stripe.com

Subject Issuer	Validity	Valid
*.a24.domeny.pl R3	`2023-06-28` - `2023-09-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
bitly.ws R3	`2023-11-20` - `2024-02-18`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-10-12` - `2024-10-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-10` - `2024-02-03`	3 months	crt.sh
*.va.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-25` - `2024-02-22`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-09` - `2024-01-06`	3 months	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2023-09-07` - `2024-09-29`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.us.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-16` - `2024-01-18`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Frame ID: 4BD1BB40A387EAE2A33F0861B9043ADD
Requests: 39 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/zrt_lookup_fy2021.html?hello=world
Frame ID: 7116CDBA0A844C1829AE2AFC1BB9521B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-2614556310778759&output=html&adk=1812271804&adf=3025194257&lmt=1701698283&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701698282895&bpp=5&bdt=412&idt=246&shv=r20231129&mjsv=m202311290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2796881521954&frm=20&pv=2&ga_vid=1330316537.1701698283&ga_sid=1701698283&ga_hid=1767977781&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079438%2C31079714%2C31079931%2C44809003%2C31078297%2C31079889%2C44807405%2C31079716%2C44807764%2C44808148%2C44808284%2C44809071&oid=2&pvsid=301346477646608&tmod=403691523&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=282
Frame ID: 2C33DF9F24F80D533F2F24769602B1B5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=3788724914&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1701698283&rafmt=11&format=1200x200&url=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701698282901&bpp=2&bdt=418&idt=292&shv=r20231129&mjsv=m202311290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2796881521954&frm=20&pv=1&ga_vid=1330316537.1701698283&ga_sid=1701698283&ga_hid=1767977781&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=298&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079438%2C31079714%2C31079931%2C44809003%2C31078297%2C31079889%2C44807405%2C31079716%2C44807764%2C44808148%2C44808284%2C44809071&oid=2&pvsid=301346477646608&tmod=403691523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=312
Frame ID: F764F217BFFC69B35A26823B36AF2A1B
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Frame ID: CAD1B3F5362FF6B5D2E25690D4430476
Requests: 8 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wADrwIE0bdBAAY0_UuHixluL4YwXoASLg&u=%7CiPZIL3BuF6AzpNNR8IaQ5tsVo5gr3rXpTLO%2BBGEpiEo%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwUAZx_wwNywyFxol_YC0vQ6mD6nSjMbrJ8BS8suZXeg3CojqqR3vFJdVm6B9h4RjNQm6zu4aP9WJ3KK2Y8CWA-3_4OiuOqXPoyUs0_kR0K2nf7-rupuZO-nM7Wrgb6WQeNgHjogrgDZOr3pjrFlmh6-04o44h_-m-19nWNMiFNhaDCGXVAj7SFzpCwXWQ8JGl-Le5paZXpg1uPubDa4xSSWLiDbZYB3Dv5_N--CjhViMLgdlxC6PeByzm6cXkDO2lLiPmkImN7ATMcR6e1vvBn_hoz9G9cHsETPbZIp4tSCy5_lTOk71AerMsctmAMN1LUpKz5SRH-adIEptbAe6I4eRcgBZ6hx1OAH607v7VHCyKTaDeHNpx-e9SqvjWkJeJ0snobhm02Le53ox-hbK_TqyXPR8Hmvl4qcdwvnFTlAepU5RdPjeX4LQ6YbKb7hBg-m75CHdMjrfu-FmtfBpZO4b0rdb0j3Zfjbx8SXv1O5YLLb4CoobdSin9cR61HnHvZVsdhZ_Ck0uS5U2Be9mbEwvXx-y3wwCr&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPzWh69ptZYLeDsHuxtYP_emY8Aycge-wXKqbqap0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0KsqfiBZwdAbl6MscZicutY_Tuy0sbH2_q7n_jnKbHuzNjP5mRNxNJPtLhtUkzBP_c5jHJSLLBGbsvQOkUsB1KFu1nhArdUSZ9hsXvznqGJBfDdDX8skrmaGJWZhy6kVIZNmKQG-cZCg652ZfeiA2A4hbE_31iNwR-5KTs6d4EbShCnJp-aZVC_Gpxh3h3svYwSwFmQg13A_8jcIsOQHHi3DhuArju8PAFwz3BQxqwCoVCM_gy1zqetU1ed4Ud29lXZJXGpHTNG3jVgBgdoxtlUzm8TKz8nHPfhWJh5wCP4eCUkFOS4DcTB11068TRZcsKWbZS5lF-dQr_JA82OABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WOvFv4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_28PKhue9yfmFi3oVPB-UmdnaVjcw%26client%3Dca-pub-2614556310778759%26adurl%3D
Frame ID: E5E3D9038F45514BAE3B12727E70EA89
Requests: 36 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wAGwp8Bd4IQAAtLBe8mw-FvrtBRooc3EA&u=%7CiPZIL3BuF6Aw5rQlTxBaLe5eiRghdhatJ%2BH3H39RA1Y%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwJ4Wtw8h-JM7xiZ_K83mKC2ZzhjpUsCdJdf-ZfCaSl_kDioKXEKPll2URtBsuRhB4uV98sAKq1A5qSOWJuLrherOK8Z-8g0ySAlgTN4IKbye00TXS7SEfDzKyDWKTXnCv4qB07toqaPSMeMGe45kGnxQGFQIQ5cEZJWmjQ0S9rMwACHVvVme-oNeJLwEVHOwXcV_Wc6uY061Fb0u86n_QjV0b9wuUag0P4HvyCUbVbs9Ka08GajY0PKorb5KuxpEXn-LuhIRpdDfDIdjKeUiA5zjt9hqhbdsYFsx7d1GPwWVapui_UGqn4omhxhKaiiKVaEcnF5Ae4Gfx5kxgmA0TGj4-yy9liWkgn-Gi8n8nYDp4MT5RIAACWDHqAwxJcV33rtqvooazNMKcmrZBDplZ9uV-lH3x1SXcV_94hFcsVsNSwhsE--FBZ9cohzUO2HOSAerFy-0OdLkCCAlf2t_cmL-_MbniJ1PNmH9LMm5k4UNxfLFrEl3mrqLVpY3RoZjcc9HvNPvNndBgpq8Be1WJeFSTh6MQFX-5&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC6Mo169ptZZ-FG5CE3rsPhZat4Aycge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0JaDxxB2xqwEKC55EPIOUvgbPlgIeeeC1C5i_COulYkafNSeIUMsbWemd-2HDnT2P_xNKASgYHtAwXz435_8YH_c7LTxF_NGwAJqyZC3b2dMnNez8k3yufU16lffJjHCI4tyQcu7LjcIyKK7AcySFtP3NGsC0GSg5O8cEELkj0M6zDa6SzA1qfXpcQKkXNDxXPozcroWJm7tJYPF_0PLaO9B6IMjDIO_bVs_Dapc93_ZOj0D8dZdw0_cvDxaw41q3E5h5y25arCNY14iLhPetq76pbcoBdexmfuuOGL8Y6Cyyo7TIOf7H0bMLkVhJTbdruvSzFytZp-AZwYPLwmABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WKH2y4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2JalWWsFH0sBp4qdofpKP-DRt41w%26client%3Dca-pub-2614556310778759%26adurl%3D
Frame ID: 2001EFC9EBA16E8B3CCF7F31C6CE646B
Requests: 33 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: B374C7D0B380A55649FF98E9A08B362E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: AC92AC311ADDC9BFDEE5BA35AF946E32
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bitly | URL Shortener

Detected technologies

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

<input[^>]+_s-xclick
paypalobjects\.com

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

129
Requests

95 %
HTTPS

85 %
IPv6

14
Domains

21
Subdomains

21
IPs

2
Countries

1292 kB
Transfer

2934 kB
Size

8
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://bitly.ws/
Title: Bitly.ws

Search URL Search Domain Scan URL

URL: https://xy2.eu/
Title: XY2

Search URL Search Domain Scan URL

URL: https://tinyurl.mobi/
Title: TinyURL

Search URL Search Domain Scan URL

URL: https://www.buymeacoffee.com/oconnel

Search URL Search Domain Scan URL

URL: https://buy.stripe.com/eVa8z88iQeWTaEUeUU

Search URL Search Domain Scan URL

URL: http://bitly.ws/G2uy
Title: The Ultimate Creator's Toolkit

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

129 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
lfmzzinoaalrihihcirihdf.bitly.ws/ 12 KB
5 KB 1708ms
174ms Document
text/html 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to

Full URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache / PHP/5.5.38
Resource Hash: 29e8077f4d3f30e78282ff2aad3176087f8a3f1060ab2997a73a33521ff80cfa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0
content-encoding: gzip
content-type: text/html
date: Mon, 04 Dec 2023 13:58:02 GMT
expires: Mon, 04 Dec 2023 13:58:02 GMT
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/5.5.38

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 240ms
100ms Script
text/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e6059b10b60eef67b577e139d7593b0a095556dbfd15af64c96e565b3d26af3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51702
x-xss-protection: 0
server: cafe
etag: 15129951502751721498
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 13:58:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 217 KB
78 KB 232ms
89ms Script
application/javascript 2607:f8b0:4006:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8Q1W6PKNCX

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d53440555f5a57ae8fd01e5212f5f89c8f9a43ed054b1f565cfa55790756886e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79111
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 13:58:02 GMT

GET
H2 200 pub-2614556310778759 Show response
fundingchoicesmessages.google.com/i/ 176 KB
59 KB 254ms
111ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/pub-2614556310778759?ers=1

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6bfc0e322d8733f7c4cf4918d0226b57e67ee1bf724f9ea084c31a49971dc68

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-n4B0Kud67cxMC6CO0OCfqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
content-security-policy: script-src 'report-sample' 'nonce-n4B0Kud67cxMC6CO0OCfqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 style.css
lfmzzinoaalrihihcirihdf.bitly.ws/css/ 10 KB
3 KB 197ms
195ms Stylesheet
text/css 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to

Full URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/css/style.css
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 151bc681e41dd21a559a36d4afe28b98b0da1bdc67ca599b5fc8e0bf983b9012

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
content-encoding: gzip
last-modified: Sat, 19 Aug 2023 16:03:04 GMT
server: Apache
etag: "29dd-60348c7c43e1e-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=0
accept-ranges: bytes
content-length: 2500
expires: Mon, 04 Dec 2023 13:58:02 GMT

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 223ms
81ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Courgette%7CAcme%7CMontserrat&subset=latin-ext

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ddccc3b074d270f15bb7619ad6324f0c4e7b2576747bb20851a8a709c62d15d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Dec 2023 13:58:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 13:50:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Dec 2023 13:58:02 GMT

GET
H2 200 adframe.js Show response
lfmzzinoaalrihihcirihdf.bitly.ws/js/ 16 B
211 B 195ms
194ms Script
application/javascript 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to

Full URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/js/adframe.js
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 0059cb4ff0a271382c38af8a7367aaf45cbeb31449637d3928d25317401e2828

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
last-modified: Sat, 30 Dec 2017 21:02:30 GMT
server: Apache
etag: "10-5619511402320"
content-type: application/javascript
cache-control: max-age=0
accept-ranges: bytes
content-length: 16
expires: Mon, 04 Dec 2023 13:58:02 GMT

GET
H2 200 paypal.jpg
bitly.ws/gfx/ 9 KB
9 KB 516ms
169ms Image
image/jpeg 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/paypal.jpg
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 1ae6619173f92af4f0201b7204322213c714b56df437aa7d6482a1c141d5337c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
last-modified: Tue, 02 Jan 2018 13:00:56 GMT
server: Apache
etag: "2204-561cab086d14b"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8708
expires: Tue, 03 Dec 2024 13:58:02 GMT

GET
H2 200 paypal.png
bitly.ws/gfx/ 5 KB
6 KB 681ms
334ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bitly.ws/gfx/paypal.png
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 675f6b6dc673aae01f8ef949697ee544c8df8574ca090a4dd690776ec6e442ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
last-modified: Tue, 02 Jan 2018 13:00:54 GMT
server: Apache
etag: "158c-561cab06562ce"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5516
expires: Tue, 03 Dec 2024 13:58:02 GMT

GET
H2 200 pixel.gif
www.paypalobjects.com/pl_PL/i/scr/ 43 B
441 B 141ms
35ms Image
image/gif 192.229.210.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/pl_PL/i/scr/pixel.gif

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.210.155 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (mic/9B64) /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-cache: HIT
paypal-debug-id: 3ddeb05243326
dc: ccg11-origin-www-1.paypal.com
content-length: 43
last-modified: Fri, 16 Aug 2019 04:57:41 GMT
server: ECAcc (mic/9B64)
traceparent: 00-00000000000000000003ddeb05243326-c0390848ad1539d2-01
etag: "5d5637c5-2b"
content-type: image/gif
cache-control: s-maxage=31536000, public,max-age=3600
accept-ranges: bytes
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
expires: Mon, 04 Dec 2023 14:58:02 GMT

GET
H2 200 bmac.png
lfmzzinoaalrihihcirihdf.bitly.ws/gfx/ 3 KB
3 KB 176ms
174ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/gfx/bmac.png
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: 54339f1c8cb089c05773b2b18fd5da6e702956decbf7dea6ef0348a64203c657

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
last-modified: Sat, 19 Aug 2023 15:45:47 GMT
server: Apache
etag: "c86-6034889f203e4"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 3206
expires: Tue, 03 Dec 2024 13:58:02 GMT

GET
H2 200 stripe.png
lfmzzinoaalrihihcirihdf.bitly.ws/gfx/ 1 KB
2 KB 175ms
173ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/gfx/stripe.png
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: b8214bd5cbd9197f329d1df98d908dc7a1cd38c28e8010b92e49b3f35dd9986a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
last-modified: Sat, 19 Aug 2023 15:45:50 GMT
server: Apache
etag: "54f-603488a24201d"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1359
expires: Tue, 03 Dec 2024 13:58:02 GMT

GET
H2 200 bitly-chart.png
lfmzzinoaalrihihcirihdf.bitly.ws/gfx/ 210 B
400 B 173ms
172ms Image
image/png 185.11.100.204
CF-KRK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/gfx/bitly-chart.png
Requested by: Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.11.100.204 , Poland, ASN29522 (CF-KRK, PL),
Reverse DNS: v5103.vps.ogicom.net
Software: Apache /
Resource Hash: c28530634cdfc14bb5c068fc74a7071f9e27fc97f9aa03a1258f5b33f9c8ab6d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
last-modified: Tue, 02 Jan 2018 13:00:56 GMT
server: Apache
etag: "d2-561cab088ec59"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 210
expires: Tue, 03 Dec 2024 13:58:02 GMT

GET
H2 200 wEO_EBrAnc9BLjLQAUk1VvoK.woff2
fonts.gstatic.com/s/courgette/v17/ 24 KB
25 KB 223ms
82ms Font
font/woff2 2607:f8b0:4006:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/courgette/v17/wEO_EBrAnc9BLjLQAUk1VvoK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Courgette%7CAcme%7CMontserrat&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

405773c896e1955562d347744121c4bdfb078188d311b13fcb6471444d191400

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 21:49:17 GMT
x-content-type-options: nosniff
age: 58125
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24964
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 17:58:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 02 Dec 2024 21:49:17 GMT

GET
H2 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v26/ 15 KB
15 KB 206ms
66ms Font
font/woff2 2607:f8b0:4006:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Courgette%7CAcme%7CMontserrat&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b5816bbfc52587979139951355fe4048da02ce60e40cef8e4a1efb6cd396281

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 21:48:37 GMT
x-content-type-options: nosniff
age: 58165
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14940
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:46:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 02 Dec 2024 21:48:37 GMT

GET
H2 200 RrQfboBx-C5_XxrBbg.woff2
fonts.gstatic.com/s/acme/v25/ 8 KB
8 KB 292ms
152ms Font
font/woff2 2607:f8b0:4006:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/acme/v25/RrQfboBx-C5_XxrBbg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Courgette%7CAcme%7CMontserrat&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb814ac86e7f409154ced702b9f3543761d09410e837ec728242e6b980a26aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 11:05:09 GMT
x-content-type-options: nosniff
age: 355973
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8236
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 21:26:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Nov 2024 11:05:09 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/ 398 KB
134 KB 120ms
119ms Script
text/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b413106c06a231fbdf3a1ee9afd6ddcd910ef9e060f4dd3ab3801edd27734b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137481
x-xss-protection: 0
server: cafe
etag: 9590601886966756231
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 13:58:02 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/ Frame 7116 9 KB
4 KB 209ms
68ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/zrt_lookup_fy2021.html?hello=world

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1042
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 13:40:41 GMT
etag: 12051592065903069241
expires: Mon, 18 Dec 2023 13:40:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxVnBafD1VCxKyJ9UOQwKk3plSWKIr0jLuSnXeIG-C2XNc2et466XYaBjO1ejtranBtfNl0A2MrqnbAzG2NX9pIJIT0gmW-I2gG_6pd1JR5TnZTR1YXTk2ONRZIXhB88PsvHmXqzkw== Show response
fundingchoicesmessages.google.com/f/ 13 KB
7 KB 122ms
121ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVnBafD1VCxKyJ9UOQwKk3plSWKIr0jLuSnXeIG-C2XNc2et466XYaBjO1ejtranBtfNl0A2MrqnbAzG2NX9pIJIT0gmW-I2gG_6pd1JR5TnZTR1YXTk2ONRZIXhB88PsvHmXqzkw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxNjk4MjgyLDk5OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9sZm16emlub2FhbHJpaGloY2lyaWhkZi5iaXRseS53cy8iLG51bGwsW1s4LCJGYVlQdVJ3ZXFJSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/am=CAM/d=1/rs=AJlcJMwtXJqxLeKc2R0IUIFp1d5liGKRSg/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

70486b7f0fb39b876d97c4b360ee5cc2a8e36d0e653635826e8983a0137fef95

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-LtFo7i9FKRSjgLnFtBmeRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:03 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-LtFo7i9FKRSjgLnFtBmeRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
257 B 151ms
59ms Ping
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-8Q1W6PKNCX&gtm=45je3bt0v9119634474&_p=1701698282510&gcd=11l1l1l1l1&dma=0&tcfd=10000&cid=1330316537.1701698283&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701698283&sct=1&seg=0&dl=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&dt=Bitly%20%7C%20URL%20Shortener&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2255
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8Q1W6PKNCX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2C33 55 KB
19 KB 280ms
279ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-2614556310778759&output=html&adk=1812271804&adf=3025194257&lmt=1701698283&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701698282895&bpp=5&bdt=412&idt=246&shv=r20231129&mjsv=m202311290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2796881521954&frm=20&pv=2&ga_vid=1330316537.1701698283&ga_sid=1701698283&ga_hid=1767977781&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079438%2C31079714%2C31079931%2C44809003%2C31078297%2C31079889%2C44807405%2C31079716%2C44807764%2C44808148%2C44808284%2C44809071&oid=2&pvsid=301346477646608&tmod=403691523&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=282

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c809d8792cb030b237397ef632d0672aac5bafeb34484602179af8ae4c7af13c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 18802
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 13:58:03 GMT
expires: Mon, 04 Dec 2023 13:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F764 36 KB
14 KB 495ms
494ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=3788724914&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1701698283&rafmt=11&format=1200x200&url=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701698282901&bpp=2&bdt=418&idt=292&shv=r20231129&mjsv=m202311290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2796881521954&frm=20&pv=1&ga_vid=1330316537.1701698283&ga_sid=1701698283&ga_hid=1767977781&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=298&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079438%2C31079714%2C31079931%2C44809003%2C31078297%2C31079889%2C44807405%2C31079716%2C44807764%2C44808148%2C44808284%2C44809071&oid=2&pvsid=301346477646608&tmod=403691523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=312

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3586fca89188da4178601f6c88760e954f8ea116975b544a8dd8a151186a7dc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 14725
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 13:58:03 GMT
expires: Mon, 04 Dec 2023 13:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/ 160 KB
55 KB 105ms
104ms Script
text/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/reactive_library_fy2021.js?bust=31079889

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fa040857c91f4e10435a8f45290116b565b34e19fddaba6d734bdde764437f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55918
x-xss-protection: 0
server: cafe
etag: 12225296448441067228
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 13:58:03 GMT

GET
H3 200 ca-pub-2614556310778759 Show response
fundingchoicesmessages.google.com/i/ 176 KB
58 KB 117ms
117ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-2614556310778759?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9d6d07efe151e2bacc48701ce439fdfc85f3b07ea6997e22ebf15f5b096b9fff

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-LZ2e-_KcVZRXyDDvDg5eqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:03 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-LZ2e-_KcVZRXyDDvDg5eqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/ Frame CAD1 9 KB
4 KB 68ms
67ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 6902
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 12:03:01 GMT
etag: 12051592065903069241
expires: Mon, 18 Dec 2023 12:03:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame F764 3 KB
1 KB 276ms
83ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=3788724914&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1701698283&rafmt=11&format=1200x200&url=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701698282901&bpp=2&bdt=418&idt=292&shv=r20231129&mjsv=m202311290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2796881521954&frm=20&pv=1&ga_vid=1330316537.1701698283&ga_sid=1701698283&ga_hid=1767977781&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=298&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079438%2C31079714%2C31079931%2C44809003%2C31078297%2C31079889%2C44807405%2C31079716%2C44807764%2C44808148%2C44808284%2C44809071&oid=2&pvsid=301346477646608&tmod=403691523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=312

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 13:55:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame F764 20 KB
9 KB 257ms
65ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 20:01:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64577
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 20:01:47 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F764 202 KB
64 KB 289ms
97ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 13:58:04 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame E5E3 220 KB
61 KB 347ms
171ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wADrwIE0bdBAAY0_UuHixluL4YwXoASLg&u=%7CiPZIL3BuF6AzpNNR8IaQ5tsVo5gr3rXpTLO%2BBGEpiEo%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwUAZx_wwNywyFxol_YC0vQ6mD6nSjMbrJ8BS8suZXeg3CojqqR3vFJdVm6B9h4RjNQm6zu4aP9WJ3KK2Y8CWA-3_4OiuOqXPoyUs0_kR0K2nf7-rupuZO-nM7Wrgb6WQeNgHjogrgDZOr3pjrFlmh6-04o44h_-m-19nWNMiFNhaDCGXVAj7SFzpCwXWQ8JGl-Le5paZXpg1uPubDa4xSSWLiDbZYB3Dv5_N--CjhViMLgdlxC6PeByzm6cXkDO2lLiPmkImN7ATMcR6e1vvBn_hoz9G9cHsETPbZIp4tSCy5_lTOk71AerMsctmAMN1LUpKz5SRH-adIEptbAe6I4eRcgBZ6hx1OAH607v7VHCyKTaDeHNpx-e9SqvjWkJeJ0snobhm02Le53ox-hbK_TqyXPR8Hmvl4qcdwvnFTlAepU5RdPjeX4LQ6YbKb7hBg-m75CHdMjrfu-FmtfBpZO4b0rdb0j3Zfjbx8SXv1O5YLLb4CoobdSin9cR61HnHvZVsdhZ_Ck0uS5U2Be9mbEwvXx-y3wwCr&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPzWh69ptZYLeDsHuxtYP_emY8Aycge-wXKqbqap0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0KsqfiBZwdAbl6MscZicutY_Tuy0sbH2_q7n_jnKbHuzNjP5mRNxNJPtLhtUkzBP_c5jHJSLLBGbsvQOkUsB1KFu1nhArdUSZ9hsXvznqGJBfDdDX8skrmaGJWZhy6kVIZNmKQG-cZCg652ZfeiA2A4hbE_31iNwR-5KTs6d4EbShCnJp-aZVC_Gpxh3h3svYwSwFmQg13A_8jcIsOQHHi3DhuArju8PAFwz3BQxqwCoVCM_gy1zqetU1ed4Ud29lXZJXGpHTNG3jVgBgdoxtlUzm8TKz8nHPfhWJh5wCP4eCUkFOS4DcTB11068TRZcsKWbZS5lF-dQr_JA82OABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WOvFv4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_28PKhue9yfmFi3oVPB-UmdnaVjcw%26client%3Dca-pub-2614556310778759%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4ba34277f565882a20857704ea829b9a10b84162e2f6143ca91c62932c3e00af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 13:58:03 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=sq7CgLRu3moSEQPxx6R4ExlZNCiAaxHQvoUmI0myAUQV5yKvkBuupPkD4VB-48hEdPqwj_tRa-XolAg_hd9w3QUz-QNrwY3wpPx6jRM6w42kPkbxvO1WlJBz6D4KUaYI5oX9OB_KaPxn-w9BzzTR_mAI2Ii9sPBm9IIcGXNzn1N5dNfFh7_C9lY2FSpDSuOAacuEatv3N2BNLrhbVz-Jwlq1stFh57y8g-yWsUGkeOuiSmAvMFrkkHusj_qwQjBN-Z2HlQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 86185141
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame CAD1 3 KB
1 KB 264ms
87ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 13:55:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame CAD1 20 KB
8 KB 250ms
73ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 20:01:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64577
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Dec 2023 20:01:47 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame CAD1 202 KB
64 KB 364ms
189ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 13:58:04 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 2001 201 KB
58 KB 443ms
281ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wAGwp8Bd4IQAAtLBe8mw-FvrtBRooc3EA&u=%7CiPZIL3BuF6Aw5rQlTxBaLe5eiRghdhatJ%2BH3H39RA1Y%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwJ4Wtw8h-JM7xiZ_K83mKC2ZzhjpUsCdJdf-ZfCaSl_kDioKXEKPll2URtBsuRhB4uV98sAKq1A5qSOWJuLrherOK8Z-8g0ySAlgTN4IKbye00TXS7SEfDzKyDWKTXnCv4qB07toqaPSMeMGe45kGnxQGFQIQ5cEZJWmjQ0S9rMwACHVvVme-oNeJLwEVHOwXcV_Wc6uY061Fb0u86n_QjV0b9wuUag0P4HvyCUbVbs9Ka08GajY0PKorb5KuxpEXn-LuhIRpdDfDIdjKeUiA5zjt9hqhbdsYFsx7d1GPwWVapui_UGqn4omhxhKaiiKVaEcnF5Ae4Gfx5kxgmA0TGj4-yy9liWkgn-Gi8n8nYDp4MT5RIAACWDHqAwxJcV33rtqvooazNMKcmrZBDplZ9uV-lH3x1SXcV_94hFcsVsNSwhsE--FBZ9cohzUO2HOSAerFy-0OdLkCCAlf2t_cmL-_MbniJ1PNmH9LMm5k4UNxfLFrEl3mrqLVpY3RoZjcc9HvNPvNndBgpq8Be1WJeFSTh6MQFX-5&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC6Mo169ptZZ-FG5CE3rsPhZat4Aycge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0JaDxxB2xqwEKC55EPIOUvgbPlgIeeeC1C5i_COulYkafNSeIUMsbWemd-2HDnT2P_xNKASgYHtAwXz435_8YH_c7LTxF_NGwAJqyZC3b2dMnNez8k3yufU16lffJjHCI4tyQcu7LjcIyKK7AcySFtP3NGsC0GSg5O8cEELkj0M6zDa6SzA1qfXpcQKkXNDxXPozcroWJm7tJYPF_0PLaO9B6IMjDIO_bVs_Dapc93_ZOj0D8dZdw0_cvDxaw41q3E5h5y25arCNY14iLhPetq76pbcoBdexmfuuOGL8Y6Cyyo7TIOf7H0bMLkVhJTbdruvSzFytZp-AZwYPLwmABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WKH2y4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2JalWWsFH0sBp4qdofpKP-DRt41w%26client%3Dca-pub-2614556310778759%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2580a164a3ea2bb5274b9e8d0ae3919bd9d7f7e1fea287084085bdaddd28dea4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 13:58:04 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=JyDE-rRu3moSEQPxFHopnMpzbatn3jhVU4ctVoYdJ29mhhQHSLp6FSyltNJD7d_cE6BKtv3I9aZ3M39WXUwV3YXNlAFy2DFBPM4JNtVZ99dS1UPytQ_ExG4ugqkqYx0i4gpxt60s4ZXoCTREpwHJYK00sRqJETnIYi4HADoEYyTG5u4SpqqtDX-SLrPBSSmmqKwezOYV8rWRm_kxBG-CAgno75fE8Dt2nH-z0yWjCHNF6k3dIQjTLPCpqMozD02Zfe9ayA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 98904819
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 131ms
129ms Image
image/gif 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=3.169851952469286

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-nTqZCHZOQD1GL0zB53LEWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-nTqZCHZOQD1GL0zB53LEWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 131ms
130ms Image
image/gif 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=4.332517625485526

Requested by

Host: lfmzzinoaalrihihcirihdf.bitly.ws
URL: https://lfmzzinoaalrihihcirihdf.bitly.ws/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-TWk_hwYJjHKdNEP5Ecr8uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-TWk_hwYJjHKdNEP5Ecr8uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 224ms
89ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-D-9isM21ubZ8TcE6yxEvWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-security-policy: script-src 'report-sample' 'nonce-D-9isM21ubZ8TcE6yxEvWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame F764 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 971a4d977108d8571fca1e34696bb58532799a6858d7a7b0397d04f1f93158a9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CAD1 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e06d26767a716202b94be18a21376f4f29c7511420982d61ee36fbe7af474e16

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame F764 0
23 B 109ms
108ms Image
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CaErH69ptZZ-FG5CE3rsPhZat4Aycge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_AFP0JaDxxB2xqwEKC55EPIOUvgbPlgIeeeC1C5i_COulYkafNSeIUMsbWemd-2HDnT2P_xNKASgYHtAwXz435_8YH_c7LTxF_NGwAJqyZC3b2dMnNez8k3yufU16lffJjHCI4tyQcu7LjcIyKK7AcySFtP3NGsC0GSg5O8cEELkj0M6zDa6SzA1qfXpcQKkXNDxXPozcroWJm7tJYPF_0PLaO9B6IMjDIO_bVs_Dapc93_ZOj0D8dZdw0_cvDxaw41q3E5h5y25arCNY14iLhPetq76pbcoBZWzuWlohYmG6kuNHgLqx0NKEG7FAF2lvsWnJyJs0nC151sUXuGABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WKH2y4349YIDgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTI2MTQ1NTYzMTA3Nzg3NTkYAA&sigh=MHkPRk-0aR4&uach_m=%5BUACH%5D&cid=CAQSTgDICaaNe1A_YGAGO1-LHjwCJ1CDD8XYRBvsSI02xcTwG4hacECUptVFrHpO2RYaUHzjdN2cYwCHFznEbCcH5A9GsU4fGdVGcBXGGUockBgB&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&client=ca-pub-2614556310778759&output=html&h=200&slotname=1428154055&adk=624732521&adf=3788724914&pi=t.ma~as.1428154055&w=1200&fwrn=4&lmt=1701698283&rafmt=11&format=1200x200&url=https%3A%2F%2Flfmzzinoaalrihihcirihdf.bitly.ws%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701698282901&bpp=2&bdt=418&idt=292&shv=r20231129&mjsv=m202311290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2796881521954&frm=20&pv=1&ga_vid=1330316537.1701698283&ga_sid=1701698283&ga_hid=1767977781&ga_fc=1&rplot=4&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=298&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079438%2C31079714%2C31079931%2C44809003%2C31078297%2C31079889%2C44807405%2C31079716%2C44807764%2C44808148%2C44808284%2C44809071&oid=2&pvsid=301346477646608&tmod=403691523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=312
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 04 Dec 2023 13:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 13:58:04 GMT

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame F764 0
125 B 251ms
59ms Image
text/plain 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kNjlFc36RLAJyAHiIp0XAgAAAI76l97vjlJMEOvabWUYKz6A3afrll1DAAASAAAKCkFRVUJDZ0VCQ2c&wp=ZW3a6wAGwp8Bd4IQAAtLBe8mw-FvrtBRooc3EA&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:03 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 296580
server: Kestrel
content-length: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame CAD1 0
23 B 106ms
105ms Image
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CT7Tg69ptZYLeDsHuxtYP_emY8Aycge-wXKqbqap0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_AFP0KsqfiBZwdAbl6MscZicutY_Tuy0sbH2_q7n_jnKbHuzNjP5mRNxNJPtLhtUkzBP_c5jHJSLLBGbsvQOkUsB1KFu1nhArdUSZ9hsXvznqGJBfDdDX8skrmaGJWZhy6kVIZNmKQG-cZCg652ZfeiA2A4hbE_31iNwR-5KTs6d4EbShCnJp-aZVC_Gpxh3h3svYwSwFmQg13A_8jcIsOQHHi3DhuArju8PAFwz3BQxqwCoVCM_gy1zqetU1ed4Ud29lXZJXGpHTNG3jVgBgdoxtlUzm8TKz4vFHWqQm_UKgRUh3cU83oqyfhh8-VZ41uUmOWwlewJ9liPElhWABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WOvFv4349YIDgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTI2MTQ1NTYzMTA3Nzg3NTkYAA&sigh=uth-pN6OEGQ&uach_m=%5BUACH%5D&cid=CAQSTgDICaaNDypO6YAfsdKud4b66IhyyDHSJSpT36Y9U87XSDzF8I_2NdG-tOiW-WgG9nnnikXB0jsr8bym7z8g5o_iB3iMU6OqkOnxeaklJhgB&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 04 Dec 2023 13:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 13:58:04 GMT

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame CAD1 0
126 B 245ms
58ms Image
text/plain 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kNjlFc36RO0HfOIinRcCAAAAstJslB9sMSIQ6tptZUlzG0me80l_1NsAABIAAAoKQVFVQkNnRUJDZw&wp=ZW3a6wADrwIE0bdBAAY0_UuHixluL4YwXoASLg&cbvp=2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 295210
server: Kestrel
content-length: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame E5E3 2 KB
1 KB 186ms
62ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wADrwIE0bdBAAY0_UuHixluL4YwXoASLg&u=%7CiPZIL3BuF6AzpNNR8IaQ5tsVo5gr3rXpTLO%2BBGEpiEo%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwUAZx_wwNywyFxol_YC0vQ6mD6nSjMbrJ8BS8suZXeg3CojqqR3vFJdVm6B9h4RjNQm6zu4aP9WJ3KK2Y8CWA-3_4OiuOqXPoyUs0_kR0K2nf7-rupuZO-nM7Wrgb6WQeNgHjogrgDZOr3pjrFlmh6-04o44h_-m-19nWNMiFNhaDCGXVAj7SFzpCwXWQ8JGl-Le5paZXpg1uPubDa4xSSWLiDbZYB3Dv5_N--CjhViMLgdlxC6PeByzm6cXkDO2lLiPmkImN7ATMcR6e1vvBn_hoz9G9cHsETPbZIp4tSCy5_lTOk71AerMsctmAMN1LUpKz5SRH-adIEptbAe6I4eRcgBZ6hx1OAH607v7VHCyKTaDeHNpx-e9SqvjWkJeJ0snobhm02Le53ox-hbK_TqyXPR8Hmvl4qcdwvnFTlAepU5RdPjeX4LQ6YbKb7hBg-m75CHdMjrfu-FmtfBpZO4b0rdb0j3Zfjbx8SXv1O5YLLb4CoobdSin9cR61HnHvZVsdhZ_Ck0uS5U2Be9mbEwvXx-y3wwCr&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPzWh69ptZYLeDsHuxtYP_emY8Aycge-wXKqbqap0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0KsqfiBZwdAbl6MscZicutY_Tuy0sbH2_q7n_jnKbHuzNjP5mRNxNJPtLhtUkzBP_c5jHJSLLBGbsvQOkUsB1KFu1nhArdUSZ9hsXvznqGJBfDdDX8skrmaGJWZhy6kVIZNmKQG-cZCg652ZfeiA2A4hbE_31iNwR-5KTs6d4EbShCnJp-aZVC_Gpxh3h3svYwSwFmQg13A_8jcIsOQHHi3DhuArju8PAFwz3BQxqwCoVCM_gy1zqetU1ed4Ud29lXZJXGpHTNG3jVgBgdoxtlUzm8TKz8nHPfhWJh5wCP4eCUkFOS4DcTB11068TRZcsKWbZS5lF-dQr_JA82OABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WOvFv4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_28PKhue9yfmFi3oVPB-UmdnaVjcw%26client%3Dca-pub-2614556310778759%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame E5E3 2 KB
1 KB 189ms
66ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame E5E3 308 B
636 B 216ms
112ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame E5E3 293 B
621 B 165ms
60ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame E5E3 43 B
348 B 367ms
63ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=jFQ7o034nCef8iB0SKb84O6eLh9BVQitKM9KPF_LTgVUDcm7vmqQg8PcYRsloeuqfKKBqih7OBuAIr6vYJqIKGUZQEMjcM8oRO3MI75W36e73lVHDaSo2HR_u1ugFC-Rr9Vj7q-Wf3v-1vu9DwDoDY4xtFIz1Q_UVCmP5mXdOiGFU2zc9S8sGg55lV0OiyYVr0tKvOyq_KLCIOYJhRdO_-zIrDe5Negk3LHLOPMHeCSp_O6NUYzjDEzWCc8qhNW3vjFaRFNPcxsboDPnw_BiNOkGd0cs1qHaa3IrL4p53inV0TzrYjDTE3AuJYdCYxiCCkk_n0H7bTKpgHBRPx9rzEmAqODKV8G8m2wuil_VXT6mB2x7pKCjrwYTQOCWAJ6Jl47i_RYGW5497fW7BkarRumCqY2yWrAWvi94fqS58G1hwAyW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2272961
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 /
d.agkn.com/pixel/8538/ Frame E5E3 43 B
564 B 250ms
74ms Image
image/gif 2600:9000:2514:3800:19:fc2c:a140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/8538/?che=656ddaec32412a378092f3c0f80b0411&col=357080,0,0,0,11280071,656ddaec32412a378092f3c0f80b0411
Requested by: Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wADrwIE0bdBAAY0_UuHixluL4YwXoASLg&u=%7CiPZIL3BuF6AzpNNR8IaQ5tsVo5gr3rXpTLO%2BBGEpiEo%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwUAZx_wwNywyFxol_YC0vQ6mD6nSjMbrJ8BS8suZXeg3CojqqR3vFJdVm6B9h4RjNQm6zu4aP9WJ3KK2Y8CWA-3_4OiuOqXPoyUs0_kR0K2nf7-rupuZO-nM7Wrgb6WQeNgHjogrgDZOr3pjrFlmh6-04o44h_-m-19nWNMiFNhaDCGXVAj7SFzpCwXWQ8JGl-Le5paZXpg1uPubDa4xSSWLiDbZYB3Dv5_N--CjhViMLgdlxC6PeByzm6cXkDO2lLiPmkImN7ATMcR6e1vvBn_hoz9G9cHsETPbZIp4tSCy5_lTOk71AerMsctmAMN1LUpKz5SRH-adIEptbAe6I4eRcgBZ6hx1OAH607v7VHCyKTaDeHNpx-e9SqvjWkJeJ0snobhm02Le53ox-hbK_TqyXPR8Hmvl4qcdwvnFTlAepU5RdPjeX4LQ6YbKb7hBg-m75CHdMjrfu-FmtfBpZO4b0rdb0j3Zfjbx8SXv1O5YLLb4CoobdSin9cR61HnHvZVsdhZ_Ck0uS5U2Be9mbEwvXx-y3wwCr&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCPzWh69ptZYLeDsHuxtYP_emY8Aycge-wXKqbqap0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0KsqfiBZwdAbl6MscZicutY_Tuy0sbH2_q7n_jnKbHuzNjP5mRNxNJPtLhtUkzBP_c5jHJSLLBGbsvQOkUsB1KFu1nhArdUSZ9hsXvznqGJBfDdDX8skrmaGJWZhy6kVIZNmKQG-cZCg652ZfeiA2A4hbE_31iNwR-5KTs6d4EbShCnJp-aZVC_Gpxh3h3svYwSwFmQg13A_8jcIsOQHHi3DhuArju8PAFwz3BQxqwCoVCM_gy1zqetU1ed4Ud29lXZJXGpHTNG3jVgBgdoxtlUzm8TKz8nHPfhWJh5wCP4eCUkFOS4DcTB11068TRZcsKWbZS5lF-dQr_JA82OABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WOvFv4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_28PKhue9yfmFi3oVPB-UmdnaVjcw%26client%3Dca-pub-2614556310778759%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:3800:19:fc2c:a140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:04 GMT
via: 1.1 368bc8b1f5073a6f7cdb40029e9a5a88.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P8
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: image/gif
cache-control: no-cache, must-revalidate
content-length: 43
x-amz-cf-id: ofp66-m_c6A1ERef3OsgDM5OKNTvvQO_r28oVhUYt6zSvrtYc3lP2g==
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 2001 2 KB
1 KB 169ms
64ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wAGwp8Bd4IQAAtLBe8mw-FvrtBRooc3EA&u=%7CiPZIL3BuF6Aw5rQlTxBaLe5eiRghdhatJ%2BH3H39RA1Y%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwJ4Wtw8h-JM7xiZ_K83mKC2ZzhjpUsCdJdf-ZfCaSl_kDioKXEKPll2URtBsuRhB4uV98sAKq1A5qSOWJuLrherOK8Z-8g0ySAlgTN4IKbye00TXS7SEfDzKyDWKTXnCv4qB07toqaPSMeMGe45kGnxQGFQIQ5cEZJWmjQ0S9rMwACHVvVme-oNeJLwEVHOwXcV_Wc6uY061Fb0u86n_QjV0b9wuUag0P4HvyCUbVbs9Ka08GajY0PKorb5KuxpEXn-LuhIRpdDfDIdjKeUiA5zjt9hqhbdsYFsx7d1GPwWVapui_UGqn4omhxhKaiiKVaEcnF5Ae4Gfx5kxgmA0TGj4-yy9liWkgn-Gi8n8nYDp4MT5RIAACWDHqAwxJcV33rtqvooazNMKcmrZBDplZ9uV-lH3x1SXcV_94hFcsVsNSwhsE--FBZ9cohzUO2HOSAerFy-0OdLkCCAlf2t_cmL-_MbniJ1PNmH9LMm5k4UNxfLFrEl3mrqLVpY3RoZjcc9HvNPvNndBgpq8Be1WJeFSTh6MQFX-5&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC6Mo169ptZZ-FG5CE3rsPhZat4Aycge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0JaDxxB2xqwEKC55EPIOUvgbPlgIeeeC1C5i_COulYkafNSeIUMsbWemd-2HDnT2P_xNKASgYHtAwXz435_8YH_c7LTxF_NGwAJqyZC3b2dMnNez8k3yufU16lffJjHCI4tyQcu7LjcIyKK7AcySFtP3NGsC0GSg5O8cEELkj0M6zDa6SzA1qfXpcQKkXNDxXPozcroWJm7tJYPF_0PLaO9B6IMjDIO_bVs_Dapc93_ZOj0D8dZdw0_cvDxaw41q3E5h5y25arCNY14iLhPetq76pbcoBdexmfuuOGL8Y6Cyyo7TIOf7H0bMLkVhJTbdruvSzFytZp-AZwYPLwmABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WKH2y4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2JalWWsFH0sBp4qdofpKP-DRt41w%26client%3Dca-pub-2614556310778759%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 2001 2 KB
1 KB 166ms
61ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 2001 308 B
636 B 118ms
65ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 2001 293 B
622 B 112ms
59ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 28 Nov 2024 13:58:04 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 2001 43 B
347 B 317ms
64ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=wiN43j_HOd5KbAj_gxYNzOudXv-rnBgxGiw_Xkq4G-jV_v62rsfYw69VqO2hrK_X_pbPPSjhbtgpSvAAf7fW-eb8AY_T57_hSEPkJUMsCOOZ1UYim7wvJfIRI2ItglZPo74Qo20XgZfxnbTFWsAqHSiC8IEKb1Lz8m-YFcpZJJ_WojXnGDAWcdQKtRXcadEFVSzz4KRcqQ2lv5ADhqU0-x2zDAX5JDit9ClWcpWTsG83dfjtU_iHuYl6Ck4Yi-aWce11CSmJdpzAWj-nEAyTEOXArQUttiPsh18fw-0fC44Q3d2OZqVH2au0F1IAhCaMUQFKeirRYvU7LLyss0EJgZBTx1LoTByh0K5Hjk-MhI1V2Ni_aHreT6fg--kHzmuPHTXjb-gznXyvKWi2lX8OB6txJuZbb50FFuW1hVPG5Uc3blVh

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2383318
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 /
d.agkn.com/pixel/8538/ Frame 2001 43 B
563 B 201ms
76ms Image
image/gif 2600:9000:2514:3800:19:fc2c:a140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/8538/?che=656ddaeb9c8477d94aa16f8f1c860fd5&col=357080,0,0,0,11280071,656ddaeb9c8477d94aa16f8f1c860fd5
Requested by: Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZW3a6wAGwp8Bd4IQAAtLBe8mw-FvrtBRooc3EA&u=%7CiPZIL3BuF6Aw5rQlTxBaLe5eiRghdhatJ%2BH3H39RA1Y%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92EhkIL8TEvdwJ4Wtw8h-JM7xiZ_K83mKC2ZzhjpUsCdJdf-ZfCaSl_kDioKXEKPll2URtBsuRhB4uV98sAKq1A5qSOWJuLrherOK8Z-8g0ySAlgTN4IKbye00TXS7SEfDzKyDWKTXnCv4qB07toqaPSMeMGe45kGnxQGFQIQ5cEZJWmjQ0S9rMwACHVvVme-oNeJLwEVHOwXcV_Wc6uY061Fb0u86n_QjV0b9wuUag0P4HvyCUbVbs9Ka08GajY0PKorb5KuxpEXn-LuhIRpdDfDIdjKeUiA5zjt9hqhbdsYFsx7d1GPwWVapui_UGqn4omhxhKaiiKVaEcnF5Ae4Gfx5kxgmA0TGj4-yy9liWkgn-Gi8n8nYDp4MT5RIAACWDHqAwxJcV33rtqvooazNMKcmrZBDplZ9uV-lH3x1SXcV_94hFcsVsNSwhsE--FBZ9cohzUO2HOSAerFy-0OdLkCCAlf2t_cmL-_MbniJ1PNmH9LMm5k4UNxfLFrEl3mrqLVpY3RoZjcc9HvNPvNndBgpq8Be1WJeFSTh6MQFX-5&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC6Mo169ptZZ-FG5CE3rsPhZat4Aycge-wXKLKp6p0wI23ARABIABgyYaAgNyjxBCCARdjYS1wdWItMjYxNDU1NjMxMDc3ODc1OcgBCagDAcgDAqoE_wFP0JaDxxB2xqwEKC55EPIOUvgbPlgIeeeC1C5i_COulYkafNSeIUMsbWemd-2HDnT2P_xNKASgYHtAwXz435_8YH_c7LTxF_NGwAJqyZC3b2dMnNez8k3yufU16lffJjHCI4tyQcu7LjcIyKK7AcySFtP3NGsC0GSg5O8cEELkj0M6zDa6SzA1qfXpcQKkXNDxXPozcroWJm7tJYPF_0PLaO9B6IMjDIO_bVs_Dapc93_ZOj0D8dZdw0_cvDxaw41q3E5h5y25arCNY14iLhPetq76pbcoBdexmfuuOGL8Y6Cyyo7TIOf7H0bMLkVhJTbdruvSzFytZp-AZwYPLwmABuSSvayj1ofLhAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggbCIBhEAEyAooCOgKAQEi9_cE6WKH2y4349YID-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2JalWWsFH0sBp4qdofpKP-DRt41w%26client%3Dca-pub-2614556310778759%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:3800:19:fc2c:a140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:04 GMT
via: 1.1 368bc8b1f5073a6f7cdb40029e9a5a88.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P8
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: image/gif
cache-control: no-cache, must-revalidate
content-length: 43
x-amz-cf-id: JQPNogs08TTNiD0lbfv3xov3kU-snyP1GiNu2hjMY7Ck9XODbfZxfA==
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame E5E3 12 KB
5 KB 115ms
41ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 452387
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YosZ6L7pxWouqlvcvki%2Bc6YDuQJqZKEKQU4dFVuqfJpmBWKFwg1P5stJhZSroVxq7mZIoUunicxtSPgrX%2Bhd6LrlejBpD8XdVVBC2iQHuy2c2GmLmnZXjZeK998ePIOTmJmmI2r9SFk85LqHR59vtdDo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83048fe8ed1031e0-MIA
expires: Sat, 23 Nov 2024 13:58:04 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame E5E3 12 KB
6 KB 219ms
128ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 95f88fc626f1432fa432382e4bfd47db_tradegothiclt-bold.woff
static.criteo.net/design/dt/ Frame E5E3 25 KB
26 KB 234ms
118ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/95f88fc626f1432fa432382e4bfd47db_tradegothiclt-bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

71fec08136db4f39744016e39725613faa040db5da9f01cbcdf3b1ef6e5000d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 05 Feb 2021 21:58:27 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"601dbf83-65e8"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 2001 12 KB
5 KB 62ms
39ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 452387
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0aLut0MO7q07hmFS391gbjkMPdgAfK3Vp04t3AWw0BoJF0dzcGsX05dLLG8TO10J%2FUaUPobf4RxhXlV8mLGoqiHPlXg%2Bw0gEVtz9Ev1jJH%2Bd%2BxUm%2Fg0I6rYtIRK80sHVcSK02m8P2w%2BNU%2BoCig0QKI8L"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83048fe8ed1331e0-MIA
expires: Sat, 23 Nov 2024 13:58:04 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 2001 12 KB
6 KB 162ms
123ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 25 KB
26 KB 279ms
134ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=244&m=0&partner=40380&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F40380%2F230519%2F793be53545db4ae08207020085cadf7f_script_logo_cta_v.png&v=3&w=464&rid=4&s=YsdbGmqWZAC_VA08lauBvtOQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

eeacb3f428d43ac8af675ad77b25e4b6ab508279cc838120e78063c101b4d252

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 25970
expires: Sat, 02 Nov 2024 02:53:46 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 2 KB
3 KB 316ms
171ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018440291_PINK_486x684.jpg&v=3&w=400&rid=4&s=-FSLmU-_G0pnMoBn1Npto_JM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

300bbc3f52956156726e308b0ff0efb62880e89720defd775a28e545bde4dcee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 2422
expires: Mon, 04 Dec 2023 15:27:24 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 5 KB
5 KB 212ms
68ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019482974_SILVER_486x684.jpg&v=3&w=400&rid=4&s=_JSRpEUGaQHCODM48JVFnY9q&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

be2c565807b990c64fad08f425f88a701a0a0a22f43b5d49d56dc2694f03023e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 5226
expires: Mon, 04 Dec 2023 18:29:32 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 2 KB
2 KB 343ms
199ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018528188_WHITE_486x684.jpg&v=3&w=400&rid=4&s=02LWT3-zgw8td0V5gV-s1Jxt&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

3f928b6bbb164f5ffd3f8d1c8b602c475f94b386684600baddc64b61d283c143

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 2152
expires: Mon, 04 Dec 2023 22:05:36 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 14 KB
14 KB 332ms
189ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019181872_GREENMULTI_486x684.jpg&v=3&w=400&rid=4&s=ecuH6GkOplopUH8eKR8FQQYp&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

af9dcb68a6bdf78dc61abe381f45b4d5956b1b534dba4c3c3e549f685d77dcfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 14186
expires: Mon, 04 Dec 2023 17:03:52 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 10 KB
10 KB 247ms
104ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018981229_NAVY_486x684.jpg&v=3&w=400&rid=4&s=wC1FvqvwaWPZ3mQr8MIKjeSZ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4fed2a7ad5032d740a816e8a4dd2d72c397612149d82d8d067efc85fb5635558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 10302
expires: Tue, 05 Dec 2023 02:43:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 9 KB
9 KB 191ms
175ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400014696370_BLACKGOLD_486x684.jpg&v=3&w=400&rid=4&s=ifsgZtCTlmOVL5fO0L4awAiV&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

bdf88373aa92b42b65b29ae03d742ff0c3eec910bb797173beb7400f2680a07e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 8974
expires: Mon, 04 Dec 2023 15:27:40 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 3 KB
4 KB 191ms
176ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019443633_MILKCHOCOLATE_486x684.jpg&v=3&w=400&rid=4&s=DLR2KjdHZKKLPUcl2Ka2liI-&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

407bb6f00a6f23035d94cdc93a8f187a5326c1d7b17f49000f1f26f85f18d22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 3420
expires: Mon, 04 Dec 2023 15:21:06 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 3 KB
3 KB 196ms
182ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018315957_INDIGOBUNTING_486x684.jpg&v=3&w=400&rid=4&s=HU61DrEHefrxx43E7BWcBQPs&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d801e92b871fa83c2b814cb197ae10152f654a0de64e969340e15086147640b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 3348
expires: Mon, 04 Dec 2023 15:30:17 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 2 KB
2 KB 210ms
196ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018546081_CAMEL_486x684.jpg&v=3&w=400&rid=4&s=QXIo7kuzqQD7nwNm5Y9YXFUq&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

9eed24cc91c3a01f46f87bdada069f07606ac0d9b896d98cc00f8d342d8f02b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 1582
expires: Mon, 04 Dec 2023 15:21:58 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 6 KB
6 KB 197ms
183ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018440362_YELLOWMULTI_486x684.jpg&v=3&w=400&rid=4&s=UXqVnW9ZV1Xz5SnO3GCd_ZFc&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

bb73bf5529e61703ddc5b2f0e50802f143083f4180dcd94f0e266b0c54936708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 6218
expires: Mon, 04 Dec 2023 15:26:23 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 17 KB
17 KB 228ms
213ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400017320514_TIDE_486x684.jpg&v=3&w=400&rid=4&s=pUw4ExHPT65uVrXsTN7DJ_My&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

90e205d053c93b709678fd3ed9a6e8d112acb52934c6827b76db515bcc6689d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 17038
expires: Mon, 04 Dec 2023 23:47:05 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 12 KB
12 KB 211ms
197ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018207858_BLACKCREAM_486x684.jpg&v=3&w=400&rid=4&s=3-7te2Nx89KiZKLiMrQRUFw8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f1d97bed3a1251b0c6f619f99e8d1bdb0d4822cf7376573bd87ec9540c115342

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 12520
expires: Mon, 04 Dec 2023 18:20:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 7 KB
7 KB 204ms
190ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400013899728_486x684.jpg&v=3&w=400&rid=4&s=GhSZ2s5OMjvAPgVV94y6Mh5a&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98a0d6bc9bf905ecf2ea8ee639808585ec323d14e3492618272d2f251fc3f551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 7180
expires: Mon, 04 Dec 2023 16:42:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 20 KB
20 KB 197ms
183ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018528921_GREENMULTICOLOR_486x684.jpg&v=3&w=400&rid=4&s=oLvIvLznftXuL5okgqDmR8eb&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e70673e126c7517f724afe8a0d530b91ca0b22781de5ca5f5eaccb731e3d62d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 20212
expires: Mon, 04 Dec 2023 15:39:59 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 6 KB
6 KB 223ms
209ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400014813430_HICKORY_486x684.jpg&v=3&w=400&rid=4&s=We8zVwfo7hbJHDChfPn3nRPR&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fd984bc852da856d92c3a84e61bb64ee2bf963aa74d034088fb7cf637f77aee2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 5644
expires: Mon, 04 Dec 2023 15:22:35 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 2 KB
2 KB 202ms
189ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019628802_GREEN_486x684.jpg&v=3&w=400&rid=4&s=XQVTc02XkiQDFvCuYlIWtiuS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

977a90da74cac486dbed34ec694c7e0a8613a960ee646805a311dc3a172e9433

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 2266
expires: Mon, 04 Dec 2023 15:21:10 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 5 KB
5 KB 203ms
189ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018723725_BLUE_486x684.jpg&v=3&w=400&rid=4&s=n7edkjmGr9Rnm5SRBhP-AWeA&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

362d1b7380751ef6405b308e4590c962a21e56ad597ad46b1fbd83e7bb34307e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 4674
expires: Mon, 04 Dec 2023 20:54:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 6 KB
7 KB 208ms
195ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018518914_BLACK_486x684.jpg&v=3&w=400&rid=4&s=jGT3c36wfTaxTKZ9EhBh8G_d&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

650ea0e3d40eb72966dc0b9aa1c934ee6c2fbb915b0dfca9016d7fa84fc1c8cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 6556
expires: Mon, 04 Dec 2023 19:40:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 10 KB
10 KB 214ms
200ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400017437086_GOLD_486x684.jpg&v=3&w=400&rid=4&s=boruPGOrpHJeNT77940aloNT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2dc23bb5e2c78a37a35ae6df3a3a7c656c9d6332b19639da09cf52c0e7944815

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 10206
expires: Mon, 04 Dec 2023 15:21:16 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 5 KB
5 KB 209ms
196ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019131571_IVORY_486x684.jpg&v=3&w=400&rid=4&s=cwqLXa8Cu-Aqxm1Kmf5TJeYG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a247ac8ed7bf7a65f89deb0a0065f14f4e7dd6703383bee45cafe75592159b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 4878
expires: Mon, 04 Dec 2023 16:17:13 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame E5E3 14 KB
14 KB 217ms
204ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018487794_MULTI_486x684.jpg&v=3&w=400&rid=4&s=rrUq4V9duDIlhanIfzl5z8a_&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0c2ff1b58d013b56b5a4e410c26c1e63861674405a8d5f29c058c3076d9dbf6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 14052
expires: Mon, 04 Dec 2023 17:45:42 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame E5E3 0
128 B 193ms
60ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=sq7CgLRu3moSEQPxx6R4ExlZNCiAaxHQvoUmI0myAUQV5yKvkBuupPkD4VB-48hEdPqwj_tRa-XolAg_hd9w3QUz-QNrwY3wpPx6jRM6w42kPkbxvO1WlJBz6D4KUaYI5oX9OB_KaPxn-w9BzzTR_mAI2Ii9sPBm9IIcGXNzn1N5dNfFh7_C9lY2FSpDSuOAacuEatv3N2BNLrhbVz-Jwlq1stFh57y8g-yWsUGkeOuiSmAvMFrkkHusj_qwQjBN-Z2HlQ&sds=2&rev=89278&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame E5E3 2 KB
1 KB 64ms
62ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame E5E3 2 KB
1 KB 62ms
60ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 95f88fc626f1432fa432382e4bfd47db_tradegothiclt-bold.woff
static.criteo.net/design/dt/ Frame 2001 25 KB
26 KB 114ms
113ms Font
application/octet-stream 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/95f88fc626f1432fa432382e4bfd47db_tradegothiclt-bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

71fec08136db4f39744016e39725613faa040db5da9f01cbcdf3b1ef6e5000d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
Origin: https://ads.us.criteo.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 05 Feb 2021 21:58:27 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"601dbf83-65e8"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 7 KB
7 KB 226ms
198ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98a0d6bc9bf905ecf2ea8ee639808585ec323d14e3492618272d2f251fc3f551

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 7180
expires: Mon, 04 Dec 2023 16:42:27 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 17 KB
17 KB 199ms
172ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

90e205d053c93b709678fd3ed9a6e8d112acb52934c6827b76db515bcc6689d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 17038
expires: Mon, 04 Dec 2023 23:47:05 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 9 KB
9 KB 227ms
201ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

bdf88373aa92b42b65b29ae03d742ff0c3eec910bb797173beb7400f2680a07e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 8974
expires: Mon, 04 Dec 2023 15:27:40 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 5 KB
5 KB 238ms
213ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a247ac8ed7bf7a65f89deb0a0065f14f4e7dd6703383bee45cafe75592159b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 4878
expires: Mon, 04 Dec 2023 16:17:13 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 7 KB
7 KB 233ms
213ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=396&m=0&partner=40380&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F40380%2F230519%2F4e93383dfcd449ea84f4e4cbdca97f23_sakslogo.png&v=3&w=528&rid=4&s=zx6z6xXaa3Qnn_nacq3f9PU5

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1f2aee869598f38b98aa3d2a105f17a8a6492622335c7082dbd7e77912b17d55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 6879
expires: Sat, 02 Nov 2024 03:00:19 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 5 KB
5 KB 243ms
224ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019111684_TAN_486x684.jpg&v=3&w=400&rid=4&s=RcKhhXdB-fheYWWeaTH1ZRRe&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

39b2727a8dd666c7dc7e79dbc0f65d2dbe73bc6ed1bb6b649cad0d7d413da1a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 4930
expires: Mon, 04 Dec 2023 20:19:14 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 2 KB
2 KB 211ms
208ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018754175_BLACK_486x684.jpg&v=3&w=400&rid=4&s=RmtBJ3hhunhJjSXacD5zHa6e&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e17e8d16719737e72c8bdefbfe5ed6a219899c1a8ffa6498f4682a90595828e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 2070
expires: Mon, 04 Dec 2023 15:24:48 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 4 KB
4 KB 244ms
242ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018922562_GREEN_486x684.jpg&v=3&w=400&rid=4&s=_4AnzWnCvch1FZg72ysa9qf8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

aed91c9871f69ca94ca3e844de27421db47c17b4acf4d6711ca0484898fc66ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 4260
expires: Mon, 04 Dec 2023 15:25:02 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 4 KB
4 KB 228ms
225ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400016744580_BLACK_486x684.jpg&v=3&w=400&rid=4&s=jHz0D8K_KrMb1HmJjU95EuFy&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4092f72f55047f69c1495f74fd1830f33ce1547f9d7eeb0da1a1731fc76712b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 4326
expires: Mon, 04 Dec 2023 15:44:20 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 6 KB
6 KB 214ms
212ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019305527_METEORITE_486x684.jpg&v=3&w=400&rid=4&s=4_haIzocM-LxHNAvn0VIY8OS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2fdbc74a5670f8a875bb6ac82c90d3144abe63ea4484b05cbbcbe07f0ee7410d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 5646
expires: Mon, 04 Dec 2023 15:21:26 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 2 KB
2 KB 219ms
217ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400095814608_ROSEGOLD_486x684.jpg&v=3&w=400&rid=4&s=6ebDhO72QH9cL5nkGkQT_RNF&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

35231ef7c1efb8ee7faf62415c518d09ad152a3d8f784e4568b998689646e43d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 1572
expires: Mon, 04 Dec 2023 15:25:00 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 14 KB
14 KB 220ms
218ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018808292_PINK_486x684.jpg&v=3&w=400&rid=4&s=H9DtGd_kZnOKPOZbct-iOZur&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

3d6c8237b0c644b1591d6bc300202ee8dd3d3fde7363ce1f6efa9eeb0f823e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 14030
expires: Mon, 04 Dec 2023 15:18:40 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 3 KB
4 KB 229ms
227ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400017170225_NAVY_486x684.jpg&v=3&w=400&rid=4&s=ElqrrO5Ala8MZNicRSuUSCog&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

61b7dedea6869df846267e03ca1db4e8f06e28870f0049f1281e4220fc4106db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 3574
expires: Tue, 05 Dec 2023 13:47:42 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 10 KB
11 KB 230ms
228ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018768875_MULTIFLORAL_486x684.jpg&v=3&w=400&rid=4&s=l5x7JBwssA1vyXtt0eWRWcUu&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

11ae85b3cdb01d3a6385315ada1128e0ebdbc0c2ed71bddc325486fa9b9b5504

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 10664
expires: Tue, 05 Dec 2023 12:36:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 2 KB
2 KB 228ms
226ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019388523_CREAM_486x684.jpg&v=3&w=400&rid=4&s=Nj7Jd7GxlSGs9QYInw-DJKEh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

43f67bce757bcf48259206c48fb554d9afdfd72d09401092052b04fbdd9482fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 2172
expires: Mon, 04 Dec 2023 15:32:08 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 4 KB
4 KB 244ms
243ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019645159_LIGHTGREYBLACK_486x684.jpg&v=3&w=400&rid=4&s=B-Sab3RfT-CDP-DPFfgx1icP&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0024f60b510aec3cb28a070ed7b1e6be1f6641925d4a7d34709813d098d17434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 3994
expires: Mon, 04 Dec 2023 20:58:06 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 3 KB
3 KB 235ms
234ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018956700_OFFWHITE_486x684.jpg&v=3&w=400&rid=4&s=gjpObfJimEYCAcW8J9IrFSH7&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

85b1f4fa65a132fb156d65bf094b7c768104829b58babc322360ff39fe1e70b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 3212
expires: Mon, 04 Dec 2023 15:45:39 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 5 KB
5 KB 242ms
241ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400018858303_NATURALOLIVE_486x684.jpg&v=3&w=400&rid=4&s=gp4Ef5znv38bH5ap8o8EKXsS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98be7979c8c3572a79c209982db44361f61de9d002b36fd9fe70729c9277b5f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 5148
expires: Mon, 04 Dec 2023 16:57:04 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 2001 8 KB
8 KB 235ms
234ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=40380&q=80&r=0&u=https%3A%2F%2Fimage.s5a.com%2Fis%2Fimage%2Fsaks%2F0400019307148_MOLEGREY_486x684.jpg&v=3&w=400&rid=4&s=yFtfsPettfOqIpQGblemuC7r&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d9357acb0c7cb77456387c72be6a9bb636478df0ccbc49477e14713d9b637761

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=86400
timing-allow-origin: *
content-length: 7902
expires: Mon, 04 Dec 2023 14:05:28 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 2001 0
127 B 77ms
61ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=JyDE-rRu3moSEQPxFHopnMpzbatn3jhVU4ctVoYdJ29mhhQHSLp6FSyltNJD7d_cE6BKtv3I9aZ3M39WXUwV3YXNlAFy2DFBPM4JNtVZ99dS1UPytQ_ExG4ugqkqYx0i4gpxt60s4ZXoCTREpwHJYK00sRqJETnIYi4HADoEYyTG5u4SpqqtDX-SLrPBSSmmqKwezOYV8rWRm_kxBG-CAgno75fE8Dt2nH-z0yWjCHNF6k3dIQjTLPCpqMozD02Zfe9ayA&sds=2&rev=89278&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 13:58:04 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 2001 2 KB
1 KB 70ms
59ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 2001 2 KB
1 KB 76ms
69ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 28 Nov 2024 13:58:05 GMT

GET
H3 200 request Show response
fundingchoicesmessages.google.com/f/AGSKWxWN1fC4P7yymsNlQITwbGJvh_ky22LlqM-Rmkwn0tuElm_VSVthcM_CHuejdTmtktQ7DacdJIRQ2-pfkERDK3MK226BVsn8DuC9NlcD-RX6zwXIqeriMANdZsQOMdEi0DfzQBoVu8wzk2Rf5aHeSjiM_gxG9... 54 B
109 B 97ms
94ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWN1fC4P7yymsNlQITwbGJvh_ky22LlqM-Rmkwn0tuElm_VSVthcM_CHuejdTmtktQ7DacdJIRQ2-pfkERDK3MK226BVsn8DuC9NlcD-RX6zwXIqeriMANdZsQOMdEi0DfzQBoVu8wzk2Rf5aHeSjiM_gxG9pXyJrl1angjq208aRN-H6MzsuRoG679/_/ad/request?/adunits?/adblock.gif?/dfpsearchads./ad-label.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.FaYPuRweqII.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzufRugCfZ2QricSdnhl71g5NspTQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

42ec8059b33062e628cef2308c602307c7b96809f280d167bca39c41d36adce2

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-KOUXrOXYR_oZbOsYyyGQKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-KOUXrOXYR_oZbOsYyyGQKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 64 KB
24 KB 77ms
75ms Script
text/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a09ba825877d567e6cca03a8eaa2583f9e76a0f6d3ec64ead89048db668a82d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 466
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24457
x-xss-protection: 0
server: cafe
etag: 7553420222452197197
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 14:50:19 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 92ms
91ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hQ1whJBJVvJMQwPL-x28-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-hQ1whJBJVvJMQwPL-x28-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 94ms
93ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-i433NBXejydAltqsmp-fmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-i433NBXejydAltqsmp-fmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 98ms
97ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-JxP4Yp0kDpMOpHi3dPxj5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-JxP4Yp0kDpMOpHi3dPxj5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 105ms
104ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7Jx6vOgbTJdQ6rCc94idSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-7Jx6vOgbTJdQ6rCc94idSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxXxGpiWvY2AfHF969YQU5rUHSV7wZcG9w3oXTlFrVMVn3hYJ2Kci8AjV4oJWTi57FQ_AYobPcqSQ3uZLocbP9JRWMdv0eSAZsp1Xq-87c6H24mC0-qcHVIG-Fzs6f__bcKQ7tpYvA== Show response
fundingchoicesmessages.google.com/f/ 4 KB
2 KB 105ms
105ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXxGpiWvY2AfHF969YQU5rUHSV7wZcG9w3oXTlFrVMVn3hYJ2Kci8AjV4oJWTi57FQ_AYobPcqSQ3uZLocbP9JRWMdv0eSAZsp1Xq-87c6H24mC0-qcHVIG-Fzs6f__bcKQ7tpYvA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxNjk4Mjg1LDMyODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vbGZtenppbm9hYWxyaWhpaGNpcmloZGYuYml0bHkud3MvIixudWxsLFtbOCwiRmFZUHVSd2VxSUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTgsIltbWzBdXV0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

414300d6f002fb7c6b329f403c22269335a5e8c4d227dc21f972fac774d633b9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-yNL9JV4xjaMzRZmnD0eUXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-yNL9JV4xjaMzRZmnD0eUXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 91ms
90ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-dJlshMyg7Qivfw_nJ9xFrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-dJlshMyg7Qivfw_nJ9xFrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxWBuiH7e5uI2hgMvC7vRUvrGlLiPmR9yRLriLV5zlVoYRr4NE3lkTJEW51Dwa7964E6IghCjTxEQcMBBnwnJFnjrCyghvTAkMF-Iae9QvWGrTUaP7BzSJcL-6FUKQXnD6pR2DBRjg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
1 KB 124ms
124ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWBuiH7e5uI2hgMvC7vRUvrGlLiPmR9yRLriLV5zlVoYRr4NE3lkTJEW51Dwa7964E6IghCjTxEQcMBBnwnJFnjrCyghvTAkMF-Iae9QvWGrTUaP7BzSJcL-6FUKQXnD6pR2DBRjg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxNjk4Mjg1LDQ3NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vbGZtenppbm9hYWxyaWhpaGNpcmloZGYuYml0bHkud3MvIixudWxsLFtbOCwiRmFZUHVSd2VxSUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTgsIltbWzBdXV0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6e87565bc8bb505a9d22e13ccc3f2857d4a65970ea7d5ad8d43d6c425dc1896e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EdHiJElflm2RqOufNd3wvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-EdHiJElflm2RqOufNd3wvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F764 42 B
64 B 231ms
98ms Fetch
image/gif 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstNRU8CKNR_09OdJrdrV78VXu0XLWGlDqxY0pLxOrHr1REMOzokrtxu303qFgJd9_HhG-vSWr4qyYINq3Bi2tkXTOE34P076H2JRfZMEfJTEteWhaiQ&sig=Cg0ArKJSzKHXfjBcgNQvEAE&id=lidar2&mcvt=1000&p=0,0,200,1200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=624732521&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701698283215&rpt=1357&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxX1jcdyWT4FB2rzzNYIzxdaqOE1jgUJJ3bAFYzoyM6PuSlIRzSwKwDTN7TGjOwm8qufJO7MvFth0XPGqhkA6q0ERzEJZtNYiPX-8oqbJupEmVFFiMyF0GcqBMgVOtZbtaBZNK9y3w== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 107ms
106ms Script
application/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX1jcdyWT4FB2rzzNYIzxdaqOE1jgUJJ3bAFYzoyM6PuSlIRzSwKwDTN7TGjOwm8qufJO7MvFth0XPGqhkA6q0ERzEJZtNYiPX-8oqbJupEmVFFiMyF0GcqBMgVOtZbtaBZNK9y3w==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzAxNjk4Mjg1LDYwMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9sZm16emlub2FhbHJpaGloY2lyaWhkZi5iaXRseS53cy8iLG51bGwsW1s4LCJGYVlQdVJ3ZXFJSSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxOCwiW1tbMF1dXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

18da539c8fdefe169ee4d1aeb4b2c2829f9896c0980322c475b7ae86400058c7

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-BvGB_NWS2YM1Jp02V5W7VQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-BvGB_NWS2YM1Jp02V5W7VQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CAD1 42 B
64 B 175ms
96ms Fetch
image/gif 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvuT3geRrpc3ACpW3ZMb5Se-eRX24OxQw2bhcW6jBQi3pqjtn28yHVU7nP8XQe-TE34qbSUo4ncXuGZ-Pa9R5XYMO4pVMFp4glvRV_Bk8xaImYj9Oyo&sig=Cg0ArKJSzFdvVw-oOP2IEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=431,1000,1000,1000,1000&tos=431,569,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701698283742&rpt=882&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 13:58:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXpHF6VIW8Ii8O5pB7lnW811OTbdUaAMnENwzJeJAWlaArd-8hfHQJ4NLyJ7fQrS3KEuzwvh8ke6UJJTNfO440vnHAv9oTAyxqtLvjDIVsjXkwbgd83jQpWqBqw3xiZzLol5_jdeQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 92ms
91ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXpHF6VIW8Ii8O5pB7lnW811OTbdUaAMnENwzJeJAWlaArd-8hfHQJ4NLyJ7fQrS3KEuzwvh8ke6UJJTNfO440vnHAv9oTAyxqtLvjDIVsjXkwbgd83jQpWqBqw3xiZzLol5_jdeQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-RiLRJMQuMYqdSLmC0b5k2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-RiLRJMQuMYqdSLmC0b5k2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 110ms
110ms XHR
text/html 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW9W_GrEzI1RM7QvEfcV6R-qjzph1NclLt36dF37FqTuWV4T7CcYznYR5iYsGa-BeOBjwYdmQ3sXHiLyneDMiQ9MmWttR56GPdW6-tTNoqPz1TWWsSSmnSHBzEEYO5l0ei3YFcstA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hIuQCFOesnHZszqzWjAvBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-hIuQCFOesnHZszqzWjAvBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://lfmzzinoaalrihihcirihdf.bitly.ws
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 99ms
98ms XHR
application/json 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231129&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5739cba91c5f008faba906ff56cef43fffb43eb6924a3679c1566723261af271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12177
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 104ms
103ms Script
text/javascript 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311290101/show_ads_impl_fy2021.js?bust=31079889

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Dec 2023 13:58:05 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame B374 13 KB
5 KB 67ms
64ms Document
text/html 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 323370
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 30 Nov 2023 20:08:35 GMT
expires: Fri, 29 Nov 2024 20:08:35 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame AC92 829 B
1 KB 231ms
89ms Document
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cec5ac8e217144bc64f17f62f5a5421ca94961548eccd5e4f38e5010b9725048

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WZQ95Ss-7XxV9JLjPBlSSQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-WZQ95Ss-7XxV9JLjPBlSSQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 13:58:06 GMT
expires: Mon, 04 Dec 2023 13:58:06 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame B374 39 KB
15 KB 66ms
66ms Script
text/javascript 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 08:02:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21354
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 08:02:12 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame E5E3 0
127 B 60ms
60ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame B374 0
10 B 65ms
65ms Image
text/plain 2607:f8b0:4006:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Du0R3w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:58:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 all
csm.us.criteo.net/ Frame 2001 0
127 B 60ms
60ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 13:58:05 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame AC92 0
0 93ms
92ms Image
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231129&jk=301346477646608&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 95ms
95ms Image
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231129&jk=301346477646608&bg=!_P-l_7DNAAY3kmNgF5I7ADQBe5WfOD6ipMgYrwjjrj9kXAkv8lFCadvutbfEg_SuqUvq-cQgSe9RjC_ySzBPfF6B8i7IAgAAAHZSAAAABGgBBwoAoaYWOZH9MzfWxobHmuMKYDdxe13PlaqPBGIfSSCpm0eSmvUzvaAGVU79PpiA-CT1PWk2sTw16DNnUOcF6x4ErgFyt-QHOsbqY7I6MT9zm7IF4bxrK5oMLK5B8aMvZGVjtjrg9eowNgSeAj_CW2F4xL-KCVwgRpoPpiZOglHiqSABTbIpbOoZOl7frPmZQ4Z71gCgixPF0ui8yDdO-KwBFLAYmQLMqLDNwHo_LDVkumeXQPZPBt2RWqj-Q0pd_MVow5Uzt3lPu7kLdOgd-HLkINF417l9aOsg2I0N6nfbCzSAHvjIKgN8zk4D-8qHKM8MjLTWzaBPd_KlF7_1h8lqcSp1t3Bg2pGYdj2LBtAJVSe0k7huq-6ne-Pa3A0GMDJ8V9Wu6UxwJ6ky6ZdVmBqAYf5KjCmo7lj6mmyxDY8MAyjaNkf-a6vAO0AJcUh9ikJayuzVW1Efm3xrLMiHd8kwnz4eirgU8Cp88qoZ8SvxLkvJsbFOocT0L8zH-oR9_vQOSXan3CXlX3nYqymQWAXoPEAyEhNRkVMai5cgKT1UOFToAki7ED-3EKWWq_HvJ21Els1QZYfu7SQZFgIvLCoY1P7i7K-2nof3IVSDKO_VoliKTj1kQuDdrT7w0t8ouCeuV2uRmnLXQLteLodm4BaU-Bzb-gv0NFbHRpmEqzLoey4VGETyrd9DoeGNlPj-TzKvdyIpwQsSHJPFVhIuSZU5-i-snBzQxn-Qp3uIfLKBhyAS_E1CCUJxaB9oI_y2Da3BcP4wRv6nW5ZGJxm_mxjtlju859JzU53548T9YuBy142ciXQkQGZvz7DR2Yi7A9WT_GczfbUWRybCNOg14vle_-dnQ6Wz9-nobHj_xPKK1KQcdTbRSHhNyESkcdju5bdezQcQFZ9kKw5H4wr26FY6Cc0aUd2qIBgtzRP9tdI2goXeSd_MwdN2ywZ7L_oU1fD_zeINIns5QjlFHelz8yOjQgDCHe88zskb2dB3GFDch7zioqY_qAJrGT9kmxYn9L70dJcJ02kYz3h8ETHmpxHj2f7qWnnHAvMPFvllsYGXsNHJsrtjQGJV1r_OtWGmnSuZ02styeZx0lmDUlQxL0YugDRmDvd3HSTFGFLe6E7ELnH5425tspy9_MAU1WJkBWNGuDfFgyP5L7CfUyRA8nZwS5E
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lfmzzinoaalrihihcirihdf.bitly.ws/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bitly.ws/	1970-01-21 02:17:38	Name: _ga_8Q1W6PKNCX Value: GS1.1.1701698283.1.0.1701698283.0.0.0
.bitly.ws/	1970-01-21 02:17:38	Name: _ga Value: GA1.1.1330316537.1701698283
.bitly.ws/	1970-01-21 02:03:14	Name: __gads Value: ID=67ae625938dd2894:T=1701698283:RT=1701698283:S=ALNI_MaMuR-ZihNMV_mEDvHgGnUktHL0-A
.bitly.ws/	1970-01-21 02:03:14	Name: __gpi Value: UID=00000da59418b033:T=1701698283:RT=1701698283:S=ALNI_Mbui6zmlOj3FTFTniJLWcTeb0IU-Q
.doubleclick.net/	1970-01-21 02:17:38	Name: IDE Value: AHWqTUneaVJIJumMIj6c0s8wYFbxcXYvq2Hz_s1rdHkYwtsSyBCRMLQ-9-X1KAPDl9k
.agkn.com/	1970-01-21 01:27:14	Name: u Value: C\|0AAAtAJdtLQCXbQAAAAAA
.agkn.com/	1970-01-21 01:27:14	Name: ab Value: 0001%3A%2FDMJQaNIHj6HjbHPIt3y54oqDEg1MtWH
.bitly.ws/	1970-01-21 01:27:14	Name: FCNEC Value: %5B%5B%22AKsRol9s1V-uHylrJm7Qbbo9Y8TLDAZMCem6VpXkb-4RMS7HLdo8FFr9d1JnXqICqUuSv0BRMDtUX8kt6jz1jX2gOBO0yzBDE2wvapU5LgeuEYSG9ZSzDaIZzv2vBLCPJbrZZjfghgyEMi3FZ0Etl3alAJLaufnTag%3D%3D%22%5D%2Cnull%2C%5B%5D%5D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1(Line 17) Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.us.criteo.com
bitly.ws
cat.va.us.criteo.com
cdnjs.cloudflare.com
csm.us.criteo.net
d.agkn.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
imageproxy.us.criteo.net
lfmzzinoaalrihihcirihdf.bitly.ws
pagead2.googlesyndication.com
rtb.va.us.criteo.com
static.criteo.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.paypalobjects.com
185.11.100.204
192.229.210.155
2001:4860:4802:32::178
2600:9000:2514:3800:19:fc2c:a140:93a1
2606:4700::6811:180e
2607:f8b0:4006:806::2003
2607:f8b0:4006:809::2008
2607:f8b0:4006:80a::2002
2607:f8b0:4006:80b::2002
2607:f8b0:4006:81d::2001
2607:f8b0:4006:81d::200e
2607:f8b0:4006:81e::2002
2607:f8b0:4006:81e::2004
2607:f8b0:4006:822::200a
2620:100:a001::16
2620:100:a001::24
2620:100:a001::3
2620:100:a001::4
2620:100:a001::9
74.119.119.147
0024f60b510aec3cb28a070ed7b1e6be1f6641925d4a7d34709813d098d17434
0059cb4ff0a271382c38af8a7367aaf45cbeb31449637d3928d25317401e2828
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
0c2ff1b58d013b56b5a4e410c26c1e63861674405a8d5f29c058c3076d9dbf6c
0e6059b10b60eef67b577e139d7593b0a095556dbfd15af64c96e565b3d26af3
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
11ae85b3cdb01d3a6385315ada1128e0ebdbc0c2ed71bddc325486fa9b9b5504
151bc681e41dd21a559a36d4afe28b98b0da1bdc67ca599b5fc8e0bf983b9012
18da539c8fdefe169ee4d1aeb4b2c2829f9896c0980322c475b7ae86400058c7
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
1ae6619173f92af4f0201b7204322213c714b56df437aa7d6482a1c141d5337c
1f2aee869598f38b98aa3d2a105f17a8a6492622335c7082dbd7e77912b17d55
2580a164a3ea2bb5274b9e8d0ae3919bd9d7f7e1fea287084085bdaddd28dea4
29e8077f4d3f30e78282ff2aad3176087f8a3f1060ab2997a73a33521ff80cfa
2dc23bb5e2c78a37a35ae6df3a3a7c656c9d6332b19639da09cf52c0e7944815
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2fdbc74a5670f8a875bb6ac82c90d3144abe63ea4484b05cbbcbe07f0ee7410d
300bbc3f52956156726e308b0ff0efb62880e89720defd775a28e545bde4dcee
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
35231ef7c1efb8ee7faf62415c518d09ad152a3d8f784e4568b998689646e43d
3586fca89188da4178601f6c88760e954f8ea116975b544a8dd8a151186a7dc0
362d1b7380751ef6405b308e4590c962a21e56ad597ad46b1fbd83e7bb34307e
39b2727a8dd666c7dc7e79dbc0f65d2dbe73bc6ed1bb6b649cad0d7d413da1a1
3d6c8237b0c644b1591d6bc300202ee8dd3d3fde7363ce1f6efa9eeb0f823e78
3f928b6bbb164f5ffd3f8d1c8b602c475f94b386684600baddc64b61d283c143
405773c896e1955562d347744121c4bdfb078188d311b13fcb6471444d191400
407bb6f00a6f23035d94cdc93a8f187a5326c1d7b17f49000f1f26f85f18d22b
4092f72f55047f69c1495f74fd1830f33ce1547f9d7eeb0da1a1731fc76712b1
414300d6f002fb7c6b329f403c22269335a5e8c4d227dc21f972fac774d633b9
42ec8059b33062e628cef2308c602307c7b96809f280d167bca39c41d36adce2
43f67bce757bcf48259206c48fb554d9afdfd72d09401092052b04fbdd9482fd
4b5816bbfc52587979139951355fe4048da02ce60e40cef8e4a1efb6cd396281
4ba34277f565882a20857704ea829b9a10b84162e2f6143ca91c62932c3e00af
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e70673e126c7517f724afe8a0d530b91ca0b22781de5ca5f5eaccb731e3d62d
4fed2a7ad5032d740a816e8a4dd2d72c397612149d82d8d067efc85fb5635558
54339f1c8cb089c05773b2b18fd5da6e702956decbf7dea6ef0348a64203c657
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5739cba91c5f008faba906ff56cef43fffb43eb6924a3679c1566723261af271
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
61b7dedea6869df846267e03ca1db4e8f06e28870f0049f1281e4220fc4106db
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
650ea0e3d40eb72966dc0b9aa1c934ee6c2fbb915b0dfca9016d7fa84fc1c8cc
675f6b6dc673aae01f8ef949697ee544c8df8574ca090a4dd690776ec6e442ea
6e87565bc8bb505a9d22e13ccc3f2857d4a65970ea7d5ad8d43d6c425dc1896e
70486b7f0fb39b876d97c4b360ee5cc2a8e36d0e653635826e8983a0137fef95
71fec08136db4f39744016e39725613faa040db5da9f01cbcdf3b1ef6e5000d1
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
85b1f4fa65a132fb156d65bf094b7c768104829b58babc322360ff39fe1e70b1
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
90e205d053c93b709678fd3ed9a6e8d112acb52934c6827b76db515bcc6689d2
971a4d977108d8571fca1e34696bb58532799a6858d7a7b0397d04f1f93158a9
977a90da74cac486dbed34ec694c7e0a8613a960ee646805a311dc3a172e9433
98a0d6bc9bf905ecf2ea8ee639808585ec323d14e3492618272d2f251fc3f551
98be7979c8c3572a79c209982db44361f61de9d002b36fd9fe70729c9277b5f5
9b413106c06a231fbdf3a1ee9afd6ddcd910ef9e060f4dd3ab3801edd27734b0
9d6d07efe151e2bacc48701ce439fdfc85f3b07ea6997e22ebf15f5b096b9fff
9eed24cc91c3a01f46f87bdada069f07606ac0d9b896d98cc00f8d342d8f02b7
9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a
9fa040857c91f4e10435a8f45290116b565b34e19fddaba6d734bdde764437f5
a09ba825877d567e6cca03a8eaa2583f9e76a0f6d3ec64ead89048db668a82d4
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a247ac8ed7bf7a65f89deb0a0065f14f4e7dd6703383bee45cafe75592159b37
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
aed91c9871f69ca94ca3e844de27421db47c17b4acf4d6711ca0484898fc66ca
af9dcb68a6bdf78dc61abe381f45b4d5956b1b534dba4c3c3e549f685d77dcfe
b8214bd5cbd9197f329d1df98d908dc7a1cd38c28e8010b92e49b3f35dd9986a
bb73bf5529e61703ddc5b2f0e50802f143083f4180dcd94f0e266b0c54936708
bb814ac86e7f409154ced702b9f3543761d09410e837ec728242e6b980a26aa0
bdf88373aa92b42b65b29ae03d742ff0c3eec910bb797173beb7400f2680a07e
be2c565807b990c64fad08f425f88a701a0a0a22f43b5d49d56dc2694f03023e
c28530634cdfc14bb5c068fc74a7071f9e27fc97f9aa03a1258f5b33f9c8ab6d
c809d8792cb030b237397ef632d0672aac5bafeb34484602179af8ae4c7af13c
cec5ac8e217144bc64f17f62f5a5421ca94961548eccd5e4f38e5010b9725048
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d53440555f5a57ae8fd01e5212f5f89c8f9a43ed054b1f565cfa55790756886e
d801e92b871fa83c2b814cb197ae10152f654a0de64e969340e15086147640b4
d9357acb0c7cb77456387c72be6a9bb636478df0ccbc49477e14713d9b637761
ddccc3b074d270f15bb7619ad6324f0c4e7b2576747bb20851a8a709c62d15d2
e06d26767a716202b94be18a21376f4f29c7511420982d61ee36fbe7af474e16
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e17e8d16719737e72c8bdefbfe5ed6a219899c1a8ffa6498f4682a90595828e1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6bfc0e322d8733f7c4cf4918d0226b57e67ee1bf724f9ea084c31a49971dc68
eeacb3f428d43ac8af675ad77b25e4b6ab508279cc838120e78063c101b4d252
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1d97bed3a1251b0c6f619f99e8d1bdb0d4822cf7376573bd87ec9540c115342
fd984bc852da856d92c3a84e61bb64ee2bf963aa74d034088fb7cf637f77aee2

lfmzzinoaalrihihcirihdf.bitly.ws Open in urlscan Pro 185.11.100.204 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

129 Requests

95 %HTTPS

85 %IPv6

14 Domains

21 Subdomains

21 IPs

2 Countries

1292 kBTransfer

2934 kBSize

8 Cookies

6 Outgoing links

Redirected requests

129 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

lfmzzinoaalrihihcirihdf.bitly.ws Open in urlscan Pro
185.11.100.204 Public Scan

Screenshot
Live screenshot

Full Image

129
Requests

95 %
HTTPS

85 %
IPv6

14
Domains

21
Subdomains

21
IPs

2
Countries

1292 kB
Transfer

2934 kB
Size

8
Cookies

129 HTTP transactions
2 data transactions