weloma.net Open in urlscan Pro
185.242.104.48 Public Scan

Software

nginx /

Resource Hash

0a46eabd9af5bb7e190e01bf7efbc9b8aa10e2d33749916dd0c96929f746bcd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9

Response headers

server: nginx
date: Fri, 31 Dec 2021 11:59:24 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
content-encoding: gzip

Redirect headers

server: nginx
date: Fri, 31 Dec 2021 11:59:23 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
location: /wem
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000

GET
H2 200 owl.carousel.min.css
weloma.net/app/manga/themes/dark/assets/css/ 3 KB
1 KB 179ms
178ms Stylesheet
text/css 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/css/owl.carousel.min.css

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

062368677bcefd9495e8b320e0cf22c4faca9f1bc04666efeb9cd5307cd591a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: W/"5f716b71-d1c"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 font-awesome.min.css
weloma.net/app/manga/themes/dark/assets/css/ 30 KB
7 KB 179ms
177ms Stylesheet
text/css 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/css/font-awesome.min.css

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: W/"5f716b71-791c"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 owl.theme.default.min.css
weloma.net/app/manga/themes/dark/assets/css/ 1018 B
781 B 133ms
132ms Stylesheet
text/css 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/css/owl.theme.default.min.css

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

505fff817f37d43899275853aa6d6f4f3644b6abe2c420ad9cd6caab1ef147cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: W/"5f716b71-3fa"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 united.css
weloma.net/app/manga/themes/dark/assets/css/ 136 KB
19 KB 182ms
181ms Stylesheet
text/css 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/css/united.css

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

2895fc7f70b100a675aa15c12238fbf790752fff565ff7ac12e36085e69ab60a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Thu, 10 Dec 2020 15:31:30 GMT
server: nginx
etag: W/"5fd23f52-21e2f"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 base.css
weloma.net/app/manga/themes/dark/assets/css/ 52 KB
11 KB 179ms
178ms Stylesheet
text/css 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/css/base.css?v=1.5

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

fe784ffb2b2319b6a3583f5abfeefa7ceb81099f59264a2cdaba2577157e78d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Mon, 15 Feb 2021 18:08:28 GMT
server: nginx
etag: W/"602ab89c-d035"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 jquery.min.js Show response
weloma.net/app/manga/themes/dark/assets/js/ 82 KB
29 KB 178ms
178ms Script
application/javascript 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/js/jquery.min.js

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

05a8a5125b36da55ff02702436ee672fa3ddd45ccebd499a8fbff0461c8cba10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: W/"5f716b71-1469c"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
51 KB 130ms
47ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5970742391268812

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98f6a96f495cc8aacc60d1c633dc89d4637c73d2884ff48b93fad9773fe2d26f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://weloma.net/
Origin: https://weloma.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51735
x-xss-protection: 0
server: cafe
etag: 7593943614216543747
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H/1.1 200
OK lovehug.js Show response
storage.de.cloud.ovh.net/v1/AUTH_4b1b323ce19643f985895cf772add44b/sarsor/ 8 KB
8 KB 182ms
48ms Script
text/javascript 145.239.139.16
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.de.cloud.ovh.net/v1/AUTH_4b1b323ce19643f985895cf772add44b/sarsor/lovehug.js
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 145.239.139.16 , France, ASN16276 (OVH, FR),
Reverse DNS: ip16.ip-145-239-139.eu
Software: /
Resource Hash: 45960ce30d5a1dc618294c81b4867295ac66336c4881ff151bdc22d5141849a9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:24 GMT
X-Openstack-Request-Id: txa4d9ea3be8ce476aa1646-0061cef09c
Last-Modified: Tue, 18 May 2021 13:16:26 GMT
X-Trans-Id: txa4d9ea3be8ce476aa1646-0061cef09c
Etag: 99a5587aaa49f43431d6856f55ad4bf4
Content-Type: text/javascript
X-Timestamp: 1621343785.94498
Accept-Ranges: bytes
Content-Length: 7786

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 114ms
44ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-205473142-1

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

69d2aea91b2f3b5c308a44a3e4da09b7fc30703954fb29a67bb9bbfc871b32d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36192
x-xss-protection: 0
last-modified: Fri, 31 Dec 2021 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 126ms
41ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2be99b99f418219be8ca7a986038e1a94c5df5b2c91a0c0d9ee35552fbb8fde8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1087 / 862 of 1000 / last-modified: 1639397097"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26915
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H2 200 site.js Show response
protagcdn.com/s/weloma.net/ 331 KB
98 KB 254ms
130ms Script
application/javascript 2606:4700:20::681a:68e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://protagcdn.com/s/weloma.net/site.js
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:68e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d19ed3be8f98fb3d9750b4925dc4994948ee1361f61e21d8d75014564c47b1ae

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3493
cf-polished: origSize=339611
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: no-cache
last-modified: Mon, 27 Dec 2021 17:43:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RVJcFqPDVAOV%2BvXeMH%2BkZZLj6NPPuEtsdw8%2BZ95tg%2FFav37IYfBe41dNEH4Vx2%2BYjX1hYA3gAREUFpBKWtwNxTVi2rQFZrZfx1pywzDXYxNWX%2FFB1%2BLNZ3mgkeuPjX30iwGPb5MyTPjWbhg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
cf-ray: 6c6357741f9c5a01-MXP
expires: Fri, 31 Dec 2021 12:29:24 GMT

GET
H/1.1 200
OK spt Show response
tg1.modoro360.com/api/adserver/ 20 KB
6 KB 412ms
160ms Script
text/javascript 2a02:26f0:6c00::210:bb3a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://tg1.modoro360.com/api/adserver/spt?AV_TAGID=6086ba97c979b40b712ace46&AV_PUBLISHERID=60095c900c0799791c46d8d4
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:bb3a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 08203ccc956dbd20d43b340b9b4c0f8a1f501e741326f44931aac3c73693ddc6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS, INDEX
Content-Type: text/javascript
Cache-Control: max-age=300
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Bamboo-Token,Event-Id,X-Requested-With,avsptstaging
Content-Length: 5623
Expires: Fri, 31 Dec 2021 12:04:25 GMT

GET
H2 200 cont.main.php
weloma.net/controllers/ 1 KB
1 KB 353ms
351ms Image
image/jpeg 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://weloma.net/controllers/cont.main.php?type=captcha

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

80a8c5645bda469e6623a120d22822402fe91900317e71365e8278088c47ab3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 chance-load.gif
weloma.net/app/manga/themes/dark/assets/images/ 43 KB
43 KB 139ms
137ms Image
image/gif 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://weloma.net/app/manga/themes/dark/assets/images/chance-load.gif

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

f6b2582fb421eb74113d18f0fb0d303093345187329e49453755a6e87c936e2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: "5f716b71-ab82"
strict-transport-security: max-age=31536000
content-type: image/gif
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 43906
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 avatar.png
weloma.net/uploads/avatars/ 7 KB
8 KB 138ms
137ms Image
image/png 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://weloma.net/uploads/avatars/avatar.png

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

719da43c137399c4400d6d39b4c27108e8bd965e0f0f7f28002a651b7ae839b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
last-modified: Sat, 04 Sep 2021 04:28:00 GMT
server: nginx
etag: "6132f5d0-1d75"
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 7541
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 a72PDIQ.gif
i.imgur.com/ 19 KB
19 KB 145ms
74ms Image
image/gif 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/a72PDIQ.gif

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

b6d9f047841878fa322786864c1f0307fe1b39b098a50eed41bcc9af0d30c99b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
age: 3297459
x-cache: HIT, HIT, HIT
content-length: 19706
x-served-by: cache-bwi5173-BWI, cache-iad-kcgs7200023-IAD, cache-fra19122-FRA
last-modified: Sun, 31 Jan 2016 10:39:15 GMT
server: cat factory 1.0
x-timer: S1640951965.743329,VS0,VE4
etag: "ada69632fe67914a70bcf54133bec12c"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1, 1

GET
H2 200 oh3ZUDF.gif
i.imgur.com/ 75 KB
75 KB 101ms
31ms Image
image/gif 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/oh3ZUDF.gif

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

196f4cb83d81a830c54cfb07a54137a952c5fee6c2a6dc39249caad154d4724f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
age: 2600152
x-cache: HIT, HIT
content-length: 76388
x-served-by: cache-bwi5121-BWI, cache-fra19122-FRA
last-modified: Sun, 31 Jan 2016 10:39:16 GMT
server: cat factory 1.0
x-timer: S1640951965.743419,VS0,VE1
etag: "249ce269be398949b9e2d2362624333d"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 404 avatar_298.jpg
weloma.net/uploads/avatars/ 548 B
548 B 157ms
155ms Image
text/html 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://weloma.net/uploads/avatars/avatar_298.jpg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept-Encoding
server: nginx
strict-transport-security: max-age=31536000
content-type: text/html

GET
H2 200 018.gif
4.bp.blogspot.com/_1Jw2fzSntT0/TZDLE4VBnBI/AAAAAAAABQs/gVSJdgUcCh0/w1600/ 4 KB
5 KB 571ms
181ms Image
image/gif 2a00:1450:4019:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/_1Jw2fzSntT0/TZDLE4VBnBI/AAAAAAAABQs/gVSJdgUcCh0/w1600/018.gif

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4019:809::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4faf26bfa0933bc6154243606e796e3a2f3d0decdc028f10d95d5bf940898109

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 08:28:09 GMT
x-content-type-options: nosniff
age: 12676
content-disposition: inline;filename="018.gif"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4575
x-xss-protection: 0
server: fife
etag: "va61"
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 14 Nov 2021 10:51:54 GMT

GET
H2 200 101.gif
3.bp.blogspot.com/_1Jw2fzSntT0/TZDLYXqZTOI/AAAAAAAABV0/2JexDPQSQCQ/w1600/ 16 KB
16 KB 113ms
30ms Image
image/gif 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/_1Jw2fzSntT0/TZDLYXqZTOI/AAAAAAAABV0/2JexDPQSQCQ/w1600/101.gif

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d1affff8231aaea73f6ab39d2cbd096cc0546874ce12ec7033200a6aa8d973c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 08:47:06 GMT
x-content-type-options: nosniff
age: 11538
content-disposition: inline;filename="101.gif"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16003
x-xss-protection: 0
server: fife
etag: "v90a"
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 18 Nov 2021 05:56:17 GMT

GET
H2 200 053.gif
4.bp.blogspot.com/_1Jw2fzSntT0/TZDLMwoWmoI/AAAAAAAABS4/5s-0GqfkYLg/w1600/ 3 KB
3 KB 434ms
172ms Image
image/gif 2a00:1450:4019:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/_1Jw2fzSntT0/TZDLMwoWmoI/AAAAAAAABS4/5s-0GqfkYLg/w1600/053.gif

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4019:809::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c54e65cbc32357610462d755ba8517809980871de61a41b54690e36a0fd823f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:14:38 GMT
x-content-type-options: nosniff
age: 6287
content-disposition: inline;filename="053.gif"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3137
x-xss-protection: 0
server: fife
etag: "v9ef"
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 13 Nov 2021 14:01:18 GMT

GET
H2 200 bootstrap.min.js Show response
weloma.net/app/manga/themes/dark/assets/js/ 27 KB
7 KB 136ms
135ms Script
application/javascript 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/js/bootstrap.min.js

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

8b08618a3fdefce17aa6cb87a64d54bd8090dc9cfdedccf54251b4978c9636bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Tue, 14 Sep 2021 03:00:54 GMT
server: nginx
etag: W/"61401066-6c53"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 owl.carousel.min.js Show response
weloma.net/app/manga/themes/dark/assets/js/ 43 KB
11 KB 151ms
151ms Script
application/javascript 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/js/owl.carousel.min.js

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: W/"5f716b71-ad3c"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 function.js Show response
weloma.net/app/manga/themes/dark/assets/js/ 21 KB
8 KB 139ms
137ms Script
application/javascript 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/js/function.js?v=1.9

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

68054a11576373e59729adbcce630b7c9315fcd8eea465eeb1b6715cbd993243

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
last-modified: Tue, 14 Sep 2021 03:29:31 GMT
server: nginx
etag: W/"6140171b-5582"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
strict-transport-security: max-age=31536000
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 hb_323303_10647.js Show response
player.adtcdn.com/prebidlink/455819/ 331 KB
98 KB 183ms
70ms Script
application/javascript 2606:4700:3032::ac43:c67b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:c67b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f8be13cada5de72a052def60d2f4344c2cd412e4707f2c7013cc0cabcdb36fe

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 711
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 22 Dec 2021 19:42:47 GMT
server: cloudflare
etag: W/"61c37fb7-52a06"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2BpWnIvJJjd6iVRldeNFsdjV3OR75PN4dDfT5HzK0PcS7aEgmUGRbkuDpsq0cTW0lqrlbthNrckM1X5teqWGtR%2BA38gY2R1Sd%2FlEQn5ocTHFbhqggIFVxU2HeQJe13Vcw%2FN7IKsZvqjmapNTXNMRhw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=345600
cf-ray: 6c635774ce0959fb-MXP
expires: Fri, 31 Dec 2021 12:02:33 GMT

GET
H2 200 wrapper_hb_323303_10647.js Show response
player.adtcdn.com/prebidlink/455819/ 1 KB
1 KB 172ms
64ms Script
application/javascript 2606:4700:3032::ac43:c67b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtcdn.com/prebidlink/455819/wrapper_hb_323303_10647.js
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:c67b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dedddf5655806277d169717ac90ebb8ebff88d7f48aa462d81491a2c7f2ad66a

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 711
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Wed, 29 Dec 2021 13:38:35 GMT
server: cloudflare
etag: W/"61cc64db-421"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nFMYkkVrNlml428Me36UyUKqJsft6w6306%2BlYH10ujcmFGZnHUUSpWQdT492gQTHubtrE0pzt88nKYK370ow5CiA%2Bd4SCm2VaalgdRGdRwdpDDG3JbTltwG%2BptoiOX5wI%2F3emKUXeyPZ6RAmR25stg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=345600
cf-ray: 6c635774ce0a59fb-MXP
expires: Fri, 31 Dec 2021 12:02:33 GMT

GET
H2 200 bg_dark.gif
weloma.net/app/manga/themes/dark/assets/images/ 3 KB
3 KB 136ms
136ms Image
image/gif 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://weloma.net/app/manga/themes/dark/assets/images/bg_dark.gif

Requested by

Host: weloma.net
URL: https://weloma.net/app/manga/themes/dark/assets/css/united.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

93816b87476a6e3625c29ba4c37254ad79c82c700a89003fd371712cb06389e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/app/manga/themes/dark/assets/css/united.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: "5f716b71-bc1"
strict-transport-security: max-age=31536000
content-type: image/gif
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 3009
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 glyphicons-halflings-regular.woff2
weloma.net/app/manga/themes/dark/assets/fonts/ 18 KB
18 KB 168ms
167ms Font
font/woff2 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/fonts/glyphicons-halflings-regular.woff2

Requested by

Host: weloma.net
URL: https://weloma.net/app/manga/themes/dark/assets/css/united.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://weloma.net/app/manga/themes/dark/assets/css/united.css
Origin: https://weloma.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: "5f716b71-466c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 18028
x-xss-protection: 1; mode=block

GET
H2 200 fontawesome-webfont.woff2
weloma.net/app/manga/themes/dark/assets/fonts/ 75 KB
76 KB 168ms
168ms Font
font/woff2 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: weloma.net
URL: https://weloma.net/app/manga/themes/dark/assets/css/font-awesome.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://weloma.net/app/manga/themes/dark/assets/css/font-awesome.min.css
Origin: https://weloma.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: "5f716b71-12d68"
x-frame-options: SAMEORIGIN
content-type: font/woff2
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 77160
x-xss-protection: 1; mode=block

GET
H2 200 01_5f4b238283a05.jpg
s4.ihlv1.xyz/images/20200830/ 263 KB
264 KB 177ms
56ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200830/01_5f4b238283a05.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db419f6b2d7358b95a9bfc1bce5fe05fabb67c40960585f10bf76b970576476b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 69859
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 269352
pragma: public
last-modified: Sun, 30 Aug 2020 03:56:50 GMT
server: cloudflare
etag: "5f4b2382-41c28"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FjNAUm%2BtR6XpsnYIRaP%2B4o2XZRAk4MOcrxnZstt4rdc%2Fph7wirTSL2mFJgIb9hEsIBqpw%2BPue3dG2WvvTa%2BPQ%2FHpWAPAYQAtXOEPp7mQBv2Y9kHlPTziX80yLSHY7CjTbczxSGcqFHBfDcA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746cdc3757-MXP
expires: Sat, 29 Jan 2022 16:35:05 GMT

GET
H2 200 5f3f447286dd9_5f3f448406f00.jpg
s4.ihlv1.xyz/images/20200821/ 262 KB
263 KB 216ms
96ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200821/5f3f447286dd9_5f3f448406f00.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2bd0c539416fddac683785d2dcbeb722e1fa8252a644e4dab1c94105eaf597f

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63620
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 268614
pragma: public
last-modified: Fri, 21 Aug 2020 03:50:28 GMT
server: cloudflare
etag: "5f3f4484-41946"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BV89kjh6hetxnWq9QNmFIj2cBX8ScPLw0eosMsr1BTHF0KAgi5iEVVXIY8QHWSX14WFsFTQRcfd0Oj2HqwHuOC5I7gYpYs0BbvICswFAPh3%2FzoQKDYfnWiJhw9xhZuRQl9KbVXYCJrZ%2Boxo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746ce23757-MXP
expires: Sat, 29 Jan 2022 18:19:04 GMT

GET
H2 200 5f92723144a0c_5f9272321fc04.jpg
s4.ihlv1.xyz/images/20201023/ 273 KB
274 KB 223ms
103ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20201023/5f92723144a0c_5f9272321fc04.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a09e20c8716187a9792a8e7d268b2ac3ce7503ce0ca9978312df2f50a0aa0222

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 18420
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 279820
pragma: public
last-modified: Fri, 23 Oct 2020 06:03:30 GMT
server: cloudflare
etag: "5f927232-4450c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KtLInKCv3vRCo17a89f3RuZrFgh%2Fu48TKUJfcnyR0gvDWfa%2B45FFEy0m7ne%2Fedw6ZWSpN%2FEVSOHDDZppGV4EgicNAoRrRiUXuB6mtyfTwyddP%2F%2B0%2FiDTSWKevG9VsgOe10pvfGmDqkjHCXY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746ce33757-MXP
expires: Sun, 30 Jan 2022 06:52:24 GMT

GET
H2 200 60383eca674f9_60383ecd08775.jpg
s4.ihlv1.xyz/images/20210226/ 125 KB
125 KB 223ms
103ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210226/60383eca674f9_60383ecd08775.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3526c0af0630086c2f21d305adb89ae59af8c5304cd05199076b6bea113859b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 74820
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 127743
pragma: public
last-modified: Fri, 26 Feb 2021 00:20:29 GMT
server: cloudflare
etag: "60383ecd-1f2ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yrrfkO8KXdR5W2Oqmj1G%2Fgd8vgVik8rn1hHx6UwKtUXfHfS%2FjgPlBSMlz606%2F%2BS%2FhOQG6cob%2BElAI17b%2FwRWy0HSTpHuRel%2FddJboU3dwxf9cAJmAK9Rc%2B8nK6MsK39BATF2Vm11zYFljnk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746cdf3757-MXP
expires: Sat, 29 Jan 2022 15:12:24 GMT

GET
H2 200 i_0003_61483c2c0c4ff.jpg
s4.ihlv1.xyz/images2/20210920/ 202 KB
203 KB 224ms
104ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20210920/i_0003_61483c2c0c4ff.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99e777e80fcc0d060924e1a69d7ef4ab5d88cc394bcbea22fac53bf63f721253

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 74820
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 207346
pragma: public
last-modified: Mon, 20 Sep 2021 07:45:48 GMT
server: cloudflare
etag: "61483c2c-329f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WxNvMPlmH6PmJqorLX8JPJfmUjsdY6dBIYZK4ElH5DNXR1i9BUnzsx61zIETUTudhG7AtM1y2gCzrW%2BmOWJlBArGXLAHaBnonNWiBo%2BSAxmBEyI%2BGOPi64LeMnAlQKBpy9bTuGhQZsOfAec%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746ce43757-MXP
expires: Sat, 29 Jan 2022 15:12:24 GMT

GET
H2 200 6155831d7f97f_6155831e4a49e.jpg
s4.ihlv1.xyz/images2/20210930/ 233 KB
234 KB 224ms
104ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20210930/6155831d7f97f_6155831e4a49e.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c31bd16b62f611c4c3fa2cace99392803e3701a29efb882c7fc5510417fe8c6e

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78788
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 239046
pragma: public
last-modified: Thu, 30 Sep 2021 09:27:58 GMT
server: cloudflare
etag: "6155831e-3a5c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4A5YstoxZIJZHuVPFB8DE9i%2Bm3f4Qy0C1pAUA52qTzQAt7U4Y7nQyLwvrcuxPnyLshtjs2Fckxa4vf8GCapTXLo0NPxFF%2BHv6g6FF4OTaxrGEuY1JLXe3vvN%2BTSxDOIWTX32Y9Fmv98ZeM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d0e3757-MXP
expires: Sat, 29 Jan 2022 14:06:16 GMT

GET
H2 200 600dba85c4bac_600dba879b7df.jpg
s4.ihlv1.xyz/images/20210125/ 142 KB
142 KB 223ms
103ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210125/600dba85c4bac_600dba879b7df.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e0b895e2cbe2b3a1b30a73471a98fc69a0dd34c2f00381d00b1068021fdffed

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 69859
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 145023
pragma: public
last-modified: Sun, 24 Jan 2021 18:20:55 GMT
server: cloudflare
etag: "600dba87-2367f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DhLHEIzEcTNGAttdT%2BfOu5ExtpJOndXM5iY0w3jm4a%2BtSOvesD%2FA%2BkIaFEtSX9BPlspTURHYy65Vw7RLPsiibWpIqyVZ%2BsIbHgqehQfLmsA4zmvMkd%2FmwF%2BXsT7AK2z2fs97OgfE72oltAI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746ce03757-MXP
expires: Sat, 29 Jan 2022 16:35:05 GMT

GET
H2 200 68037_61a94af15eac7.jpg
s4.ihlv1.xyz/images2/20211203/ 132 KB
133 KB 223ms
103ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211203/68037_61a94af15eac7.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c78e15c68842dfcb6508238b1abace76357fee0bfada1e17b220011627165cfa

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2466662
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 135250
pragma: public
last-modified: Thu, 02 Dec 2021 22:38:41 GMT
server: cloudflare
etag: "61a94af1-21052"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nn4HqcsB4YgrXUDPElN8iRHBSUjnRsBvJwfWqVEBS98nu0L%2FRkH9a1XtUCgKLMULagN4IWJ%2Foe%2FocsYWNTcdx%2Bahtemcpah%2Bdk2prW8z1NUbBgY4%2BAccHjMqXfGiJdXDSoHVz0Ej%2FnOzVs4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746ce13757-MXP
expires: Sat, 01 Jan 2022 22:48:22 GMT

GET
H2 200 03_61cb3007c9a43.jpg
s4.ihlv1.xyz/images2/20211228/ 224 KB
224 KB 223ms
102ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211228/03_61cb3007c9a43.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7623d45938446785775170c323d1cca1439e4d38a52a89fc55b822072e7c893b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 245709
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 229026
pragma: public
last-modified: Tue, 28 Dec 2021 15:40:55 GMT
server: cloudflare
etag: "61cb3007-37ea2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=61unw20oVIqDxwsNItBPLt4yDiBdlYSsWLtEjXecdUsuwnq4RtM3zCz%2FQPod14zzfIVTuccxUtf5JuGys6HWsIv2hOcKJ2F8zPBZOu0cFoKjBrglaoltWLhsgWH7uL761jRAx2PjbEwCFIk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357746cdd3757-MXP
expires: Thu, 27 Jan 2022 15:44:15 GMT

GET
H2 200 5f2f9303962f6_5f2f930400617.jpg
s4.ihlv1.xyz/images/20200809/ 231 KB
232 KB 90ms
86ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200809/5f2f9303962f6_5f2f930400617.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8677c7b5ded643e5ff01d3b8e47ba23404529235ecff2b2d5dcac19b3a127460

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4513
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 236834
pragma: public
last-modified: Sun, 09 Aug 2020 06:09:08 GMT
server: cloudflare
etag: "5f2f9304-39d22"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=62EFAU3ZmpT3e%2FDtt7DusPLpSv6uALBEmXg%2F88l3xxCHszrpjmDVUccEpa1M0uUH9FxYt3MFdSgtyJElJGFnTQiXfSdEHyeBK4SeNnnmcRpDwBTS4i382RuupqS5JJ963El%2FMGIOTYmNI3o%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d113757-MXP
expires: Sun, 30 Jan 2022 10:44:11 GMT

GET
H2 200 5f4b1ded441b7_5f4b1dedf0362.jpg
s4.ihlv1.xyz/images/20200830/ 321 KB
321 KB 91ms
87ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200830/5f4b1ded441b7_5f4b1dedf0362.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13e09007573be6c501777f19774e91f40a834704821c41513d32df3bc434e130

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4513
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 328246
pragma: public
last-modified: Sun, 30 Aug 2020 03:33:01 GMT
server: cloudflare
etag: "5f4b1ded-50236"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ua2qgk5l%2BtAPkafVbPaBIP5vM%2FGAkeA%2BGQWOQQWftvqtY53KrvD4CEICXiJdCg6uA8thvkiFbI9vbJJbxvjGki2BU8RnMnYVYCFWqZsgiaG93aJWPq2z14b6%2BtGe%2BOkKVcHNsDIM0XgOawg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d193757-MXP
expires: Sun, 30 Jan 2022 10:44:11 GMT

GET
H2 200 5f7fe81cd800c_5f7fe81d80c6c.jpg
s4.ihlv1.xyz/images/20201009/ 218 KB
218 KB 92ms
87ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20201009/5f7fe81cd800c_5f7fe81d80c6c.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b668e8212a187ba3b0d12f6ba08723ebab9546ea92f3281ce921064c54410efa

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 222866
pragma: public
last-modified: Fri, 09 Oct 2020 04:33:33 GMT
server: cloudflare
etag: "5f7fe81d-36692"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hxo%2Fv7UlD2M8w9JbTADSYNoBs3bovV4sOpZ0Rxvt5QTWnZWdYhXl%2FFuIDyx2Qz4R77xwaErLn8N12leMtdFSaOyBeR83oy0pqTOdYNCzJz5Z8S1nZYm1Gxm9ldAoLhgVH2dYPH1VFvWOIlw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d1a3757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 whoso3H.jpg
i.imgur.com/ 124 KB
124 KB 54ms
53ms Image
image/jpeg 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/whoso3H.jpg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

2d0c59342063bf09df8310c14ca6aecdb9331e451121025fc4a3eec4dd140296

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
age: 2525542
x-cache: HIT, HIT
content-length: 127022
x-served-by: cache-bwi5128-BWI, cache-fra19122-FRA
last-modified: Wed, 25 Sep 2019 16:58:29 GMT
server: cat factory 1.0
x-timer: S1640951965.818614,VS0,VE2
etag: "1e5512107ece0a817251c7ab5ebb20fd"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 03_5f6da0c390b87.jpg
s4.ihlv1.xyz/images/20200925/ 190 KB
190 KB 92ms
88ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200925/03_5f6da0c390b87.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80220f63ef5aa68592a299e4622f6dfea89db99bd068c731d068c52be384deb6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 194104
pragma: public
last-modified: Fri, 25 Sep 2020 07:48:19 GMT
server: cloudflare
etag: "5f6da0c3-2f638"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6WblPGT0Zc7POcqWIP9SQdN6EVU95JpzdbHuXP62VkaKk8opum6CN6XaYwFIJfNZedzgVcalt7b3BQuW0hEozYvLejWgxvOJUqkDSmMOx00IMuDGbnIBzKyN6JrB2NVyoXi3HNr1rxAsQUw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d1b3757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 604bad2d0d374_604bad2e20496.jpg
s4.ihlv1.xyz/images/20210313/ 9 KB
10 KB 91ms
87ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210313/604bad2d0d374_604bad2e20496.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 497619a0f83506281130cde2f1387df44ea4a5f3b33b5fed66f4d5c33e755fe6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9591
pragma: public
last-modified: Fri, 12 Mar 2021 18:04:30 GMT
server: cloudflare
etag: "604bad2e-2577"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M5yGAg%2FcFl%2FVOwNLeKHCtst3FENxGGcZvPU6Hqr%2BSuITH%2FAcKiEPGbz7bGugh93xoLE2WBG7%2BxrRauhAKb%2FUo9lNKJriNru7I%2Btq0KiOPS1McDh5%2B50%2FE%2FTc%2Fuq1rR0PTHOfasnxU2uwMXk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d1c3757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 02_6185ffbf60141.jpg
s4.ihlv1.xyz/images2/20211106/ 285 KB
286 KB 92ms
88ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211106/02_6185ffbf60141.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c6a0bce5277fd960bf9a736c0f4f3d9ffc8d48d14037bac6f58f45c2b2dffdd

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 291748
pragma: public
last-modified: Sat, 06 Nov 2021 04:08:31 GMT
server: cloudflare
etag: "6185ffbf-473a4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yhMDs8gLByq0BjUHMvo1gck16jgFS2NoIEqkWEWS%2FrdaSfowDY4Yx028S%2BgGUSH4tvuoddLY60%2FhpaX9EaPdnrEJwzbvgGzpahtvYs4b1xtbY3U0sDaRDlOgGqtZICwkMUvZSyk%2BqJ1u3yY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d1d3757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 5f2395db25aba_5f2395dc91d8f.jpg
s4.ihlv1.xyz/images/20200731/ 45 KB
46 KB 91ms
87ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200731/5f2395db25aba_5f2395dc91d8f.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a25307657189b22d39260c8d1a989aec64c30f52b3a4a277dce67939982a28e3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 46413
pragma: public
last-modified: Fri, 31 Jul 2020 03:54:04 GMT
server: cloudflare
etag: "5f2395dc-b54d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bzbx553ecAmk%2B3SeEByNHgFy4f0LnzfHVDd5exojfBIfgVL149Z%2FTXCWL0c1aEPdtLKuBx%2BjVt9epB4cQt4IwE6pTyK4p7706U1FsMIQIESHEry4GbnyPebAndiztFmSGiGgJrwPG934%2F8k%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d1e3757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 IJHQw01.jpg
i.imgur.com/ 241 KB
241 KB 33ms
32ms Image
image/jpeg 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/IJHQw01.jpg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

5e3498906ec77635a97041002b9db20c7e40f322b2a29216180ae7d5cf0a3292

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
x-content-type-options: nosniff
age: 3729384
x-cache: HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 246949
x-served-by: cache-bwi5167-BWI, cache-fra19122-FRA
last-modified: Sat, 08 Feb 2020 01:08:39 GMT
server: cat factory 1.0
x-timer: S1640951965.818641,VS0,VE2
etag: "01b19aeba6d13c8a284b875ac498e18f"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 5f2cca6058991_5f2cca60af98d.jpg
s4.ihlv1.xyz/images/20200807/ 82 KB
82 KB 93ms
89ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200807/5f2cca6058991_5f2cca60af98d.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba922c68c5a6b6dc2cba494cf621508aac36bbd7f0dd57586cc6f53e43884c14

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 83937
pragma: public
last-modified: Fri, 07 Aug 2020 03:28:32 GMT
server: cloudflare
etag: "5f2cca60-147e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2BfVIDGzV%2BR9S1Stic345VIa6qHK1FD3hxJv4y5Nnz%2BD8IkocVcCzDy7DV%2FgAJKoK%2BFvxr1fo31N6gxDri7wYOkMCkX4hh%2BirN%2BxmQAVWXASIkliadvPz0Gr6jFnx9SdXuI9u1iSSvuAgTQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d1f3757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 5fdfed1c93c0d_5fdfed1ed557b.jpg
s4.ihlv1.xyz/images/20201221/ 14 KB
15 KB 92ms
88ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20201221/5fdfed1c93c0d_5fdfed1ed557b.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb2389ed31742bdf7af557be19fd0196f618de13f9a2c0e6f311eea0387b6f99

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 18024
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 14745
pragma: public
last-modified: Mon, 21 Dec 2020 00:32:30 GMT
server: cloudflare
etag: "5fdfed1e-3999"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sdNyMtCg6cFAMyFu5Sels37uNOoiiQT0gFpUj0nB0HwQcF8HBSQAZUg8j8GkSm6yeSed0LdiY2TWOg2v%2BPLuDis%2B7tnbevjqbrjvcg9K4apykcGIYwrGsf4z6Q412MI8z4QiBUTy1F%2B8i%2Fw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d213757-MXP
expires: Sun, 30 Jan 2022 06:59:00 GMT

GET
H2 200 5f2d41fa33eea_5f2d41fe95da1.jpg
s4.ihlv1.xyz/images/20200807/ 601 KB
602 KB 92ms
88ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200807/5f2d41fa33eea_5f2d41fe95da1.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c195d2467e70309e1a76b5a621c06bf596a63d48b50db46e9f66723600e40c42

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 615541
pragma: public
last-modified: Fri, 07 Aug 2020 11:58:54 GMT
server: cloudflare
etag: "5f2d41fe-96475"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLGRU4f3qpQTpoDBN7NKjKBQvgJ2%2BQtjOpZ0kJ20XB2gE4lFhNVqODun3%2Funa8pu0HP3gsNsJpS8ONVKtwKgyTRBrhdy7OrbBXOpZn77csOI3tb0yRWKp0zNrosJgqCiSk0IVUr7JEbXjgk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d223757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 5f326adb9dacc_5f326ae029129.jpg
s4.ihlv1.xyz/images/20200811/ 304 KB
305 KB 95ms
91ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20200811/5f326adb9dacc_5f326ae029129.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9154003d9a197d0fc2124bb5da55332886d4127d74010e35be3fa0b3127aa6a1

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 18024
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 311493
pragma: public
last-modified: Tue, 11 Aug 2020 09:54:40 GMT
server: cloudflare
etag: "5f326ae0-4c0c5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gqrPVhDq0pxJFP%2B0K1WnA4K6etyqGLidqB2DFQjcg9VFJ6WrLHF049kTh9H4Rn2%2Bfyse72wTx2Vz4G5E4JiRbJ1OF1xBxEpTQbHK3SqKN4CeoTpMgFbtQ8msv%2F1jlzR66ktVPvH7o8TCiBo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d233757-MXP
expires: Sun, 30 Jan 2022 06:59:00 GMT

GET
H2 200 607aaafa69087_607aaafb93468.jpg
s4.ihlv1.xyz/images/20210417/ 85 KB
85 KB 93ms
89ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210417/607aaafa69087_607aaafb93468.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fd4e69cd34dc11ad285bf1326df83bf380fbbaaa541070e8ca2218ea2dc1366

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22309
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 86577
pragma: public
last-modified: Sat, 17 Apr 2021 09:31:39 GMT
server: cloudflare
etag: "607aaafb-15231"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XujMf4BGwysafFFcZeGfLMjYaqHv1J7h%2FbjT5OJJA%2F6RXnTtHaCRwsrvQrA5A76ShFqc4v34l0qBvpZhXLW%2BGd%2Fvkd06egi0wdXl1YlwF1iU6X%2F5TZapqDIU8kqT9P5jVKQnXpcZeC%2F%2BsKk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d243757-MXP
expires: Sun, 30 Jan 2022 05:47:35 GMT

GET
H2 200 69604_61b30a31c74a9.jpg
s4.ihlv1.xyz/images2/20211210/ 145 KB
145 KB 93ms
89ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211210/69604_61b30a31c74a9.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d75131f62d93435d89a15d2574809d056411b82f9a9e02fb10fc67e07a9849ff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 18024
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 148010
pragma: public
last-modified: Fri, 10 Dec 2021 08:05:05 GMT
server: cloudflare
etag: "61b30a31-2422a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=568obhO9Jm4OPCNCBlZk0hOJrf8iRWynZquFS3Iu%2F%2B6Uf%2Bq5JC4SQfO14pr9KbRBaSACirhkQBwiln5EGsbqu9rzNTVVsIWqSglwubmtaikt%2BsphbnbpGOtsw%2FbCOiVjltOATDaE0RG1Obo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d263757-MXP
expires: Sun, 30 Jan 2022 06:59:00 GMT

GET
H2 200 61776e4c9a1d1_61776e4e22bc7.jpg
s4.ihlv1.xyz/images2/20211026/ 112 KB
113 KB 92ms
89ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211026/61776e4c9a1d1_61776e4e22bc7.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 998e700f457f74d9ea3cc31e774543b55413c8895e4e350c1f84a93309d20899

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25297
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 115029
pragma: public
last-modified: Tue, 26 Oct 2021 02:56:14 GMT
server: cloudflare
etag: "61776e4e-1c155"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rrk%2F6l%2B%2FsnBn6Y%2B%2F5sHw7ZBx18Pa2re90%2BpkJg8RogI9Wu3k%2FOy6ocbjEzW5qQmr%2FU5Tb0pSRuc%2FVh6c5P5hvU4pzSO4z4BqnoVslJP5QrDeGfzO%2Flsx7RmSpw%2FqYrRKvT9WsAMWqKwB2k8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d273757-MXP
expires: Sun, 30 Jan 2022 04:57:47 GMT

GET
H2 200 605d52c0a3eca_605d52c29fa80.jpg
s4.ihlv1.xyz/images/20210326/ 80 KB
80 KB 95ms
91ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210326/605d52c0a3eca_605d52c29fa80.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebc6433cb2e141c8b2d9134d40992ba1fe437574d90aa3a022e21762cedc4ad4

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25297
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 81552
pragma: public
last-modified: Fri, 26 Mar 2021 03:19:30 GMT
server: cloudflare
etag: "605d52c2-13e90"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qATzqfrf4UP15i9r0w7iEJSPeZtIwwA7ULbZk4Y6GFOhDEYrwu3Ys0ECdEg%2BirLyfo6I%2BUEPDBBAEdxo47lSfMdpeZRZ4tmvsNJj%2FLQpDOfue0qF9ZtEAzjdeXBj0k4B8xwRvv4PW3WDBUA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d283757-MXP
expires: Sun, 30 Jan 2022 04:57:47 GMT

GET
H2 200 6066984ed286a_60669852d88a6.jpg
s4.ihlv1.xyz/images/20210402/ 47 KB
48 KB 93ms
89ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210402/6066984ed286a_60669852d88a6.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 751a9f40a512ed2f3be5df96d86b655fd530b214e6a54e48693c32bcb16adefe

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 623256
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 48543
pragma: public
last-modified: Fri, 02 Apr 2021 04:06:42 GMT
server: cloudflare
etag: "60669852-bd9f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bp%2Bfb93VuTZAHnksm5uyuyXF64a6ciFb5vyNf9GCwk2YdkgrQfsYhoICo1OLB03AX6S6ntfYx85Tsv5lOmRIMYUMlc6Ly5ggo7%2By9C71%2FZf%2Fmi5XudDlJjkAMX%2BszRBZkh5vOb%2F6z8nLT24%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357748d293757-MXP
expires: Sun, 23 Jan 2022 06:51:48 GMT

GET
H2 200 02_614e97ebaf0ca.jpg
s4.ihlv1.xyz/images2/20210925/ 279 KB
280 KB 93ms
90ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20210925/02_614e97ebaf0ca.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d23072c04d211eb83922252cecba4c5ea160e943b4151312e2390c0459122abe

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 26677
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 285662
pragma: public
last-modified: Sat, 25 Sep 2021 03:30:51 GMT
server: cloudflare
etag: "614e97eb-45bde"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cf64uijQZruqKQgoBBKAdgJOLmnXt8b48%2BJyzp%2B3EwBRZfGNcrTDIl03Jo9dgl2j7eIWUGArIq8prb3AryXVfXYMch1N0Gm4LUGOOSw2RF2n%2BwY9A%2BR8gYdE2ZJlJ72TBIy7Ap4VNTHnXUg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d2a3757-MXP
expires: Sun, 30 Jan 2022 04:34:47 GMT

GET
H2 200 6003d364dc55e_6003d365c56a1.jpg
s4.ihlv1.xyz/images/20210117/ 214 KB
215 KB 93ms
90ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210117/6003d364dc55e_6003d365c56a1.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d74b9408159c96b8806613e3ba4214a117a5ba7609ab312da3f9fdf9d2d09ce

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 26677
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 218976
pragma: public
last-modified: Sun, 17 Jan 2021 06:04:21 GMT
server: cloudflare
etag: "6003d365-35760"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WKPIR%2BIMXg2n%2B%2B6O4tuiw4SMOnnhaFvOiQbiGovcd3RhyKiGbSkjmmMp1NlA9GrnHcjf00wtO5GT8nDxZXbQB9gtwgo6lln0G%2FS1akgRzL4Itu1Oa06zKq0GYuMbTt50DZ0ESXZGN%2FFiLgk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d2d3757-MXP
expires: Sun, 30 Jan 2022 04:34:47 GMT

GET
H2 200 f175b7c80fad2705bea411912f48cfa14937652.jpg
ihlv1.xyz/images/20200703/ 253 KB
254 KB 178ms
63ms Image
image/jpeg 2606:4700:3038::6815:ea8f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ihlv1.xyz/images/20200703/f175b7c80fad2705bea411912f48cfa14937652.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 368a3ec56bf53062dd5441b05f7ee2fd2f08df1f4171cea107552a64bac78865

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 26677
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 258647
pragma: public
last-modified: Fri, 03 Jul 2020 07:02:15 GMT
server: cloudflare
etag: "5efed7f7-3f257"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KCZPf%2FxTDSeJB3mxE7%2B52X3rnxRF47TQHnX81jDjaYix23nIQr4E9x%2BlNtYy20rZoqltPD0K6JDVNmkPTcbalLSAopJ2OnBRNaRWusZI80PF8e7i0mViWNzTkmgjpkCzLpqZyUImCNI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c635774d92f3745-MXP
expires: Sun, 30 Jan 2022 04:34:47 GMT

GET
H2 200 5f8ac1dc721c0_5f8ac1de6539c.jpg
s4.ihlv1.xyz/images/20201017/ 13 KB
14 KB 94ms
90ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20201017/5f8ac1dc721c0_5f8ac1de6539c.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1028284104e59ce88909fceb65e8c190df8eda40b9f6b7f39beec2a6e7cb1b21

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27769
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13677
pragma: public
last-modified: Sat, 17 Oct 2020 10:05:18 GMT
server: cloudflare
etag: "5f8ac1de-356d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e9HVzsErfXatm8276eCK2EpWaVJwgGfJ13%2FgtRHYBDsXw%2BSZBvQ%2FFskqXneHHQCyuR9T7pqRMIo2H90uo0YjlgQgxzuEnzlzGAjtWZVWdLiq8Oun2xbsSFcqUw0WCe74X2xJ82Ko23F0Apk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d2f3757-MXP
expires: Sun, 30 Jan 2022 04:16:35 GMT

GET
H2 200 6048dc1867757_6048dc19e965b.jpg
s4.ihlv1.xyz/images/20210310/ 58 KB
59 KB 94ms
90ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210310/6048dc1867757_6048dc19e965b.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14520c9f8483045b69f49fd6aa05a0c3111b547a95e847b8647389d3acb8f65b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 28096
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 59560
pragma: public
last-modified: Wed, 10 Mar 2021 14:47:53 GMT
server: cloudflare
etag: "6048dc19-e8a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7LJohEhIfYGuu9AXe0BOEqBc28Ea%2Bo2J2Y7DuYJm2btk%2F2ylARwdmv8lLhOeDG%2FQvFS9RlQ7SINJbTcOUplbnphWDkfMEMpVYPKfVp4d0xhydrag0y7TNTAg8Yb2Ehl1iX2TvuDC7UThVM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d323757-MXP
expires: Sun, 30 Jan 2022 04:11:08 GMT

GET
H2 200 605d56619ed30_605d5663209d5.jpg
s4.ihlv1.xyz/images/20210326/ 80 KB
80 KB 94ms
90ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images/20210326/605d56619ed30_605d5663209d5.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f94bfd35414caf79e45a9fb5d5f55edd7b3b1a8504627f0f810194da716382b0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 28096
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 81925
pragma: public
last-modified: Fri, 26 Mar 2021 03:34:59 GMT
server: cloudflare
etag: "605d5663-14005"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YErDYs34izEykxDzbmr0RN74C38qgZMvvR2cnhFsEru%2BG7W7M52Yfl%2BkIFLcuzb7J50GKVOYsx4nys7o4JOY3EOxUIyuqfVrgphDx7a74MEE87FlFPYKXCV3KAmxgmI4fF%2FPG88QGYXqRqg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d333757-MXP
expires: Sun, 30 Jan 2022 04:11:08 GMT

GET
H2 200 61bca4b797960_61bca4b8d48ae.jpg
s4.ihlv1.xyz/images2/20211217/ 114 KB
114 KB 96ms
92ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211217/61bca4b797960_61bca4b8d48ae.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5e423d2f99acf00cfe2440b2b7e03dd30e5b683366a5d558f0554b6d27855f3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 18024
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 116441
pragma: public
last-modified: Fri, 17 Dec 2021 14:54:48 GMT
server: cloudflare
etag: "61bca4b8-1c6d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DuxcZ0K7LIaRIbmM9RzqNG45nb%2F3E84RSN0IHG3Ypl6m5r1JhJc5HJCWN%2Ff7c2kKCeTgRZ7ma0lJFAH2UNLZUjW3tY%2BwIQsnc64PO3oiVKqFGPesCACVaNjlHgNhQbMpg%2B7%2FAvtLzyqCLq4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d353757-MXP
expires: Sun, 30 Jan 2022 06:59:00 GMT

GET
H2 200 no-cover.png
weloma.net/app/manga/themes/dark/assets/images/ 7 KB
8 KB 137ms
136ms Image
image/png 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://weloma.net/app/manga/themes/dark/assets/images/no-cover.png

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

9f7ac07304646e9b951d9ba6e522ffb76cdda3581f96e009fdbc66154b0e27cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/wem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: "5f716b71-1dd6"
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 7638
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 61cdb00a1b911_61cdb00aa0903.jpg
s4.ihlv1.xyz/images2/20211230/ 243 KB
243 KB 94ms
91ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211230/61cdb00a1b911_61cdb00aa0903.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b28be3c74dee7db1938fc64bd7e7e9750a12561ec82ebbde09e6c20d27d308fa

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78788
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 248427
pragma: public
last-modified: Thu, 30 Dec 2021 13:11:38 GMT
server: cloudflare
etag: "61cdb00a-3ca6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=seLuaoCtpOM%2Ft08ac3QFDZ9zbRmZ7%2B6AMlllt%2BqNeXqR%2B1f6wYKWAu%2F5cR7ev4up680jX4wKQyaG0DRbEa%2FfoYxlQublzkdStYqSx4xXUOGlist9atnLilD8i8fI76RXKGesnO4qZk6rtEc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d393757-MXP
expires: Sat, 29 Jan 2022 14:06:16 GMT

GET
H2 200 006_61cdaeda2c445.jpg
s4.ihlv1.xyz/images2/20211230/ 137 KB
138 KB 95ms
91ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211230/006_61cdaeda2c445.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab6ab520df1a13ee44dbe64ad753d5fa8d592b6bb7b18f67f637297c5dfbc2aa

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 81928
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 140449
pragma: public
last-modified: Thu, 30 Dec 2021 13:06:34 GMT
server: cloudflare
etag: "61cdaeda-224a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qD8IkFYhsMrc3bBD5vJviWwkaKgPpgg8MdWeUW2l2VLAyAPaLlxMI3VMrA2orDtE0uTkY8gnTHHB2yM4LWz3sWg6pFidPVbMborfLJ5Gim4VRwPBq9wDjLoKO9ch%2F1e4%2B%2FEvIpmKQ%2BgPiMY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d3b3757-MXP
expires: Sat, 29 Jan 2022 13:13:56 GMT

GET
H2 200 61cb34b921856_61cb34bae8cc0.jpg
s4.ihlv1.xyz/images2/20211228/ 206 KB
207 KB 95ms
92ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211228/61cb34b921856_61cb34bae8cc0.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4510b1a2986c80230b967251a3fdc561f227b2c32ab1f45edc77e78f96e955f5

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 243918
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 211358
pragma: public
last-modified: Tue, 28 Dec 2021 16:00:58 GMT
server: cloudflare
etag: "61cb34ba-3399e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KoDge0cZKp0VVtRIHKRzAB7xUhwWW%2FiI%2FEkPByKENcek4oQ9stNtpsNYT11ra3lWJpxhN24w5rnwR%2BM9HFiViS9pqLGGNZnaFesCOTfO%2BvI1hZWlcqPs%2FWGsW0yxUE91EFB5GUsB15dodDc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d3c3757-MXP
expires: Thu, 27 Jan 2022 16:14:06 GMT

GET
H2 200 61cb311641acc_61cb3117b310f.jpg
s4.ihlv1.xyz/images2/20211228/ 198 KB
199 KB 110ms
106ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211228/61cb311641acc_61cb3117b310f.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1771f460f6261d943b48bf566018612e3251cd748a28efcb35d60fcd8bcb2c71

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 244809
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 202985
pragma: public
last-modified: Tue, 28 Dec 2021 15:45:27 GMT
server: cloudflare
etag: "61cb3117-318e9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3CKRPoxslYeTXswOPRplv8nAsQX2hJpnQx4o13Zk7mdYzpYzCWcmcVxRE8Datm3bI8A6ihzHBaeN%2FrOlw3aDtG1m%2F3x4eXD58yIA2l6x0ZtsFYyQcr%2FsXr%2FPlAMSCAA5mSKXqbahKKqbfwY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d3f3757-MXP
expires: Thu, 27 Jan 2022 15:59:15 GMT

GET
H2 200 61cb097a98176_61cb097b513c0.jpg
s4.ihlv1.xyz/images2/20211228/ 51 KB
52 KB 95ms
91ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211228/61cb097a98176_61cb097b513c0.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 455891874254da5288f726e30558ae353c155bafd3c55cc7aee33f1705812af3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 253587
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 52412
pragma: public
last-modified: Tue, 28 Dec 2021 12:56:27 GMT
server: cloudflare
etag: "61cb097b-ccbc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=114vuGlV%2Fnz8xS5MQ31TYM%2FKG%2FQGSh3MPDcAp08PDTT9VuUUmzZKeGu5E2ZxblGuK5fzsTpaZ2pMj8l0gvgPzojwecBxoktMUec8qWejfZyWyREuEprdbC6S8jvzrvyYlYiG7GvsaX%2BjT%2FM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d403757-MXP
expires: Thu, 27 Jan 2022 13:32:57 GMT

GET
H2 200 57943_61cb0925bc92c.jpg
s4.ihlv1.xyz/images2/20211228/ 148 KB
149 KB 95ms
92ms Image
image/jpeg 2606:4700:3038::6815:ea8e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.ihlv1.xyz/images2/20211228/57943_61cb0925bc92c.jpg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea8e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d410f8d2ac3bf9dc5059db5bcd93ef50fee9aa54008b630ef283463b6ff9ac6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 253587
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 151999
pragma: public
last-modified: Tue, 28 Dec 2021 12:55:01 GMT
server: cloudflare
etag: "61cb0925-251bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lti%2BgZ2GpUKdLK0JQmdJbn5e6jipwC%2BbuFkGhcFNVEVepTkqu4fWqSsXjgcGu3HKHZBpeWYb%2BSj2M087TfYrHuSlWjHYTmINYoFnBFKNQyWj7%2FrLBFqSSAgs23viJdTom2CzNR69%2BaBaEWM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6c6357749d413757-MXP
expires: Thu, 27 Jan 2022 13:32:57 GMT

GET
H2 200 bebas.ttf
weloma.net/app/manga/themes/dark/assets/fonts/ 31 KB
32 KB 137ms
137ms Font
application/octet-stream 185.242.104.48
FISHNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://weloma.net/app/manga/themes/dark/assets/fonts/bebas.ttf

Requested by

Host: weloma.net
URL: https://weloma.net/app/manga/themes/dark/assets/css/united.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.242.104.48 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

3ea88f24c7c571c864b9e38b6af290a9749bf26220f45a68a4e674a5c8dde110

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://weloma.net/app/manga/themes/dark/assets/css/united.css
Origin: https://weloma.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Fri, 31 Dec 2021 11:59:24 GMT
last-modified: Mon, 28 Sep 2020 04:49:53 GMT
server: nginx
etag: "5f716b71-7dbc"
strict-transport-security: max-age=31536000
content-type: application/octet-stream
cache-control: max-age=2592000, public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 32188
expires: Sun, 30 Jan 2022 11:59:21 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 109ms
29ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-205473142-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3498
date: Fri, 31 Dec 2021 11:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 31 Dec 2021 13:01:06 GMT

GET
H2 200 pubads_impl_2021120601.js Show response
securepubads.g.doubleclick.net/gpt/ 348 KB
117 KB 41ms
40ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119476
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 09:34:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 291 B
168 B 82ms
42ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=weloma.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75ab93a2f142474e7ad3195f3f68738dd98b78c82a44e6ffe47c3c571a2464f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143
x-xss-protection: 0
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/ 276 KB
99 KB 102ms
55ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5970742391268812&plah=weloma.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5970742391268812

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1037f1e0d1ae470df705a7179a41aa2c969aec5ff56771a7438edc74fc46a9f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101736
x-xss-protection: 0
server: cafe
etag: 6975236974516728872
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/ Frame 91B2 11 KB
5 KB 119ms
33ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5970742391268812

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 30 Dec 2021 18:37:20 GMT
expires: Thu, 13 Jan 2022 18:37:20 GMT
content-type: text/html; charset=UTF-8
etag: 17731914101004188133
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4884
x-xss-protection: 0
age: 62524
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 78 KB
27 KB 125ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: storage.de.cloud.ovh.net
URL: https://storage.de.cloud.ovh.net/v1/AUTH_4b1b323ce19643f985895cf772add44b/sarsor/lovehug.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c3c5d63a5360b25896019d020ad1e1fedf0a3aa9d1db00a3dbf46daf5ccb398

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1087 / 46 of 1000 / last-modified: 1639397097"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26910
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 31 Dec 2021 11:59:24 GMT

GET
H2 200 adipolo_logo.png
adipolo.com/wp-content/uploads/2020/06/ 7 KB
8 KB 217ms
80ms Image
image/png 2606:4700:3033::6815:2de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adipolo.com/wp-content/uploads/2020/06/adipolo_logo.png
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:2de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b071563c8b59cdc2b12b2703f3b5d147f555b1c41d83e5c5ef4a02395aed89c

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5149
cf-cached-on: Mon, 27 Dec 2021 02:01:24 GMT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7068
last-modified: Tue, 28 Dec 2021 00:12:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9xDFG64yosjjCtBnbGqqc14OTrP%2BVbOQMLsKz3BPttycPlCj%2Bwpk1J%2B71oGqYTjOkEQ%2BpdcZo04G1Du979wlbLCIBc%2Bg72Tzp2A41PiO4v9Ujz%2F0flxbC%2Fho23rGew%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6c63577558f959ef-MXP

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 76ms
37ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1532115371&t=pageview&_s=1&dl=https%3A%2F%2Fweloma.net%2Fwem&ul=en-us&de=UTF-8&dt=WeLoveManga%20-%20Read%20Manga%20Free%20Online%20Hight%20Quality&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1837573703&gjid=1124901611&cid=287651425.1640951965&tid=UA-205473142-1&_gid=530548206.1640951965&_r=1&gtm=2ouc10&z=1052104137

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://weloma.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hbw_master_323303_10647.js Show response
player.aplhb.adipolo.com/prebidlink/455819/ 258 KB
34 KB 174ms
73ms Script
application/javascript 45.133.44.4
ATT-INTERNET4

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aplhb.adipolo.com/prebidlink/455819/hbw_master_323303_10647.js
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/wrapper_hb_323303_10647.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.4 Philadelphia, United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software: nginx /
Resource Hash: 5c150c17ba5f64c3c00beed7602c7db5609dac323851c12b50393f982eecc756

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
last-modified: Wed, 29 Dec 2021 13:38:35 GMT
server: nginx
etag: W/"61cc64db-40706"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600
expires: Fri, 31 Dec 2021 12:59:25 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 214 B
415 B 138ms
73ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=weloma.net&callback=_gfp_s_&client=ca-pub-5970742391268812

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5970742391268812&plah=weloma.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e6ebd2e6e79b364e8b6372e1ea4010db2d8ba6751857eb9044d9d11deda0672

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 203ms
71ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=weloma.net

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 210ms
72ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 107ms
106ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fweloma.net%2Fwem&tn=SECTION&id=rd-side_icon&ign=false&pw=1600&ph=1200&x=1575&y=1175

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 106ms
105ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fweloma.net%2Fwem&tn=DIV&id=header&cls=navbar%20navbar-inverse%20navbar-fixed-top%20navbar-responsive-collapse&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2705 0
19 B 179ms
100ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5970742391268812&output=html&adk=1812271804&adf=3025194257&lmt=1640951965&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fweloma.net%2Fwem&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1640951964841&bpp=2&bdt=549&idt=195&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=982503030237&frm=20&pv=2&ga_vid=287651425.1640951965&ga_sid=1640951965&ga_hid=1532115371&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530529%2C44750774%2C31063859%2C31062931&oid=2&pvsid=2179918186621210&pem=244&tmod=380&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=208

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 31 Dec 2021 11:59:25 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 31 Dec 2021 11:59:25 GMT
cache-control: private

GET
H2 200 avcplayer.js Show response
player.avplayer.com/script/2/v/ 242 KB
58 KB 358ms
70ms Script
application/javascript 2a02:26f0:ef::5f65:4d5b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.avplayer.com/script/2/v/avcplayer.js
Requested by: Host: tg1.modoro360.com
URL: https://tg1.modoro360.com/api/adserver/spt?AV_TAGID=6086ba97c979b40b712ace46&AV_PUBLISHERID=60095c900c0799791c46d8d4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ef::5f65:4d5b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 88d34d768fff67e23429eef90f0221bfb514aa59a013560d2a3286f2c6ea4534

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycduS1V5w_6ZXbMaZIgKJUiYFW9UhAY7DOcBC0yzdZwH23B6LrOalcwwmB2mbc28rCM9S0MELJxGa95OSmp9A5HE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
content-length: 58932
last-modified: Wed, 01 Dec 2021 07:43:20 GMT
server: UploadServer
etag: "2a52a4eea594d28a4782b234215c3e57"
vary: Accept-Encoding
x-goog-hash: crc32c=uDNYqQ==, md5=KlKk7qWU0opHgrI0IVw+Vw==
content-language: en
x-goog-generation: 1638344600242304
cache-control: public, max-age=300
x-goog-stored-content-length: 58932
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 31 Dec 2021 12:04:25 GMT

GET
H2 200 track
servt.modoro360.com/ 0
71 B 567ms
117ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?pid=61522ae545833a0b2b769c04&cid=61708778bf7dc912731d1596&cb=1640951965078&r=weloma.net&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&e=playerLoaded
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 config.json Show response
player.adtelligent.com/exchange_rates/313490/ 9 KB
4 KB 255ms
61ms XHR
application/json 45.133.44.3
ATT-INTERNET4

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/exchange_rates/313490/config.json?cb=https%3A%2F%2Fweloma.net%2Fwem
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software: nginx /
Resource Hash: b7792f297f7c4447e3cf81c5cb77552f95eeeddc3616a04040a0dd21a590149c

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
last-modified: Fri, 31 Dec 2021 00:02:13 GMT
server: nginx
etag: W/"61ce4885-222b"
content-type: application/json
access-control-allow-origin: https://weloma.net
expires: Fri, 31 Dec 2021 12:59:25 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H3 200 index.html Show response
protagcdn.com/check-bot/ Frame 5F32 666 B
1 KB 322ms
148ms Document
text/html 2606:4700:20::681a:68e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://protagcdn.com/check-bot/index.html
Requested by: Host: protagcdn.com
URL: https://protagcdn.com/s/weloma.net/site.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:68e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5750bf6f0303d627d6631306fefe70c371a772bb21e58760fb28ffb13b586896

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-type: text/html
last-modified: Tue, 31 Aug 2021 15:11:08 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
expires: Wed, 12 Jan 1980 05:00:00 GMT
vary: Accept-Encoding
pragma: no-cache
access-control-allow-origin: *
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xOE9hwanWlvvEMws7SXHTc5MSQ%2Bi3PmoK96y5z9KURMhB335gaCxhnr6t6SrXpmevRiRZRGHQvYAAL5YR0REYc3jkYRQKyLfsK6B5TGBHhtxuArn%2Bz9e70%2FuMYFu2J4V2j388MeNalCL8ro%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6c635777fb5b59bf-MXP
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H/1.1 200
OK / Show response
ghb.aplhb.adipolo.com/geo/ 142 B
388 B 408ms
44ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.aplhb.adipolo.com/geo/
Requested by: Host: player.aplhb.adipolo.com
URL: https://player.aplhb.adipolo.com/prebidlink/455819/hbw_master_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: a4bca02b5d2958ea8734f1d14ad3c8329f28d1d7567595af8c7fd68986c0f87f

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://weloma.net
Date: Fri, 31 Dec 2021 11:59:25 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive
Content-Length: 142
Content-Type: application/json

GET
H/1.1 200
OK tracking Show response
ghb.aplhb.adipolo.com/adunit/ 43 B
414 B 405ms
42ms XHR
image/gif 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.aplhb.adipolo.com/adunit/tracking?event=11&type=0&client_id=323303&site_id=10647&full_page_url=https%3A%2F%2Fweloma.net%2Fwem&adid=ucfjtu.sq&features=0&vpbv=N040&lifecycle_tte=2243
Requested by: Host: player.aplhb.adipolo.com
URL: https://player.aplhb.adipolo.com/prebidlink/455819/hbw_master_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://weloma.net
Date: Fri, 31 Dec 2021 11:59:25 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 j.html Show response
p.jcontentcdn.com/prebidlink/18992/ Frame E554 1 KB
879 B 391ms
19ms Document
text/html 45.133.44.3
ATT-INTERNET4

General

Check archive.org

Show headers Download Go to

Full URL: https://p.jcontentcdn.com/prebidlink/18992/j.html?i=11595
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software: nginx /
Resource Hash: cf35c9e8af47d8cd7233bebf1b785af16546782547f31501432cb7ad97d84714

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-type: text/html; charset=utf-8
server: nginx
last-modified: Wed, 16 Sep 2020 14:50:15 GMT
etag: W/"5f622627-434"
cache-control: max-age=3600
content-encoding: gzip
expires: Fri, 31 Dec 2021 12:59:25 GMT
access-control-allow-origin: *

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 16 KB
9 KB 368ms
368ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2179918186621210&correlator=1008928218708884&output=ldjh&impl=fifs&eid=31062931&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211231&iu_parts=162717810%3A282468209%2Cweloma.net%2Cin_content&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=468x280%7C336x280%7C320x100%7C320x50%7C300x300%7C300x250&prev_scp=env%3Dprod%26site%3Dweloma.net%26referrer%3D-%26protag_env%3Dprod%26protag_page-url%3Dhttps%253A%252F%252Fweloma.net%252Fwem%26utm_campaign%3D-%26utm_source%3D-%26utm_medium%3D-%26utm_term%3D-%26utm_content%3D-%26protag_segment_20m%3D35%26protag_minutes%3D59%26protag_hours%3D11%26protag_day%3D5%26protag_native%3Dnative%26protag_enable_native%3Dtrue%26pa_upr%3D0.00%26protag_upr%3D0.00%26protag_opt_u%3D0%2CX%26protag_proSlotId%3Dprotag-in_content%26excl_cat%3DPREPOST&eri=1&cookie=ID%3D770a9a7b9ca4a162-2281b28c12cd0014%3AT%3D1640951965%3ART%3D1640951965%3AS%3DALNI_MbjXk5fewKEdpPJMjLfYzSAn73c_w&bc=31&abxe=1&lmt=1640951965&dt=1640951965297&dlt=1640951964292&idt=634&frm=20&biw=1600&bih=1200&oid=2&adxs=371&adys=761&adks=87696662&ucis=1&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fweloma.net%2Fwem&vis=1&dmc=8&scr_x=0&scr_y=0&psz=723x0&msz=723x0&ga_vid=287651425.1640951965&ga_sid=1640951965&ga_hid=1532115371&ga_fc=true&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4675ac65c9c7668c884d8978d76b1514a6050bc2fb37100ac9a7caf1e491117c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9248
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://weloma.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F141 6 KB
4 KB 342ms
46ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 31 Dec 2021 11:59:25 GMT
expires: Sat, 31 Dec 2022 11:59:25 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ 216 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41c8460c9c718fb0e8c275b7baa9083f5477ec0919bab552ef952ecee74c567b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK favicon.ico
storage.de.cloud.ovh.net/v1/AUTH_4b1b323ce19643f985895cf772add44b/js/ 15 KB
15 KB 57ms
57ms Image
image/x-icon 145.239.139.16
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.de.cloud.ovh.net/v1/AUTH_4b1b323ce19643f985895cf772add44b/js/favicon.ico
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 145.239.139.16 , France, ASN16276 (OVH, FR),
Reverse DNS: ip16.ip-145-239-139.eu
Software: /
Resource Hash: fb20da3761f50927006a6f6303ae6fceec0b3cb5f4c532ba5845bcd5392112d8

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:25 GMT
X-Openstack-Request-Id: txba50ad31fbea49a785841-0061cef09d
Last-Modified: Sun, 31 Jan 2021 12:57:34 GMT
X-Trans-Id: txba50ad31fbea49a785841-0061cef09d
Etag: 7bf4f6782dee3b520a65ff84286e3691
Content-Type: image/x-icon
X-Timestamp: 1612097853.12655
Accept-Ranges: bytes
Content-Length: 15086

GET
DATA 200
OK truncated
/ 480 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee9a49aae5d1fc7602361ae5c6d69fc8eb128d007b4dee67d42ce19bbf2c87e0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 AVmanager.js Show response
player.aniview.com/script/6.1/ Frame AE4E 365 KB
103 KB 212ms
56ms Script
application/javascript 2a02:26f0:6c00:28a::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/v/avcplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:28a::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: afcee61ffa77c766763143e934d9ea4ab0fbb86e65b5fca2bf8e72fb8cf980b4

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycduC1-gRo3R35jJPqQPRccbYy-1ZeiVB7183PcZ-xNcLED12un-WADMuA-QGjkQ5pZqE3TtrSvfGhfoDy8LcH-E
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
content-length: 105203
last-modified: Wed, 15 Dec 2021 08:26:56 GMT
server: UploadServer
etag: "3faeddaf733d543bb1aa15327b216609"
vary: Accept-Encoding
x-goog-hash: crc32c=WLqW6Q==, md5=P67dr3M9VDuxqhUyeyFmCQ==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1639556816117989
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 105203
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 31 Dec 2021 12:04:25 GMT

GET
H3 200 api.js Show response
protagcdn.com/cdn-cgi/bm/cv/669835187/ Frame 5F32 35 KB
9 KB 52ms
52ms Script
text/javascript 2606:4700:20::681a:68e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://protagcdn.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Host: protagcdn.com
URL: https://protagcdn.com/check-bot/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:68e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://protagcdn.com/check-bot/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4UmjvgruyAzkrrMf8lfhA%2B%2B70LpQo6%2FO9F9rsjh36KFyfOUSWcZSAX5bMnoNXpCSHGUH3wcdtTCu7hzn5igopgxoFoqn8RBz%2Bx3aR3uV8YxPyNJOr1V2Q9%2F2BS26ymntE1iEow2Z5ZaCEUQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
cf-ray: 6c6357795e7059bf-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

OPTIONS
H2 200 openrtb
adx.adform.net/adx/ Frame 0
0 171ms
38ms Preflight 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://weloma.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Fri, 31 Dec 2021 11:59:25 GMT
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://weloma.net
access-control-max-age: 86400
allow: POST,OPTIONS
cache-control: no-cache, no-store, must-revalidate, no-transform
expires: -1
pragma: no-cache
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
172 B 161ms
51ms XHR
text/plain 185.184.8.65
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.65 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-65.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://weloma.net
date: Fri, 31 Dec 2021 11:59:25 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
344 B 451ms
237ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://weloma.net
date: Fri, 31 Dec 2021 11:59:25 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 133
vary: origin, Accept-Encoding

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
515 B 86ms
26ms XHR
application/json 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.20.0
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 8bd75be6af8ea705f861e0562a11a821d09df1b2109b967bb78e804e5f7a5b52

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 31 Dec 2021 11:59:25 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://weloma.net
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 98ms
29ms XHR
application/json 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://weloma.net
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
285 B 155ms
99ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=bX9srg4dmr64KsaKjGFx_2
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 8a2624fcb33d24027e2535135c67551112a0a23942b01149bb80e15747fb31e7

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://weloma.net
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 567 B
627 B 258ms
44ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: c900c7efbdf55959469de71896fedca923f5ac9b421ac98d2993fc46d1326bc9

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 31 Dec 2021 11:59:25 GMT
Content-Encoding: gzip
Server: VertaMedia 1.0
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://weloma.net
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Length: 342

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
211 B 120ms
26ms XHR
text/plain 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=5.20.0&cb=38325885466

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://weloma.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
405 B 145ms
64ms XHR
text/plain 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://weloma.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
357 B 93ms
30ms XHR
application/json 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://weloma.net
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 139 B
815 B 99ms
42ms XHR
application/json 185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

6b5fda62d46188f626b5c01220344ffb6ba5321654216fca1af4bf1bd9c9aee8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:25 GMT
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 36849a20-7650-4d1d-910a-ce1567f84f77
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://weloma.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 139
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ROS Show response
pbjs.e-planning.net/hb/1/2e43c/1/weloma.net/
Redirect Chain

https://pbjs.e-planning.net/pbjs/1/2e43c/1/weloma.net/ROS?rnd=0.4879395526597605&e=728x90_0%3A728x90%2C970x90%2C320x50%2C320x100%2B728x90_1%3A728x90%2C970x90%2C320x50%2C320x100&ur=https%3A%2F%2Fwel...
https://pbjs.e-planning.net/hb/1/2e43c/1/weloma.net/ROS?ct=1&r=pbjs&rnd=0.4879395526597605&e=728x90_0%3A728x90%2C970x90%2C320x50%2C320x100%2B728x90_1%3A728x90%2C970x90%2C320x50%2C320x100&ur=https%3...

661 B
1 KB

25ms
25ms

XHR
application/json

5.178.65.246
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbjs.e-planning.net/hb/1/2e43c/1/weloma.net/ROS?ct=1&r=pbjs&rnd=0.4879395526597605&e=728x90_0%3A728x90%2C970x90%2C320x50%2C320x100%2B728x90_1%3A728x90%2C970x90%2C320x50%2C320x100&ur=https%3A%2F%2Fweloma.net%2Fwem&pbv=5.20.0&ncb=1&vs=FF&crs=UTF-8&fr=https%3A%2F%2Fweloma.net%2Fwem&e_pubcid=d03a2b06-069e-4ed0-9b3f-4928e1801b3e
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Server: 5.178.65.246 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 2d7a19836270b67f78200e8454967b5f5f7fdea5b0a1b494527176f3e3f4091e

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
server: openresty
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-allow-origin: https://weloma.net
expires: Fri, 31 Dec 2021 11:59:25 GMT
cache-control: max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 661
x-sid: AMS-607

Redirect headers

date: Fri, 31 Dec 2021 11:59:25 GMT
server: openresty
access-control-allow-origin: https://weloma.net
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
location: /hb/1/2e43c/1/weloma.net/ROS?ct=1&r=pbjs&rnd=0.4879395526597605&e=728x90_0%3A728x90%2C970x90%2C320x50%2C320x100%2B728x90_1%3A728x90%2C970x90%2C320x50%2C320x100&ur=https%3A%2F%2Fweloma.net%2Fwem&pbv=5.20.0&ncb=1&vs=FF&crs=UTF-8&fr=https%3A%2F%2Fweloma.net%2Fwem&e_pubcid=d03a2b06-069e-4ed0-9b3f-4928e1801b3e
access-control-allow-credentials: true
content-type: text/html; charset=iso-8859-1
x-sid: AMS-607

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
122 B 76ms
39ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=weloma.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 77ms
40ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 38 KB
15 KB 304ms
304ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2179918186621210&correlator=3717254651143712&output=ldjh&impl=fifs&eid=31062931&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211231&iu_parts=21939239661%3A22377873257%2Capl%2Cinter&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ists=1&fas=8&prev_scp=hb_rfBid%3D0&eri=1&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&bc=31&abxe=1&lmt=1640951965&dt=1640951965723&dlt=1640951964292&idt=634&frm=20&biw=1600&bih=1200&oid=2&adxs=-9&adys=-9&adks=2730807981&ucis=2&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fweloma.net%2Fwem&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=0x-1&ga_vid=287651425.1640951965&ga_sid=1640951965&ga_hid=1532115371&ga_fc=true&fws=2&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5408eec7711bdbf1f2f234f88d10174129c5d86f54ca5d206ca05faad8bb074f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14959
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://weloma.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_page_level_ads_2021120601.js Show response
securepubads.g.doubleclick.net/gpt/ 34 KB
13 KB 37ms
37ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021120601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6438deeda87c2438473fc3c887e708b7f23b9c27dbf7df19e2e525f3b299abd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12940
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 09:34:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 31 Dec 2021 11:59:25 GMT

GET
H3 200 container.html Show response
55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C1E1 6 KB
3 KB 68ms
31ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 31 Dec 2021 11:59:25 GMT
expires: Sat, 31 Dec 2022 11:59:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame A1F1 2 KB
1 KB 80ms
27ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=73533313f553633313f593630313&cid=1069&x=4404325371&p=weloma.net&s=weloma.net&adtg=protag-in_content&nci=2101210293&ci=&lon=&lat=&emh=&nai=4404325371&h=280&w=336
Requested by: Host: protagcdn.com
URL: https://protagcdn.com/s/weloma.net/site.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Dec 2021 16:27:27 GMT
server: cloudflare
age: 5038
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6c63577a48587453-LHR
content-length: 1168
expires: Fri, 31 Dec 2021 13:59:25 GMT

GET
H/1.1 200
OK csyncs Show response
ghb.aplhb.adipolo.com/ 572 B
609 B 42ms
42ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.aplhb.adipolo.com/csyncs?aid1=628405&aid2=628406&aid3=undefined
Requested by: Host: player.aplhb.adipolo.com
URL: https://player.aplhb.adipolo.com/prebidlink/455819/hbw_master_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 5e33920d7f1fbf5fa6de9509acc0da78f9d6c63aa301c31e7246ce5650f24933

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:25 GMT
Content-Encoding: gzip
Server: VertaMedia 1.0
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://weloma.net
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Length: 324

GET
H2 200 pbm_307825_11595.js Show response
p.jcontentcdn.com/prebidlink/18992/ Frame E554 32 KB
12 KB 34ms
34ms Script
application/javascript 45.133.44.3
ATT-INTERNET4

General

Check archive.org

Show headers Download Go to

Full URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/j.html?i=11595
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software: nginx /
Resource Hash: fb7caee44299396c0ebc5ccb90b41adb6be999fcbfc4cc13af960f0067a3958a

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://p.jcontentcdn.com/prebidlink/18992/j.html?i=11595
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
last-modified: Wed, 29 Dec 2021 13:46:14 GMT
server: nginx
etag: W/"61cc66a6-7ec6"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600
expires: Fri, 31 Dec 2021 12:59:25 GMT

GET

csync
sync.adtelligent.com/ Frame 28A7
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bdevice_id%7D
https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=facac378-96ae-43df-bb0e-ed043dcedee9

0
0

GET csync
sync.adtelligent.com/ 0
0

GET
H2 204 match
dm.hybrid.ai/ 0
238 B 254ms
81ms Image
text/plain 37.18.16.22
HYBRID-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/match?id=186&burl=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D324902%26extuid%3D%24%7BVID%7D

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.18.16.22 , Russian Federation, ASN205675 (HYBRID-AS, RU),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: *
cache-control: no-cache, no-store
x-mode: 104
x-xss-protection: 1; mode=block
expires: -1

POST
H3 204 result Show response
protagcdn.com/cdn-cgi/bm/cv/ Frame 5F32 0
738 B 57ms
56ms XHR
text/plain 2606:4700:20::681a:68e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://protagcdn.com/cdn-cgi/bm/cv/result?req_id=6c635777fb5b59bf
Requested by: Host: protagcdn.com
URL: https://protagcdn.com/cdn-cgi/bm/cv/669835187/api.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:68e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://protagcdn.com/check-bot/index.html
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qb58hMWpHOgYiETKXQq5dUf2pnMjadNLHuBVA1mcg6CVRvzdrlck8dHQDknoFYERoNKN%2BJdsfE0wJKIHQdgZ3NerJX5yOa%2FjSYibW9SuotKWMpgZsJZ0AYRnIncEPQCRuhOP5p6Q2uolZ%2Bc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 6c63577a891859bf-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H/1.1 200
OK tracking Show response
ghb.adtelligent.com/adunit/ Frame E554 43 B
419 B 146ms
45ms XHR
image/gif 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/adunit/tracking?pubbid=0&event=11&full_page_url=https%3A%2F%2Fweloma.net&adid=12043e7c8e0a03&vpbv=M055&client_id=307825&site_id=11595&lifecycle_tte=547
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://p.jcontentcdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://p.jcontentcdn.com
Date: Fri, 31 Dec 2021 11:59:25 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK / Show response
ghb.adtelligent.com/geo/ Frame E554 142 B
395 B 145ms
44ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/geo/
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: a4bca02b5d2958ea8734f1d14ad3c8329f28d1d7567595af8c7fd68986c0f87f

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://p.jcontentcdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://p.jcontentcdn.com
Date: Fri, 31 Dec 2021 11:59:25 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive
Content-Length: 142
Content-Type: application/json

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3289 624 B
297 B 41ms
39ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNXcOcch4YOzYy7vQ6J5pHEn8cn1mmyI_wjy9iMZOyYKWlnfilb9cGEWcYjZZeNNuGC7asb1s06pWSCE_M2J1g2dTcvg1Gy466zpa0wRl2YrILA7vJF3MvRlCnl2Eerux4sAcxWz5Ph5cXlmfVZFHQNM0EZEfejfMG9-W7H99RDDIFi1kjyhNd9svp0cp6ih_wn8F5COnVZqEEZDAUP8PH_SD7yxNg

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 31 Dec 2021 11:59:25 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C1E1 76 KB
30 KB 80ms
78ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B0n_G1-ZFItieiNZzcNWls_CR5zH9AuTqtl2hlPNCErYRXU2ZyF2DcbUWzPUHbOZn-9bNB4xyTTnbe7_rfwud3kEx-irW9bbBOniA-Jf4AZFOG3glCJ1sunCpngh7RoSF5OytaUGWOxBlrPuLAzVMJYkNhnQ&dbm_d=AKAmf-DrSf2D_0w4T6oD62NTlTpnv-7JScKnRu_vPztwqwxkJ0qsmQTVjWMgkiS-hmKN9AWzSCbCMx6sxu5m-0CAZpysjfooyjcawcRP_hsoNkHoMqk7LVp_S1oztpeJqcjEwAqqTvwl9JmtYHHvHy8AvPdPipKa-pLmwteYrMCUKMumxeh92e5Sos11vy9TgBxnnrozRXt1eq58R89fm1p3M3i1jfohN6zmRdy7jTqperFNADvsy83sfcxlL-FTjbts1bMe1P8ZOLhqmNxkFgCfl4GepDVi9WMDjkxZbrMl_FgCFXriLUIYsweK7XFZwXM-2upMl578aTwZN504qP6P4kBD0Q_cyqooEbXEKgndrCk1Iex0tzYf1IwJilu3lNtSzYqoqmCYoUEyLczVljL_RGXWB-2uvFb7NcNhLdxjB_HrE4DbakcHIAr4cLEs4rl5O6aotHEqAoL4rKhQjIVTrn8okDbkL_niMJgTDoMusA-pg5IqF5rqRpm51tOiesnWW9p_HNyeSmyR8ujap5FvaTysWQmSsD_YUZAOZN_0-GYd7cuhkZml-eo5kO951WolKvaYKbt26Fr1DTxwKZaAyjhj08K9fobRCbm1SUWdecWZdjim0SYt0kuPILdz-b7eHDT7Pvk4mNbRmtD2xF_C3Xw6nAnFkn8pP2rqtr3A-R8fjrCOt4NudKS-VCIZmYg-EOm1ndgdjQkDMsHAXOoY9gTY1s_PdF05e4wS_YYCoC4-d0oaGLN8p42zZz7ppBYA-Jc_j5MinkWIqNXnXoBUNRgmDpZB7PcPvi4wO8FMnGKjPdQXen1lcHEJe0TZy351hjWa3gK6YSrJvzrmj-0AApu6czU7s7U-H0jP2Mg1uXhqrGpmtuz_8jyJkgcFnxzZnK0v5Es9GHtGtpSuUMql1qEJnOg81d73qiJNV0tgh_1pf-t230RBBd2_vPX15Z5M67MQsXmYG22X9XTklu_K6fMbQ4_ix8o7NTA5U70euPOg2PNSD0WUV5xOeTBVdclxD5_xt2N_l2KnmWNjiW9Rz6YNciDNToIWy3H0MB0vIV61P7_tb-CtBdCUKEOzJo2N5q51sMfdm3KY_lr06EWTrESjZfVk2RMe2yjqyxOT6eKMlSpO1xcchgzIB2wZnVAfwAOMFZFkTLyGo78xPsL5Rw1_7ZVuEn9VCtCQTQaYKg5_ib209qYo_8tljuuSChMDraMv7_cC1Y5uQW9UYdNdK3RL6qGBeCyt8QzQCg9LDldHqMJiW2GgCiVw2I_nIIWgpQ18dAHBHADSJbZKL1cKb0zs1d1s6YRkukd6yD8NG-o5ZK7u8BBSGapDO8ebbEAM0MZdq0BaMoGblw-v9_7Coel9rX1wYaUVGObe3TVSQBmgxRItQH2eL0EXU6hTWCq5p5s3EeB0kEsBUe1XJ_7vEJOjwiJCscnWTD9HHZohxOVtc3rSXW0WoReg9xlxeZxj0tnONEpgB_bI5N3UMrdw16pAzNKQp3NarH2SOQXeFtpDSEVRFFrFxsHU9OJ8At_opNIkD-w6ae_gsUP7zk935uj8kf2gXJoaQa5WUq9uCDvDQwLSNxwACRvwQ5nKlBtmEHPKHPJlh_PgGDLqtW_PTB_Gy7fkP2g7jy7n9x22Xke5r9Lh9QjoAmV0Alah8NtEi3fIOS27rCkXsnqyGG7mJTJE77Y5-ZBqFyzv1OWoQEzKEY4U7g_sF4SHzedLpzsXlRpNxtIZo2xmixrruQKaLK_cNa7RtqsKHptwm3Q7g7Y_hyT3O4aM5tnIaSwwcKXAsCqyzhn5LOkg6AVS9PJae4siUFFyVQ9StUNe6XySTzh-ho679TNbevuvZCCYKeuX0S__i9M7lnhNULmj3JDwMNMZ4pZn5fPUaBRtN5WpUSZtTlxO5gD3mchy1hcKeU0ZX9wJGuZhOzhHt28Tug9zgPVWtCOyL0kSpg1vI2JjJU5Ys7IBWoPMlKmwVCHAsUxKEgKDkqUF69RUn2z8eJ537VCyJSszLIU4DmLZV85CUn53b5p3BNUVJdh1U0-1DD00MGmLOWLmyqskIRFvzT_MxPBk0iwx-y3Fzy7EhAJhRbCepR36mxTx2vGVLgX46aVDriHLg4Gj-YBIBlezkd7Lmf7zqiZEtOdtfglLFrPaLjy2ElqAhc9GyKN6uwrS9cAF0h11FXCLqvG4WEKLJWWyIBvnq_3ytidIP7xPXkNrZLA5qA6CUw4lEImUzQ_Ek8sbPgWGl6EH7TWR6spTNIDisUJOibcjOGG-2Ma2ehd10OqXsBOs3mSnMf37QDPCIYOV6dbDwz2plFM58HTpUc5lYmkYcPGWgESts_0U6lE8_CI9lBSsIjWSn8EC7-YfS98P0Jo8s7mWr3U431pA5rrk-hcqBHfMF0T3ND9t5WqsnAPbCxWYn4TNawDN-3CUmbInmsvnUgZhhSMIkluGUNrCOS57Pj1JRJz29J2Kl7iqEfYI-13_P3gVp45rZfO_KmkRzQUMT3-GgG-loSNQgTpW0ELmkynAvIf9zUStTibkUzVulGozTAQMQDrH10Z_IBWL-RNV3gLimk7mIN8XiZ1wVIYhSSvQq2eOJD27l_rTqizzQs7HgOV_fgGDQYgLfoylVRbQSfS2Paz0d8L844Hq12nq1wskultA9egHxAf8XaD0ooVW2g-NjJ123ThnZuEQKEkPlxQRzKO7f07_WVZCTFUn-qvtjQGME8uxVJ9oGlDA17VcctvTE3JTVyeHtUWubDywG9ak2zICfLFMFtWVKRRsfHO-DSKT6SpSybYhXVhUHjdRLe8z3X7Y9EcabZMbYVxTlVdwHKbl1lZbzBlZ_4X04ExIKmdnS2d6fDfVdYRLV4iml6O6bqKQoxpup9-GR_FNffn6OuPJ3SQ1ut06Hps5MkLkFHigynwmGfFh87YkPzbs7jrn4oLhqD1PvPqVogfoD7QXGgmIdHJyqxMODfh6Ech9METBPp-h2o_1cu4TMk-YEuiPc4sKJQ6X7gyIoTRqeQkXGThdYDpiZMCCaM82Oos9PjA0MGJO3LKupSy-tJLepkD5VFgp4MGM_QjQ3uKTCKOdZeuOTfi-3HAhaf2VSdqlXg&cid=CAASEuRoQcxAKqcopBW6egxhtnCq7A&rfl=1%2Chttps%253A%252F%252Fweloma.net%252F%240

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c35afbc5fcd68c8c8375e83f315b775538b4aa40774509cfd7a525bd79a2703

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30827
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C1E1 42 B
63 B 63ms
61ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BX2hDgN5k1fuKABq0j47mTpSvCuRcCX2RT7TYtRnAbkpLU5VknPmcWbg2DLM-KqygK84XVMLRqHSgR1sbjsStViGjwHQ3zoeEPZB3jZsLUlr4XyW4

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame C1E1 2 KB
1 KB 108ms
33ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:47:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 730
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:47:15 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C1E1 119 KB
36 KB 76ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 31 Dec 2021 11:59:25 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame C1E1 15 KB
7 KB 104ms
29ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:42:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:42:24 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C1E1 0
0 107ms
37ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQFXuPTAj0PWnbuIgbK_3pugWH43eVhT_AmsSxuo7Z547KbJ4jd3WmddpbrA150AF2mSgvJKvvFrzg2LoIjVrlZbs-QKg
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E554 12 KB
6 KB 109ms
109ms XHR
application/json 185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

nginx/1.17.9 /

Resource Hash

6d21db2e01ac7eddd549682e3b30b45e9ed14f1075ae47f03b54f0badc5ba926

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://p.jcontentcdn.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 31 Dec 2021 11:59:25 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f5abb95e-9350-4be8-937b-898eb0a9cc70
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://p.jcontentcdn.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame E554 0
218 B 26ms
25ms XHR
text/plain 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=31&wv=3.22&cb=85781818556

Requested by

Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://p.jcontentcdn.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://p.jcontentcdn.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

POST
H2 200 prebid-request Show response
onetag-sys.com/ Frame E554 15 B
364 B 30ms
29ms XHR
application/json 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://p.jcontentcdn.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://p.jcontentcdn.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame E554 0
179 B 53ms
52ms XHR
text/plain 185.184.8.65
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.65 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-65.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://p.jcontentcdn.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://p.jcontentcdn.com
date: Fri, 31 Dec 2021 11:59:25 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame E554 301 B
602 B 930ms
104ms XHR
application/json 135.125.163.79
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.163.79 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3190286.ip-135-125-163.eu
Software: /
Resource Hash: 2168a1b6d7f001eea863523b615b1dd93ff388971ed80f83cd639eb4200c0538

Request headers

Referer: https://p.jcontentcdn.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://p.jcontentcdn.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 301
expires: 0

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame A1F1 31 KB
24 KB 27ms
26ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1640951965845&ver1=2.2.3&qid=73533313f553633313f593630313&rnd=n0m1kxy5ykqg&cid=1069
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=73533313f553633313f593630313&cid=1069&x=4404325371&p=weloma.net&s=weloma.net&adtg=protag-in_content&nci=2101210293&ci=&lon=&lat=&emh=&nai=4404325371&h=280&w=336
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Dec 2021 16:27:27 GMT
server: cloudflare
age: 5054
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6c63577a98a87453-LHR
content-length: 24217
expires: Fri, 31 Dec 2021 13:59:25 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3289
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1&C=1

43 B
1013 B

53ms
53ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNXcOcch4YOzYy7vQ6J5pHEn8cn1mmyI_wjy9iMZOyYKWlnfilb9cGEWcYjZZeNNuGC7asb1s06pWSCE_M2J1g2dTcvg1Gy466zpa0wRl2YrILA7vJF3MvRlCnl2Eerux4sAcxWz5Ph5cXlmfVZFHQNM0EZEfejfMG9-W7H99RDDIFi1kjyhNd9svp0cp6ih_wn8F5COnVZqEEZDAUP8PH_SD7yxNg
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 31 Dec 2021 11:59:26 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3289
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yc7wntYvWexiMldam6rABwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1

43 B
893 B

50ms
50ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNXcOcch4YOzYy7vQ6J5pHEn8cn1mmyI_wjy9iMZOyYKWlnfilb9cGEWcYjZZeNNuGC7asb1s06pWSCE_M2J1g2dTcvg1Gy466zpa0wRl2YrILA7vJF3MvRlCnl2Eerux4sAcxWz5Ph5cXlmfVZFHQNM0EZEfejfMG9-W7H99RDDIFi1kjyhNd9svp0cp6ih_wn8F5COnVZqEEZDAUP8PH_SD7yxNg
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 31 Dec 2021 11:59:26 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3289
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBHyelGaELce_E4syDUpgGk&google_cver=1

43 B
1006 B

58ms
58ms

Image
image/gif

185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBHyelGaELce_E4syDUpgGk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNXcOcch4YOzYy7vQ6J5pHEn8cn1mmyI_wjy9iMZOyYKWlnfilb9cGEWcYjZZeNNuGC7asb1s06pWSCE_M2J1g2dTcvg1Gy466zpa0wRl2YrILA7vJF3MvRlCnl2Eerux4sAcxWz5Ph5cXlmfVZFHQNM0EZEfejfMG9-W7H99RDDIFi1kjyhNd9svp0cp6ih_wn8F5COnVZqEEZDAUP8PH_SD7yxNg

Protocol

HTTP/1.1

Server

185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 55da5bfb-3f55-4206-aec5-539d65eda7ce
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBHyelGaELce_E4syDUpgGk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3289
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg2NDYyMzk0MzA1NjMwMjY4OQ%3D%3D

170 B
188 B

80ms
41ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg2NDYyMzk0MzA1NjMwMjY4OQ%3D%3D

Requested by

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a44640c8-1587-41ac-820b-37a2454b5b39
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg2NDYyMzk0MzA1NjMwMjY4OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame A1F1 26 B
305 B 178ms
58ms Image
image/gif 2606:4700::6810:75c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1640951965954&rnd=n0m1kxy5ykqg&ifm=2&uai=2&cid=1069&s=weloma.net&p=weloma.net&x=4404325371&adtg=protag-in_content&ats=0&atf=&nsi=&si=&nci=2101210293&nai=4404325371&pft=0&iip=0&adb=0&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:75c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cf-cache-status: HIT
last-modified: Tue, 28 Dec 2021 16:23:59 GMT
server: cloudflare
age: 3245
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6c63577c2f34839d-MXP
content-length: 26
expires: Fri, 31 Dec 2021 13:59:26 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame A1F1 26 B
89 B 181ms
61ms Image
image/gif 2606:4700::6810:75c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1640951965937977&ver=1.2r81&qid=73533313f553633313f593630313&p=weloma.net&s=weloma.net&x=4404325371&cid=1069&od1=&od2=&adtg=protag-in_content&nci=2101210293&nai=4404325371&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=n0m1kxy5ykqg&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&w=336&h=280&lat=&lon=&ci=&1=4d40a17eeb0d15981cfbb4227c36c806&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1069&ifm=2&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=0&icp=&irfl=0&irf=&cty=4&fcs=1&flky=ver-fl-6-qid-fl-28-p-fl-10-s-fl-10-x-fl-10-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-17-nci-fl-10-nai-fl-10-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-w-fl-3-h-fl-3-lat-fl-0-lon-fl-0-ci-fl-0-&spfp=1&spfnp=0&sp1=Chromefl_andLinux&sp2=Chromefl_andWindows&adv=0&det=1&adb=0&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=1x1&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_10_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=25
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:75c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cf-cache-status: HIT
last-modified: Tue, 28 Dec 2021 16:23:59 GMT
server: cloudflare
age: 6332
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6c63577c2f37839d-MXP
content-length: 26
expires: Fri, 31 Dec 2021 13:59:26 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 99ms
99ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?r=weloma.net&sn=&ic=0&tgt=0&app=&wi=400&he=225&test=2&d36=6.1.2.92&apppkg=&fv=1&proto=https&pid=61522ae545833a0b2b769c04&cid=61708778bf7dc912731d1596&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&e=inventory&vi=100&cb=1640951965981
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame C1E1 169 KB
59 KB 133ms
30ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
Origin: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 20:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54369
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 Dec 2021 20:53:17 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame C1E1 8 KB
3 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B0n_G1-ZFItieiNZzcNWls_CR5zH9AuTqtl2hlPNCErYRXU2ZyF2DcbUWzPUHbOZn-9bNB4xyTTnbe7_rfwud3kEx-irW9bbBOniA-Jf4AZFOG3glCJ1sunCpngh7RoSF5OytaUGWOxBlrPuLAzVMJYkNhnQ&dbm_d=AKAmf-DrSf2D_0w4T6oD62NTlTpnv-7JScKnRu_vPztwqwxkJ0qsmQTVjWMgkiS-hmKN9AWzSCbCMx6sxu5m-0CAZpysjfooyjcawcRP_hsoNkHoMqk7LVp_S1oztpeJqcjEwAqqTvwl9JmtYHHvHy8AvPdPipKa-pLmwteYrMCUKMumxeh92e5Sos11vy9TgBxnnrozRXt1eq58R89fm1p3M3i1jfohN6zmRdy7jTqperFNADvsy83sfcxlL-FTjbts1bMe1P8ZOLhqmNxkFgCfl4GepDVi9WMDjkxZbrMl_FgCFXriLUIYsweK7XFZwXM-2upMl578aTwZN504qP6P4kBD0Q_cyqooEbXEKgndrCk1Iex0tzYf1IwJilu3lNtSzYqoqmCYoUEyLczVljL_RGXWB-2uvFb7NcNhLdxjB_HrE4DbakcHIAr4cLEs4rl5O6aotHEqAoL4rKhQjIVTrn8okDbkL_niMJgTDoMusA-pg5IqF5rqRpm51tOiesnWW9p_HNyeSmyR8ujap5FvaTysWQmSsD_YUZAOZN_0-GYd7cuhkZml-eo5kO951WolKvaYKbt26Fr1DTxwKZaAyjhj08K9fobRCbm1SUWdecWZdjim0SYt0kuPILdz-b7eHDT7Pvk4mNbRmtD2xF_C3Xw6nAnFkn8pP2rqtr3A-R8fjrCOt4NudKS-VCIZmYg-EOm1ndgdjQkDMsHAXOoY9gTY1s_PdF05e4wS_YYCoC4-d0oaGLN8p42zZz7ppBYA-Jc_j5MinkWIqNXnXoBUNRgmDpZB7PcPvi4wO8FMnGKjPdQXen1lcHEJe0TZy351hjWa3gK6YSrJvzrmj-0AApu6czU7s7U-H0jP2Mg1uXhqrGpmtuz_8jyJkgcFnxzZnK0v5Es9GHtGtpSuUMql1qEJnOg81d73qiJNV0tgh_1pf-t230RBBd2_vPX15Z5M67MQsXmYG22X9XTklu_K6fMbQ4_ix8o7NTA5U70euPOg2PNSD0WUV5xOeTBVdclxD5_xt2N_l2KnmWNjiW9Rz6YNciDNToIWy3H0MB0vIV61P7_tb-CtBdCUKEOzJo2N5q51sMfdm3KY_lr06EWTrESjZfVk2RMe2yjqyxOT6eKMlSpO1xcchgzIB2wZnVAfwAOMFZFkTLyGo78xPsL5Rw1_7ZVuEn9VCtCQTQaYKg5_ib209qYo_8tljuuSChMDraMv7_cC1Y5uQW9UYdNdK3RL6qGBeCyt8QzQCg9LDldHqMJiW2GgCiVw2I_nIIWgpQ18dAHBHADSJbZKL1cKb0zs1d1s6YRkukd6yD8NG-o5ZK7u8BBSGapDO8ebbEAM0MZdq0BaMoGblw-v9_7Coel9rX1wYaUVGObe3TVSQBmgxRItQH2eL0EXU6hTWCq5p5s3EeB0kEsBUe1XJ_7vEJOjwiJCscnWTD9HHZohxOVtc3rSXW0WoReg9xlxeZxj0tnONEpgB_bI5N3UMrdw16pAzNKQp3NarH2SOQXeFtpDSEVRFFrFxsHU9OJ8At_opNIkD-w6ae_gsUP7zk935uj8kf2gXJoaQa5WUq9uCDvDQwLSNxwACRvwQ5nKlBtmEHPKHPJlh_PgGDLqtW_PTB_Gy7fkP2g7jy7n9x22Xke5r9Lh9QjoAmV0Alah8NtEi3fIOS27rCkXsnqyGG7mJTJE77Y5-ZBqFyzv1OWoQEzKEY4U7g_sF4SHzedLpzsXlRpNxtIZo2xmixrruQKaLK_cNa7RtqsKHptwm3Q7g7Y_hyT3O4aM5tnIaSwwcKXAsCqyzhn5LOkg6AVS9PJae4siUFFyVQ9StUNe6XySTzh-ho679TNbevuvZCCYKeuX0S__i9M7lnhNULmj3JDwMNMZ4pZn5fPUaBRtN5WpUSZtTlxO5gD3mchy1hcKeU0ZX9wJGuZhOzhHt28Tug9zgPVWtCOyL0kSpg1vI2JjJU5Ys7IBWoPMlKmwVCHAsUxKEgKDkqUF69RUn2z8eJ537VCyJSszLIU4DmLZV85CUn53b5p3BNUVJdh1U0-1DD00MGmLOWLmyqskIRFvzT_MxPBk0iwx-y3Fzy7EhAJhRbCepR36mxTx2vGVLgX46aVDriHLg4Gj-YBIBlezkd7Lmf7zqiZEtOdtfglLFrPaLjy2ElqAhc9GyKN6uwrS9cAF0h11FXCLqvG4WEKLJWWyIBvnq_3ytidIP7xPXkNrZLA5qA6CUw4lEImUzQ_Ek8sbPgWGl6EH7TWR6spTNIDisUJOibcjOGG-2Ma2ehd10OqXsBOs3mSnMf37QDPCIYOV6dbDwz2plFM58HTpUc5lYmkYcPGWgESts_0U6lE8_CI9lBSsIjWSn8EC7-YfS98P0Jo8s7mWr3U431pA5rrk-hcqBHfMF0T3ND9t5WqsnAPbCxWYn4TNawDN-3CUmbInmsvnUgZhhSMIkluGUNrCOS57Pj1JRJz29J2Kl7iqEfYI-13_P3gVp45rZfO_KmkRzQUMT3-GgG-loSNQgTpW0ELmkynAvIf9zUStTibkUzVulGozTAQMQDrH10Z_IBWL-RNV3gLimk7mIN8XiZ1wVIYhSSvQq2eOJD27l_rTqizzQs7HgOV_fgGDQYgLfoylVRbQSfS2Paz0d8L844Hq12nq1wskultA9egHxAf8XaD0ooVW2g-NjJ123ThnZuEQKEkPlxQRzKO7f07_WVZCTFUn-qvtjQGME8uxVJ9oGlDA17VcctvTE3JTVyeHtUWubDywG9ak2zICfLFMFtWVKRRsfHO-DSKT6SpSybYhXVhUHjdRLe8z3X7Y9EcabZMbYVxTlVdwHKbl1lZbzBlZ_4X04ExIKmdnS2d6fDfVdYRLV4iml6O6bqKQoxpup9-GR_FNffn6OuPJ3SQ1ut06Hps5MkLkFHigynwmGfFh87YkPzbs7jrn4oLhqD1PvPqVogfoD7QXGgmIdHJyqxMODfh6Ech9METBPp-h2o_1cu4TMk-YEuiPc4sKJQ6X7gyIoTRqeQkXGThdYDpiZMCCaM82Oos9PjA0MGJO3LKupSy-tJLepkD5VFgp4MGM_QjQ3uKTCKOdZeuOTfi-3HAhaf2VSdqlXg&cid=CAASEuRoQcxAKqcopBW6egxhtnCq7A&rfl=1%2Chttps%253A%252F%252Fweloma.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:57:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:57:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame C1E1 24 KB
9 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:55:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9516
x-xss-protection: 0
server: cafe
etag: 14328493792227503680
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:55:38 GMT

GET
H2 200 / Show response
serv.modoro360.com/api/adserver/tag/2/ 22 KB
3 KB 422ms
169ms XHR
application/json 54.88.99.244
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://serv.modoro360.com/api/adserver/tag/2/?AV_TAGID=6086ba97c979b40b712ace46&AV_PUBLISHERID=61522ae545833a0b2b769c04&AV_SLOTT=-2&AV_SECURED=1&AV_LANGUAGE=en&AV_URL=https%3A%2F%2Fweloma.net%2Fwem&AV_CHANNELID=61708778bf7dc912731d1596&tgt=0&AV_SUBID=&AV_CDIM1=&AV_CDIM2=&AV_CDIM3=&AV_ABT=2&pce=1&npx=1&AV_DETDOMAIN=weloma.net&AV_DADPOS=1&AV_TAG=6086ba97c979b40b712ace46&AV_TEMPLATE=6049d3f140d88e45f4252456&d36=6.1.2.92&sver=1&avtoken=965980&AV_WIDTH=400&AV_HEIGHT=225&AV_DNT=0&cb=1640951966003
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.88.99.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-88-99-244.compute-1.amazonaws.com
Software: /
Resource Hash: 0c2d8d394d774319a9e5440a409ee97d1fe4b0c0f34c2ca93972dac483dc5a15

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://weloma.net
cache-control: no-cache
access-control-allow-credentials: true
expires: Sun, 19 Dec 2021 22:12:46 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C1E1 41 KB
15 KB 69ms
30ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 14:56:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Dec 2022 14:56:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 952C 1 KB
749 B 30ms
29ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 31 Dec 2021 05:53:44 GMT
expires: Sat, 01 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 21942
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C1E1 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a16218809dbcee5f683ba8e07eedb14a69df8951b17b3d8c8338fddb4c474c8e

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BB1C 6 KB
3 KB 29ms
29ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 31 Dec 2021 11:59:25 GMT
expires: Sat, 31 Dec 2022 11:59:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 952C
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEKVJnFxUXwIVuHdIlimRCvI&google_cver=1&google_push=AYg5qPJXRwGwrRU9PaRNVQYFH0stuGaQDNWSZCZ7l0DdinZXNOtBR7pfuB3QCZnSrf5R9djeuzhAjyDWP9wURdrq_tZFgtPXcQY&r...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKVJnFxUXwIVuHdIlimRCvI&google_cver=1&google_push=AYg5qPJXRwGwrRU9PaRNVQYFH0stuGaQDNWSZCZ7l0DdinZXNOtBR7pfuB3QCZnSrf5R9djeuzhAjyDWP9wURdrq_tZFgtPXcQY...

43 B
424 B

232ms
222ms

Image
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKVJnFxUXwIVuHdIlimRCvI&google_cver=1&google_push=AYg5qPJXRwGwrRU9PaRNVQYFH0stuGaQDNWSZCZ7l0DdinZXNOtBR7pfuB3QCZnSrf5R9djeuzhAjyDWP9wURdrq_tZFgtPXcQY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJXRwGwrRU9PaRNVQYFH0stuGaQDNWSZCZ7l0DdinZXNOtBR7pfuB3QCZnSrf5R9djeuzhAjyDWP9wURdrq_tZFgtPXcQY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6c63577e7ddf83af-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 3672
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6c63577cda4b83af-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKVJnFxUXwIVuHdIlimRCvI&google_cver=1&google_push=AYg5qPJXRwGwrRU9PaRNVQYFH0stuGaQDNWSZCZ7l0DdinZXNOtBR7pfuB3QCZnSrf5R9djeuzhAjyDWP9wURdrq_tZFgtPXcQY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJXRwGwrRU9PaRNVQYFH0stuGaQDNWSZCZ7l0DdinZXNOtBR7pfuB3QCZnSrf5R9djeuzhAjyDWP9wURdrq_tZFgtPXcQY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 952C 0
191 B 84ms
21ms Image
text/plain 66.155.71.149
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEGirXic1mNCPjJGVM3KNwBI&google_cver=1&google_push=AYg5qPILczcAWFojEFmzG1fc4pmq4j0CohBKStiTreE1WGxu8Ufu91TZHQJsyRstRBdtpBj9ZnLr_PnJFQZQShgYr5YHVFcvq5U
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1 403
Forbidden gg_pixel
sync.adaptv.advertising.com/ Frame 952C 14 B
14 B 441ms
91ms Image
text/plain 52.2.183.88
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adaptv.advertising.com/gg_pixel?google_gid=CAESEID3wszxpVbVzEDeenskvTg&google_cver=1&google_push=AYg5qPICBDi9uvq-69Ltge0-Pmf164OyEvxIB-5zvibbA9siEAQqr7-T0lSNxvamFsnR4OayZhCUWlNCkkYEMlv9tOTo6E5oAg
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.2.183.88 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-183-88.compute-1.amazonaws.com
Software: ribs2.0 /
Resource Hash: 0db80e4ae35fcf307507f9ced66fe9ccb3147c1ea12a60ea034092e6aa3ebf40

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Server: ribs2.0
Connection: keep-alive
Content-Length: 14
Content-Type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 952C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEFmy2jIuInCWr9Yx479na8g&google_cver=1&google_push=AYg5qPLnqJH4edZTNnlo3gjvL_9-MFXHhG_72ExjwQy8mL6tG_RxJwPvHZctdcoFp08jdVgNGpe_BNFnI8-0Zko...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ilCquLlcTiZx0AQ6L8V5fMIkbqU&google_push=AYg5qPLnqJH4edZTNnlo3gjvL_9-MFXHhG_72ExjwQy8mL6tG_RxJwPvHZctdcoFp08jdVgNGpe_BNFnI8-0Zk...

170 B
188 B

42ms
41ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ilCquLlcTiZx0AQ6L8V5fMIkbqU&google_push=AYg5qPLnqJH4edZTNnlo3gjvL_9-MFXHhG_72ExjwQy8mL6tG_RxJwPvHZctdcoFp08jdVgNGpe_BNFnI8-0Zko6opn1xDUnAg

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=ilCquLlcTiZx0AQ6L8V5fMIkbqU&google_push=AYg5qPLnqJH4edZTNnlo3gjvL_9-MFXHhG_72ExjwQy8mL6tG_RxJwPvHZctdcoFp08jdVgNGpe_BNFnI8-0Zko6opn1xDUnAg
Date: Fri, 31 Dec 2021 11:59:26 GMT
Connection: keep-alive
Content-Length: 240
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 952C
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENOxdlgHGYUCW2BXIjPpr2Y&google_cver=1&google_push=AYg5qPJlOpGi72ml1U0ywlLpHvGsEblFR7X2olxaNJokjeI1rZikCGgllAS4H2Vwaq4KfZci_VY6jzVd-9PLKwyDV...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENOxdlgHGYUCW2BXIjPpr2Y&google_cver=1&google_push=AYg5qPJlOpGi72ml1U0ywlLpHvGsEblFR7X2olxaNJokjeI1rZikCGgllAS4H2Vwaq4KfZci_VY6jzVd-9PLKwyDV...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJlOpGi72ml1U0ywlLpHvGsEblFR7X2olxaNJokjeI1rZikCGgllAS4H2Vwaq4KfZci_VY6jzVd-9PLKwyDV--JTefK2s4&google_hm=983195b7c0215efb8e5c3c18

170 B
188 B

40ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJlOpGi72ml1U0ywlLpHvGsEblFR7X2olxaNJokjeI1rZikCGgllAS4H2Vwaq4KfZci_VY6jzVd-9PLKwyDV--JTefK2s4&google_hm=983195b7c0215efb8e5c3c18

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 31 Dec 2021 11:59:26 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJlOpGi72ml1U0ywlLpHvGsEblFR7X2olxaNJokjeI1rZikCGgllAS4H2Vwaq4KfZci_VY6jzVd-9PLKwyDV--JTefK2s4&google_hm=983195b7c0215efb8e5c3c18
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 952C
Redirect Chain

https://ads.avads.net/sync/ggl?google_gid=CAESEA2zf52eMGqg_uxE-gbkVRQ&google_cver=1&google_push=AYg5qPKiIl8112BvmLqdJeDuQ4RD7hrmr78gQe2h5T64blmcV5YD36_4gNkIr47cE0cF6RrQaJScLPc3ZWkSA4Yo2Mw2ayK526sk
https://ads.avads.net/sync/ggl?google_gid=CAESEA2zf52eMGqg_uxE-gbkVRQ&google_cver=1&google_push=AYg5qPKiIl8112BvmLqdJeDuQ4RD7hrmr78gQe2h5T64blmcV5YD36_4gNkIr47cE0cF6RrQaJScLPc3ZWkSA4Yo2Mw2ayK526sk&...
https://ads.avads.net/sync/ggl?google_gid=CAESEA2zf52eMGqg_uxE-gbkVRQ&google_cver=1&google_push=AYg5qPKiIl8112BvmLqdJeDuQ4RD7hrmr78gQe2h5T64blmcV5YD36_4gNkIr47cE0cF6RrQaJScLPc3ZWkSA4Yo2Mw2ayK526sk
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NzdkNjA1NzktYzg5Yy00NzczLWFlMzktYWY3NDRkOTY5MGIy&google_push=AYg5qPKiIl8112BvmLqdJeDuQ4RD7hrmr78gQe2h5T64blmcV5YD36_4gNkIr47cE0cF6Rr...

170 B
188 B

42ms
42ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NzdkNjA1NzktYzg5Yy00NzczLWFlMzktYWY3NDRkOTY5MGIy&google_push=AYg5qPKiIl8112BvmLqdJeDuQ4RD7hrmr78gQe2h5T64blmcV5YD36_4gNkIr47cE0cF6RrQaJScLPc3ZWkSA4Yo2Mw2ayK526sk

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NzdkNjA1NzktYzg5Yy00NzczLWFlMzktYWY3NDRkOTY5MGIy&google_push=AYg5qPKiIl8112BvmLqdJeDuQ4RD7hrmr78gQe2h5T64blmcV5YD36_4gNkIr47cE0cF6RrQaJScLPc3ZWkSA4Yo2Mw2ayK526sk
date: Fri, 31 Dec 2021 11:59:25 GMT
x-envoy-upstream-service-time: 4
server: istio-envoy
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 952C 0
12 B 62ms
38ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K_6F8_I88Pzuxn3zhC4OPuN2Uk1-1FpJBUO53N7jIahq8jmU5t2zcFvxt38bJd3cA

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 css2
fonts.googleapis.com/ Frame BB1C 4 KB
1 KB 106ms
38ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 31 Dec 2021 10:10:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 31 Dec 2021 11:59:26 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 84A5 624 B
297 B 43ms
42ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNWhRxA_PTyfcUwudvdok4fR-Zi_98LT4-zCxoE7M0OHPGGK-dpB-AmdB98jF0zBkAzmAiFE80C4hNdaT4s5Ng75DMQZIKRiMgCXc6ZwtRRHTuPz5L8kN981vKoaP66fqrYHu7dNmoEzTF79kto_rF9g_m1AiSBq0McHF1BMw7jlfhnQ6d4

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 31 Dec 2021 11:59:26 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E7BF 81 KB
32 KB 105ms
104ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DEkjlRZ1kVpYbN-MwPNeEJN7BYBaIvc9Xt51em5h2EIx1Rk7eBeZh_nP5tb5TYqH-Ety4RpbBy9fi16qeV7I01REVVNm_SAi2XAReIY275iEo59rKbXIxabiFBshOevDtzzqxzFh06FXSLxfac4r30j2dEzw&dbm_d=AKAmf-DbgQhP6pRi2xS-uwx6rzL6nnYHq6EffG2_0X7qPtaaBdydMOZyHHC3a-GvAy2c7wCYAxqom2Imme2dNFzQ0BKK0vZeCCZDCoj_319580AcCUy9R8g4aWRfX2e0Sw0KOIpJneh07_8wwLny_nyrTSJAgCCn0Md0RyjbK0cFGq7ESQe-NNTIu5a2npAKPneEYbK8LFqDmh1D5tBJY8V1HdHNLIqKkhX3USKbSZIyXvkPYtYQwbe3kOSaBfhX5K1B8K6L3lWMbXf6-0it_ACsJARVhrRtSegfpXk528-GDg0O38AurQnNjC9WWG3OeuTYHkCkRUopX1rJ91aQuLpSuSQLlTf2Kjb2uONkgbTTYGc7QYFQAb8qTPpwWCS4nCZYtwLn8DprRgU3coTE2RhKqN3muGJfSvst7aq34ALzHyvfaoguYg31PBjt65qFP32QqfCmFSRv5nHJ7BIzjIUA8ljrf_TM58ljL-gberhCwnr0C9J4LTY0dJsv4yUve85GtN2kQk2WM9cF8I9VSfFHHZklY9wGsQ1Rn22mPPWG3HDiODaxQz-f3XHYUunmuGn9thO_F5EFA87OU2RKmPkNKo7qZ0DDY9tRZJKqTlMaV3akik_f3lICc8ywzknPWe2COSx7oPjNm6joFvulRo9o71FUiFSEaGEAlUszUApDK_XYZl5vm2hUrl4E29my7gSfmCdt--Jdp9k_Ka51Wd5TP45-7cTpWHdzBsnQlEzCMw-Z2-EVcnPGxMVZotLqNhSrImynBxFyf_wsgSPe6LzyBfQ5MFPdMFV9zOEIezEnQfEjxab5yWKMkIWfsJ7IYe2UgpO3VqikWmrYfQDxF-9jSv6nkO7SJMFTuZknt944c7wGi8uTMkBA6QsWgDqHmsyC8UuT5P2AUpYBefSJDOw_tChND4hnUVmtM_fCwpThYus3wDYSUr84jy48ZgzmoIENxAxYwAEWpA7keDOSadxzjZInLzt9MpT0zXz-KV712Ro40LycTdgCfNTrPd1twjn4qszoIDQZjybChyAavP9h0yf7ABW1YcdiX__6tXZrjzHBoyEg0adlhbW1JTDlwQwJtStI_eVBL0nBlhL8EOUEN9YnpCt5XI248StWVp_idpWTzFfsD5brGCJxnzrMGRRLcvXIw2njtwZ19_Ve33pYFABvajzK-ViCysg97Lz_Jq9tvId8QnYo5Ef0_ImRYUH6lJOYkWkUH1M1_ky9knnvCUabzuZiSoiQslMrtHesOswHeAobMhuDEseS9VB9_MAv3hKhKRwljV8Evk6-3boLJABIQdp9RYKB-c-6HL0pcMEKDg7NJDZKdCFY2-y8Fhc5QO-xKYgZD-1WCpRcqHKFCAGXliCo0VSAp4j0enWB539HlXKq5EcBdiV2b5mp4wcLZdZz23jtAtcxpra8gQwmPjp0e7vr6BRdOT3bZHlnVcFARDQTW1o_In9XAaVmD3JW5-kSMprYGT8G0RtDWyvRf_b51V1UftqkSm8qF1EFKDknHUnJNFMQKu_-LjXDcr3YHYCdwIIyL8NvXQzZTh9_ZxPO3pqtjVUY4OgSLVQCXJjzAfUcbiCtEHgGUQfRrIIrFuDQtSUGBIJ0wzWoK6AUpLTM34GOOsQvRlxbYTB0in7IWPfKAlmBbNcAN_w065-h5UrzKdZJ0kvdlTAW8ZGJaxMZUOyerKjtHlL00zGeZmExAWEkQrVNxJudJTUpEb3i-38paQifufXIRm7VMLLzgQEbMpzQ_kMTngIrX9pJ35W2qdhEZOurAdLCshDRCph_iM8L7JIszePP68LJ-_vWA1tioUxAvu_Qj2XlSK8bI3DMiLkfdoO9aYHr7AsL71_Eg2OydmpHuOn3i08Px5q-6IEqkoQCk8ZizJBF6yK7pcasfIsmn9Mryx2qaxnCQWu698EPPVKtx106cE9HhAYc22kOjGD4rAd_vr3Djiagrce5GMJgVvj2MGTy5lLnUpeX37LryU1Bq6C1XQnYdXXu1RK99-PcS5ctmiY4DxABFYlC50arBopqQgQUyFhVdOeAa6PkZna1UkbaMBIyurqqHeZkhMkU9iovK5KBw_bFl3ocxnfrKtfhkDz5InNgt8BFRMDuKmXePV4YeFTCN1t1UjGWOvWt6R7I5Ka-TsC9T7xgga9OLvmhEeAregYo7xu7OiCKiC2ISD-3yKgbUVBQHziFl5clXLFH1IXqkLK_EwO8rCjb3-p6r5SEcRPMq7O4Lcm0oF4l3a_wq8mBPlGt5dWJtspA-oDpGB5cXgUyNWCljrIaCRTHSFrgGkksjyrf8fEVbbMz_-rf6ySw2M9g2SGvPueYNaKS6A6ZfzvmbXELpWglBhB-JiNT-jHlxUE4SpGUK6_iZkdmEtSonFwppxquBhKWMtlwztewCnDdWVu5fPJnHL6eFzOrqgUGrsJEAeawfuLP5vdBY_lCnD8-FQ51xU9VX6qc0MAEWvV4loc4d4FrEQa3NtjixGLYqMvB2UPqGpUA7sMXiUJocl7Ge9lvSrLXpSj20KmWVK7tegdsYsyjcZiyA3nY-pgcfv0tLK0fqrgo-ber2TiH2nRYD69oZ1O8oyx2WkNl11hPQVG-FwcmGn39VVNF9ZXTQEyzPdf1WWTuRrLqgqMX-3ZPInEqIiK-zJkyCQLA2J-S8G8BbydK6I9y5eQgz4W2ZHmgsrOf-03kGOmfjRMquZ-i4oDm4vf-F9_6O_Q-pMeEZd0Q_RV0SsIv5tcSIIzxMZlqG0-W2CRj5eUamm9dtFnjl3MiixeoN1aJThVStBIaA0tTnr2R3beO-PQlR3rKcsJdDkqHEVjJbxHEE2ykjNbVRJocqeeq3-n74tv18bJeHcKGz-8NejpWfx3PeSylMJrvl9GdWdqJ6RfW3YKd8-uBsQBsRemQYHVFWPAD5mVF9xuTSry7f_TC4H3IyC7clnWan3ndZrrho3KFwc5CisRgdsQR_cgNMFO1ZHBzrALu_6hLCrFrQRZZKdD9OCk8A54I898zsmTB15QjgN3GJImQzSTBSGmqu5Ftxy7uaaWhHQZRD-PrPzI_wX-6Vb3lcRhMUgI3PMHGmGYwXo06w_GSRxF-iXXviajrs4xnM8imiVzAZuaSKJDEHePa5LYWof1Yt00GOFhe2XCOkmJ-uNJz19f09aNm4Qx3FBgIOC39XUsNvEWrEpQwc-q0zQmNEKFqySXMFzO4IqJ_pVyu5eJWov1I1xKDdg&cid=CAASEuRoSbJ0edvpGCec8Vv80mw0Fw&rfl=2%2Chttps%253A%252F%252Fweloma.net%252F%240

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d9ab4b3cb1b00291a778b1ea92166fe46a5a5edb1ad6cfb913a7f69cc39bde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32553
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame E7BF 2 KB
1 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:55:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 240
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:55:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E7BF 119 KB
36 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame E7BF 15 KB
6 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:42:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1022
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:42:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E7BF 0
0 75ms
36ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSL0tfti0Qry_UaNkQ1gFg35e3OTZZun_S6dezITmjQ4mI_-lXBFxcusTQ7G1WIcEDhncTYxOz33_cNlkBrrhaTpEXZkw
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E7BF 42 B
63 B 62ms
61ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BY1G0jp84hWwgDCGBaO7YlHk_8uwzExTQIU91Fi88oMr25TDM_SZrSqDS5EfpNr0oxHfyei87xjoCQQxRP21GUIKGcavkepKp3bF8gccqeIprRuPM

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame BB1C 19 KB
8 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc7731959f24eb86dc0127adfa88c91e71d68b5a0c958dae09aab1b34438256c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:58:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8346
x-xss-protection: 0
server: cafe
etag: 3177319193432224586
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:58:01 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F9DF 22 KB
8 KB 29ms
29ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Tue, 28 Dec 2021 14:56:46 GMT
expires: Wed, 28 Dec 2022 14:56:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 248560
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 58 KB
7 KB 75ms
37ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2a6d65f858e94ba90694d1f9733485bb7789a342ae63b2f4fa6bbefe0da7fd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
expires: Sat, 31 Dec 2022 11:59:26 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C1E1 0
571 B 157ms
73ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJI7wT4clhsmnpOzT52qhPTJohCs6_yg-r2n75vzbshLajBBe_1wTZon_cApGNCFsUMtAgkKdQyx4NjYAaCuJjKygvMFrVxZxpOYchxbBILFJ-A1ScK-ciUVDp4NqV8FAI85meeY_CU1I0o6YFHAuUyznWw9DQA9wAy3FReRT19EVwOTEkKJAk2gzYLaZs06cv6h_e5CkA8gxJkWkVSaPkqncztstp7eZnuy_PPXPfLlQ9s4gKugJBijATiilSDJHyWjnUrUWZlvTYPsWI9GUoDcO_C_MS7uqTHTCZ8b0dfXJQq9gBPbD-nWA-BwfZwL96YF3PPhQaStH40o29heIRSmpNqSKwkSPWDbHBXulRHPTVKC7XbQKJGJLjxbYygsoYiq6oeccYcNmvd8NBFeIff6gzyJlRJTGRE4QQyDw_0ecNCRowSJDBdHFH9CDDA-uYA-n76wproPSfgwP4UpmwGSBGeHROlapJvCee5CYPkXC6uq1NXbOL19k4KE2u2bqxbpWlR3bEOA0uXtzng2irPidXpK4Wf5pBs5j3q1BBPlVuN0wkTxe6W7MjXkZ1L6fWcIw7kXQ1ijDQzjRh_9rhHdBQzeMrW6i3KZHEj9zp4U_bXmiv9eCmL1HrB-_wEUz_6fhjSLGZUa5Ub9SJ2k9KddNXJe15U_rfZRtLUgCOoBD9fUd_0YmbKr8iTFtH5waiZ_xYkQInywX0gjh48zcx5lp6-tu-YXHLrkeo1C1GzA6ni4M5X-91to1nLMUHH6Ixo9eozz-EcJ8JQ7jIdOrTdGelJunN-Qy3YSh5NhjrrrXP8N1dG3Xmk4NAAE7OHEWTke-G-YeqGP0WcUJhog87vfiLifMIUpYsGVFqx2Ul5qea7aac3s8ZrhfxhbvcO9UYaF4ZiyrK12s9h-ZXgx_ucPGF6J-WABlMX4gpOb4NlZYZ21NP-YSoBjDeUdmoKKjnwUc92KV4pxagthwJ_Sjp9PmlO45iOWX5G52Vk3geDd6x3iNbvwaLvcdIfAEXS4kxsyrq_XwAepoL378gYQN6AgYeRNchaXJ4DIIpvfa1Q12ZbAWl7WfJIorPuJjG6_qrflK_g1gh3bVKN4v12jwFLuIkyBDpraeH3afPe49RZwqkAp8BGnk2Fmr-99pJX4CCi1Rie3EbvJE&sai=AMfl-YTqa3ynILEoXHC24z5uCX2YXzG1qyf3Y7orb3eUsjRgGEQ40QOLTovIWKxrvxD7in9wxUCOHbErLoZu-0fvYm-NuRVE25qjJit-RTrCY4fV8mUTTq_KyBVjLb9p8YOjHo53zpMYsjScjjpS7JnAH1S5G3QLpA&sig=Cg0ArKJSzOaBbVgDVLTMEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=211&cbvp=1&cstd=206&cisv=r20211207.34955&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 31 Dec 2021 11:59:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 84A5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1

43 B
893 B

54ms
53ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNWhRxA_PTyfcUwudvdok4fR-Zi_98LT4-zCxoE7M0OHPGGK-dpB-AmdB98jF0zBkAzmAiFE80C4hNdaT4s5Ng75DMQZIKRiMgCXc6ZwtRRHTuPz5L8kN981vKoaP66fqrYHu7dNmoEzTF79kto_rF9g_m1AiSBq0McHF1BMw7jlfhnQ6d4
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 31 Dec 2021 11:59:26 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 84A5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yc7wnm3EVMzVgitt83VqnAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1

43 B
893 B

54ms
53ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNWhRxA_PTyfcUwudvdok4fR-Zi_98LT4-zCxoE7M0OHPGGK-dpB-AmdB98jF0zBkAzmAiFE80C4hNdaT4s5Ng75DMQZIKRiMgCXc6ZwtRRHTuPz5L8kN981vKoaP66fqrYHu7dNmoEzTF79kto_rF9g_m1AiSBq0McHF1BMw7jlfhnQ6d4
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 31 Dec 2021 11:59:26 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEqsVLnZVfOsTvw2A5uCp9o&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 84A5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBHyelGaELce_E4syDUpgGk&google_cver=1

43 B
1006 B

46ms
46ms

Image
image/gif

185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBHyelGaELce_E4syDUpgGk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCk16sBGMvdomkwAQ&v=APEucNWhRxA_PTyfcUwudvdok4fR-Zi_98LT4-zCxoE7M0OHPGGK-dpB-AmdB98jF0zBkAzmAiFE80C4hNdaT4s5Ng75DMQZIKRiMgCXc6ZwtRRHTuPz5L8kN981vKoaP66fqrYHu7dNmoEzTF79kto_rF9g_m1AiSBq0McHF1BMw7jlfhnQ6d4

Protocol

HTTP/1.1

Server

185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cc566f2f-c69c-49b6-9035-b13179e827bd
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBHyelGaELce_E4syDUpgGk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 84A5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg2NDYyMzk0MzA1NjMwMjY4OQ%3D%3D

170 B
188 B

43ms
43ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg2NDYyMzk0MzA1NjMwMjY4OQ%3D%3D

Requested by

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:26 GMT
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 49cf5c1a-5d5c-43cf-9de0-b73eadc47463
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg2NDYyMzk0MzA1NjMwMjY4OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response
pagead2.googlesyndication.com/bg/ Frame F9DF 35 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:24:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13555
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 31 Dec 2022 10:24:41 GMT

GET
H3 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame E7BF 169 KB
59 KB 70ms
31ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
Origin: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 20:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54369
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 Dec 2021 20:53:17 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame E7BF 8 KB
3 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DEkjlRZ1kVpYbN-MwPNeEJN7BYBaIvc9Xt51em5h2EIx1Rk7eBeZh_nP5tb5TYqH-Ety4RpbBy9fi16qeV7I01REVVNm_SAi2XAReIY275iEo59rKbXIxabiFBshOevDtzzqxzFh06FXSLxfac4r30j2dEzw&dbm_d=AKAmf-DbgQhP6pRi2xS-uwx6rzL6nnYHq6EffG2_0X7qPtaaBdydMOZyHHC3a-GvAy2c7wCYAxqom2Imme2dNFzQ0BKK0vZeCCZDCoj_319580AcCUy9R8g4aWRfX2e0Sw0KOIpJneh07_8wwLny_nyrTSJAgCCn0Md0RyjbK0cFGq7ESQe-NNTIu5a2npAKPneEYbK8LFqDmh1D5tBJY8V1HdHNLIqKkhX3USKbSZIyXvkPYtYQwbe3kOSaBfhX5K1B8K6L3lWMbXf6-0it_ACsJARVhrRtSegfpXk528-GDg0O38AurQnNjC9WWG3OeuTYHkCkRUopX1rJ91aQuLpSuSQLlTf2Kjb2uONkgbTTYGc7QYFQAb8qTPpwWCS4nCZYtwLn8DprRgU3coTE2RhKqN3muGJfSvst7aq34ALzHyvfaoguYg31PBjt65qFP32QqfCmFSRv5nHJ7BIzjIUA8ljrf_TM58ljL-gberhCwnr0C9J4LTY0dJsv4yUve85GtN2kQk2WM9cF8I9VSfFHHZklY9wGsQ1Rn22mPPWG3HDiODaxQz-f3XHYUunmuGn9thO_F5EFA87OU2RKmPkNKo7qZ0DDY9tRZJKqTlMaV3akik_f3lICc8ywzknPWe2COSx7oPjNm6joFvulRo9o71FUiFSEaGEAlUszUApDK_XYZl5vm2hUrl4E29my7gSfmCdt--Jdp9k_Ka51Wd5TP45-7cTpWHdzBsnQlEzCMw-Z2-EVcnPGxMVZotLqNhSrImynBxFyf_wsgSPe6LzyBfQ5MFPdMFV9zOEIezEnQfEjxab5yWKMkIWfsJ7IYe2UgpO3VqikWmrYfQDxF-9jSv6nkO7SJMFTuZknt944c7wGi8uTMkBA6QsWgDqHmsyC8UuT5P2AUpYBefSJDOw_tChND4hnUVmtM_fCwpThYus3wDYSUr84jy48ZgzmoIENxAxYwAEWpA7keDOSadxzjZInLzt9MpT0zXz-KV712Ro40LycTdgCfNTrPd1twjn4qszoIDQZjybChyAavP9h0yf7ABW1YcdiX__6tXZrjzHBoyEg0adlhbW1JTDlwQwJtStI_eVBL0nBlhL8EOUEN9YnpCt5XI248StWVp_idpWTzFfsD5brGCJxnzrMGRRLcvXIw2njtwZ19_Ve33pYFABvajzK-ViCysg97Lz_Jq9tvId8QnYo5Ef0_ImRYUH6lJOYkWkUH1M1_ky9knnvCUabzuZiSoiQslMrtHesOswHeAobMhuDEseS9VB9_MAv3hKhKRwljV8Evk6-3boLJABIQdp9RYKB-c-6HL0pcMEKDg7NJDZKdCFY2-y8Fhc5QO-xKYgZD-1WCpRcqHKFCAGXliCo0VSAp4j0enWB539HlXKq5EcBdiV2b5mp4wcLZdZz23jtAtcxpra8gQwmPjp0e7vr6BRdOT3bZHlnVcFARDQTW1o_In9XAaVmD3JW5-kSMprYGT8G0RtDWyvRf_b51V1UftqkSm8qF1EFKDknHUnJNFMQKu_-LjXDcr3YHYCdwIIyL8NvXQzZTh9_ZxPO3pqtjVUY4OgSLVQCXJjzAfUcbiCtEHgGUQfRrIIrFuDQtSUGBIJ0wzWoK6AUpLTM34GOOsQvRlxbYTB0in7IWPfKAlmBbNcAN_w065-h5UrzKdZJ0kvdlTAW8ZGJaxMZUOyerKjtHlL00zGeZmExAWEkQrVNxJudJTUpEb3i-38paQifufXIRm7VMLLzgQEbMpzQ_kMTngIrX9pJ35W2qdhEZOurAdLCshDRCph_iM8L7JIszePP68LJ-_vWA1tioUxAvu_Qj2XlSK8bI3DMiLkfdoO9aYHr7AsL71_Eg2OydmpHuOn3i08Px5q-6IEqkoQCk8ZizJBF6yK7pcasfIsmn9Mryx2qaxnCQWu698EPPVKtx106cE9HhAYc22kOjGD4rAd_vr3Djiagrce5GMJgVvj2MGTy5lLnUpeX37LryU1Bq6C1XQnYdXXu1RK99-PcS5ctmiY4DxABFYlC50arBopqQgQUyFhVdOeAa6PkZna1UkbaMBIyurqqHeZkhMkU9iovK5KBw_bFl3ocxnfrKtfhkDz5InNgt8BFRMDuKmXePV4YeFTCN1t1UjGWOvWt6R7I5Ka-TsC9T7xgga9OLvmhEeAregYo7xu7OiCKiC2ISD-3yKgbUVBQHziFl5clXLFH1IXqkLK_EwO8rCjb3-p6r5SEcRPMq7O4Lcm0oF4l3a_wq8mBPlGt5dWJtspA-oDpGB5cXgUyNWCljrIaCRTHSFrgGkksjyrf8fEVbbMz_-rf6ySw2M9g2SGvPueYNaKS6A6ZfzvmbXELpWglBhB-JiNT-jHlxUE4SpGUK6_iZkdmEtSonFwppxquBhKWMtlwztewCnDdWVu5fPJnHL6eFzOrqgUGrsJEAeawfuLP5vdBY_lCnD8-FQ51xU9VX6qc0MAEWvV4loc4d4FrEQa3NtjixGLYqMvB2UPqGpUA7sMXiUJocl7Ge9lvSrLXpSj20KmWVK7tegdsYsyjcZiyA3nY-pgcfv0tLK0fqrgo-ber2TiH2nRYD69oZ1O8oyx2WkNl11hPQVG-FwcmGn39VVNF9ZXTQEyzPdf1WWTuRrLqgqMX-3ZPInEqIiK-zJkyCQLA2J-S8G8BbydK6I9y5eQgz4W2ZHmgsrOf-03kGOmfjRMquZ-i4oDm4vf-F9_6O_Q-pMeEZd0Q_RV0SsIv5tcSIIzxMZlqG0-W2CRj5eUamm9dtFnjl3MiixeoN1aJThVStBIaA0tTnr2R3beO-PQlR3rKcsJdDkqHEVjJbxHEE2ykjNbVRJocqeeq3-n74tv18bJeHcKGz-8NejpWfx3PeSylMJrvl9GdWdqJ6RfW3YKd8-uBsQBsRemQYHVFWPAD5mVF9xuTSry7f_TC4H3IyC7clnWan3ndZrrho3KFwc5CisRgdsQR_cgNMFO1ZHBzrALu_6hLCrFrQRZZKdD9OCk8A54I898zsmTB15QjgN3GJImQzSTBSGmqu5Ftxy7uaaWhHQZRD-PrPzI_wX-6Vb3lcRhMUgI3PMHGmGYwXo06w_GSRxF-iXXviajrs4xnM8imiVzAZuaSKJDEHePa5LYWof1Yt00GOFhe2XCOkmJ-uNJz19f09aNm4Qx3FBgIOC39XUsNvEWrEpQwc-q0zQmNEKFqySXMFzO4IqJ_pVyu5eJWov1I1xKDdg&cid=CAASEuRoSbJ0edvpGCec8Vv80mw0Fw&rfl=2%2Chttps%253A%252F%252Fweloma.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:57:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:57:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame E7BF 24 KB
9 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:55:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9516
x-xss-protection: 0
server: cafe
etag: 14328493792227503680
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:55:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E7BF 41 KB
15 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 14:56:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Dec 2022 14:56:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4E0C 1 KB
749 B 30ms
30ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 31 Dec 2021 05:53:44 GMT
expires: Sat, 01 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 21942
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 gwdpage_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 55 B
103 B 30ms
29ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 731 B
263 B 30ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdtaparea_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 157 B
144 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdimage_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 281 B
187 B 32ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 24 B
72 B 33ms
31ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdvideo_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 388 B
208 B 34ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdvideo_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e66fb907a79a93d3c9813f2f348b42bd1bf6f3bf140331fe57bc7cc30a816246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 179
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdattached_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 26 B
74 B 34ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9070 5 KB
753 B 79ms
41ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans|Source+Sans+Pro

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4c7ad602f81fcc1cb545b11260b0ee7b03d04cdaedf521e065bb7e4edb8300a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 31 Dec 2021 11:59:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 31 Dec 2021 11:59:26 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 21 KB
6 KB 35ms
31ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c51a4086e332a8b351790a53582dbba5bd78b7a1f021b829d93da3ad59ca575f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 247 B
225 B 35ms
31ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

503621190c75700c18c84fd3ec0977bf31b083d66e331d1009bb9cd17cdb85da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 3 KB
1 KB 34ms
30ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

257c9947bb8a45c4a0519f4ddc8769ecc7f889e268a046b0f05c17dfc7912eee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 8 KB
3 KB 38ms
34ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07b9621ff6886bdda3fbafc4d21319eab9a92a7922d38bacca72f5679249ac32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3145
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 9070 109 KB
37 KB 43ms
39ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:38:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4859
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jan 2022 10:38:27 GMT

GET
H3 200 gwdtaparea_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 4 KB
2 KB 42ms
38ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e99c54c8d777d1b291f68296ac99fe0c7b8f51153eb7b36b1a88b4783bfd2bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1746
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwd-events-support.1.0.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 2 KB
641 B 57ms
53ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a6a6286fb73252576c9346ddadc9c26d4e2ce795e3710d891cde7aa970a69a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 612
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdimage_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 5 KB
2 KB 57ms
53ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c3223c27067f54618683e5fdfe83536907b179e81ed9a39873aa8b8140c05f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2001
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 13 KB
4 KB 53ms
49ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ac5c3a1604eb19f5c47e157ea3b58b4297428e653b74d6def6b41661a25eb5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4332
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdvideo_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 9 KB
3 KB 54ms
50ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdvideo_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

249f537d8e7349dab5ab2e541e485351315526451ae2e8979422f33a215307c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3083
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdgpadataprovider_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 3 KB
1 KB 70ms
66ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdgpadataprovider_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fabe68b63d6140786250c4aa8afb26bd1d69d2b7af3527be611e3e70ed2ff6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1285
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdattached_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 1 KB
616 B 69ms
65ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b1b78dc0bec6c4c5e65036a6d67c15a91ae2fc807f61ddab5ddccc3483cb9c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 587
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdtexthelper_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 7 KB
3 KB 70ms
66ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ce8bd0ee36a0c73ad575c2b1a3d8117bb51a83021a64510197960c8fe5a1e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2867
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwddatabinder_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 5 KB
2 KB 65ms
61ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwddatabinder_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f94da61df33854f21c6df7a5ef4574368905bd23ac88229b69478bf87ea4a84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2320
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwd-dynamic-binders.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 26 KB
10 KB 57ms
54ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwd-dynamic-binders.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ad58476ab825a803186b556323543d4c8a31540770399ec3760ed1473cd8719

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10433
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8922 22 KB
8 KB 29ms
29ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Tue, 28 Dec 2021 14:56:46 GMT
expires: Wed, 28 Dec 2022 14:56:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 248560
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 4E0C
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1&google_push=AYg5qPLdQ9bRZqYkeL5Hm5_LT6cMMkzj7RflP20b07ZpXE2A5_z3mE0qNCsQIfvT6hn5nWqGEW8ZlBxdz-2ckW0pVZF7oY8Zvjk
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzI0ODU0MTgxMzEzODQ2Mjk5Mw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1

43 B
407 B

81ms
34ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:25 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 4E0C 70 B
265 B 117ms
35ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIKAbd6CUcRVkFw7XIklJVA&google_cver=1&google_push=AYg5qPK_rGcksJYw1410xrQGa3flKYMthNKw_kgVDOZ3OEGMuD8q2WKAC7iHDKSP-EUtkcwflJ-__9iJ4q42L1oO2zBfQAgRC5g
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 4E0C 0
191 B 23ms
21ms Image
text/plain 66.155.71.149
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEGirXic1mNCPjJGVM3KNwBI&google_cver=1&google_push=AYg5qPJaKANKTTqi6wvHcmEQ1K-K5RJt3jmk-CvyEbvuAaeFHAAXm_oXyHE_tuQ3QdvBeIK-UH5lGIPmKj1eSIDbcZOLWi2vk0s
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E0C
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEL9Mz8V1MgogbjW1gMeG8UI&google_cver=1&google_push=AYg5qPLvMSetGRJnBDv2Y3ElgUnYd4V6ItlsnBaZ8ac8yHzS_O6ciT6ZwmgxF5wvNL95lfrRzvKbrKqeXb6VDa5b...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RxFvuEZpRHKrnfTRLjKKYQ2&google_push=AYg5qPLvMSetGRJnBDv2Y3ElgUnYd4V6ItlsnBaZ8ac8yHzS_O6ciT6ZwmgxF5wvNL95lfrRzvKbrKqeXb6VDa5bJEmITW8OJUk

170 B
188 B

40ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RxFvuEZpRHKrnfTRLjKKYQ2&google_push=AYg5qPLvMSetGRJnBDv2Y3ElgUnYd4V6ItlsnBaZ8ac8yHzS_O6ciT6ZwmgxF5wvNL95lfrRzvKbrKqeXb6VDa5bJEmITW8OJUk

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 31 Dec 2021 11:59:26 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RxFvuEZpRHKrnfTRLjKKYQ2&google_push=AYg5qPLvMSetGRJnBDv2Y3ElgUnYd4V6ItlsnBaZ8ac8yHzS_O6ciT6ZwmgxF5wvNL95lfrRzvKbrKqeXb6VDa5bJEmITW8OJUk
x-host: tde-deliveryengine-production-584bdf445-nf7km
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E0C
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDXfVRFfKVTHjoczVvBwqoI&google_cver=1&google_push=AYg5qPKDXTZ1HLsJf5cULEDIegEymcpX2z1FROWKcZCuHmtmcKjqbW6YbzHsrDXLEsd9tm8xAsboWvk3...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEDXfVRFfKVTHjoczVvBwqoI&google_cver=1&google_push=AYg5qPKDXTZ1HLsJf5cULEDIegEymcpX2z1FROWKcZCuHmtmcKjqbW6YbzHsrDXLEsd9tm8xAsb...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODkyNjM1OTE0MjQ5MjQxMjI2Ng&google_push=AYg5qPKDXTZ1HLsJf5cULEDIegEymcpX2z1FROWKcZCuHmtmcKjqbW6YbzHsrDXLEsd9tm8xAsboWv...

170 B
188 B

40ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODkyNjM1OTE0MjQ5MjQxMjI2Ng&google_push=AYg5qPKDXTZ1HLsJf5cULEDIegEymcpX2z1FROWKcZCuHmtmcKjqbW6YbzHsrDXLEsd9tm8xAsboWvk3NGzGJPdFrHLVAWoaPBU

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODkyNjM1OTE0MjQ5MjQxMjI2Ng&google_push=AYg5qPKDXTZ1HLsJf5cULEDIegEymcpX2z1FROWKcZCuHmtmcKjqbW6YbzHsrDXLEsd9tm8xAsboWvk3NGzGJPdFrHLVAWoaPBU
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E0C
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEBC2K-W9AWU2X6lntg981qo&google_cver=1&google_push=AYg5qPK0p7l86jvawzWxS7tJi00JWSX2BYlA9fg0z-Adzpp6BrRsyuA3Cwdh2InX8xKBJ9jMbbYEqH6qwi11bnDy...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK0p7l86jvawzWxS7tJi00JWSX2BYlA9fg0z-Adzpp6BrRsyuA3Cwdh2InX8xKBJ9jMbbYEqH6qwi11bnDyxVkuUxzkA3M

170 B
188 B

40ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK0p7l86jvawzWxS7tJi00JWSX2BYlA9fg0z-Adzpp6BrRsyuA3Cwdh2InX8xKBJ9jMbbYEqH6qwi11bnDyxVkuUxzkA3M

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 31 Dec 2021 11:59:26 GMT
via: 1.1 fc562aab29280948aa0691960bee3d6b.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P5
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK0p7l86jvawzWxS7tJi00JWSX2BYlA9fg0z-Adzpp6BrRsyuA3Cwdh2InX8xKBJ9jMbbYEqH6qwi11bnDyxVkuUxzkA3M
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: -ipTCedI-3DBIEmW6iwnWMcFAmwCxcrBSUGmkNx0sLHZLXJ-nrV8mw==

GET

pixel
cm.g.doubleclick.net/ Frame 4E0C
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEEx0e-UbKr5bgqAn57Q0jyI&google_cver=1&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPKtua8ZUWRbsSBaQ3Vx0u937iRAsrdYXL3RG5H381vxa_YulXR4LzyluA8y9EWULTscoxRZENwutse0s5PUfrGT4ngQDoI

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4E0C 0
12 B 38ms
37ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KnfCR0OXYYY0-0EL-1WZIkqGbSBywTxvYvAhTZ_t3xiVgB226R4292dQyWXnoNiunUPkqs

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-124-133-36.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 58 KB
7 KB 46ms
46ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2a6d65f858e94ba90694d1f9733485bb7789a342ae63b2f4fa6bbefe0da7fd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
expires: Sat, 31 Dec 2022 11:59:26 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response
pagead2.googlesyndication.com/bg/ Frame 8922 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:24:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13555
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 31 Dec 2022 10:24:41 GMT

GET
H3 404 museosans_900.ttf
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 0
0 322ms
321ms Font
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/museosans_900.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: sffe
x-dns-prefetch-control: off
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 404 museosans500.ttf
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 0
0 62ms
61ms Font
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/museosans500.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: sffe
x-dns-prefetch-control: off
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H2

200

cookiesyncendpoint Show response
servs.modoro360.com/ Frame 0789
Redirect Chain

https://ad.360yield.com/server_match?partner_id=1581&r=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D22%26auid%3D1640951966305-993100379804-...
https://ad.360yield.com/ul_cb/server_match?partner_id=1581&r=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D22%26auid%3D1640951966305-9931003...
https://servs.modoro360.com/cookiesyncendpoint?pid=59c9148628a0612da3689288&biddername=22&auid=1640951966305-993100379804-005659-002-004999&key=30a16c47-4f05-496a-8a27-a19cd7892968

0
240 B

325ms
92ms

Document
text/plain

52.22.214.16
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://servs.modoro360.com/cookiesyncendpoint?pid=59c9148628a0612da3689288&biddername=22&auid=1640951966305-993100379804-005659-002-004999&key=30a16c47-4f05-496a-8a27-a19cd7892968
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.214.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-214-16.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-length: 0

Redirect headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-type: text/plain
content-length: 0
location: https://servs.modoro360.com/cookiesyncendpoint?pid=59c9148628a0612da3689288&biddername=22&auid=1640951966305-993100379804-005659-002-004999&key=30a16c47-4f05-496a-8a27-a19cd7892968
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

204

sync
pixel.advertising.com/ups/58246/ Frame 29D2
Redirect Chain

https://pixel.advertising.com/ups/58246/sync?&gdpr=1&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58246/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true

0
0

32ms
32ms

Document
text/plain

3.124.133.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pixel.advertising.com/ups/58246/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.133.36 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
strict-transport-security: max-age=31536000

Redirect headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-length: 0
location: https://pixel.advertising.com/ups/58246/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 0E29 14 KB
5 KB 168ms
51ms Document
text/html 2.20.157.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=160993&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D1%26auid%3D1640951966305-993100379804-005659-002-004999%26key%3D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.157.2 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-2.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=120456
expires: Sat, 01 Jan 2022 21:27:02 GMT
date: Fri, 31 Dec 2021 11:59:26 GMT
vary: Accept-Encoding

GET
H2

200

cookiesyncendpoint Show response
servs.modoro360.com/ Frame BE8A
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=aniview&redir=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D200%26auid%3D1640951966305-993100379804...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4299575349
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4299575349
https://sync.1rx.io/usersync/tradedesk/ec6eaa9a-3049-49ee-8b67-ea9ae85c40bb
https://sync.targeting.unrulymedia.com/csync/RX-85c2166e-1499-4768-9c61-2459079ab526-003?redir=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3...
https://servs.modoro360.com/cookiesyncendpoint?pid=59c9148628a0612da3689288&biddername=200&auid=1640951966305-993100379804-005659-002-004999&key=RX-85c2166e-1499-4768-9c61-2459079ab526-003

0
251 B

218ms
93ms

Document
text/plain

52.22.214.16
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://servs.modoro360.com/cookiesyncendpoint?pid=59c9148628a0612da3689288&biddername=200&auid=1640951966305-993100379804-005659-002-004999&key=RX-85c2166e-1499-4768-9c61-2459079ab526-003
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.214.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-214-16.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-length: 0

Redirect headers

server: Tengine
date: Fri, 31 Dec 2021 11:59:26 GMT
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://servs.modoro360.com/cookiesyncendpoint?pid=59c9148628a0612da3689288&biddername=200&auid=1640951966305-993100379804-005659-002-004999&key=RX-85c2166e-1499-4768-9c61-2459079ab526-003
etag: RX85c2166e149947689c612459079ab526003

GET
H2 204 services
sync.technoratimedia.com/ Frame 1D9F 0
0 390ms
105ms Document
text/plain 150.136.156.92
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=1640951966305-993100379804-005659-002-004999&cb=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D3%26auid%3D1640951966305-993100379804-005659-002-004999%26key%3D%5BUSER_ID%5D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 150.136.156.92 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

server: nginx
date: Fri, 31 Dec 2021 11:59:26 GMT
access-control-allow-origin: https://weloma.net/
access-control-allow-credentials: true
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 224411011
age: 0
via: 1.1 varnish

GET
H/1.1 204
No Content merge
ce.lijit.com/ Frame 83B5 0
0 85ms
26ms Document
text/plain 216.52.2.19
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=376385&3pid=1640951966305-993100379804-005659-002-004999&us_privacy=1---&gdpr=1&gdpr_consent=&location=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D18%26auid%3D1640951966305-993100379804-005659-002-004999%26key%3D%5BSOVRNID%5D
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

Server: nginx
Date: Fri, 31 Dec 2021 11:59:26 GMT
X-MERGE: GDPR Optout true
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap4ams1

GET
H2 200 avpb3.js Show response
player.aniview.com/script/6.1/ Frame AE4E 314 KB
98 KB 57ms
57ms Script
application/javascript 2a02:26f0:6c00:28a::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/avpb3.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:28a::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: eda76969217d61f1d94de37ea52f15c2266eb2c4fb56f107ff5835c59273bbd8

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdup1HDO6QLtvu3rwxFy9zcAvZozJTDnakuI3mBn7imyuFPyOSS-y2ipLVM-6811gg8A5oEekAR_kCO8LyUlhbg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
content-length: 99492
last-modified: Wed, 15 Dec 2021 08:25:49 GMT
server: UploadServer
etag: "106d630db54a500f0a231346c7dd14cd"
vary: Accept-Encoding
x-goog-hash: crc32c=PuUYZw==, md5=EG1jDbVKUA8KIxNGx90UzQ==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1639556749784456
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 99492
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 31 Dec 2021 12:04:26 GMT

GET
H2 200 avpb3a2.js Show response
player.aniview.com/script/6.1/ Frame AE4E 65 KB
21 KB 88ms
88ms Script
application/javascript 2a02:26f0:6c00:28a::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/avpb3a2.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:28a::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 2e782a175e3bf85e25513afa4e55caecb6badcc77abafa9489aabee1bb64aea5

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtga8R3djlQtPecm4RNWmQMH8hTsV7rSIfw09sCKvNWExj3NlATU-F9_fJERy2HTEVoiqiDK4J6NuKtz59ljyRU3ABE3A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
content-length: 21183
last-modified: Wed, 15 Dec 2021 08:26:31 GMT
server: UploadServer
etag: "627d390870a976e4dcf0e8914e1ce0d6"
vary: Accept-Encoding
x-goog-hash: crc32c=T8mgGQ==, md5=Yn05CHCpduTc8OiRThzg1g==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1639556790886752
access-control-expose-headers: Content-Type
cache-control: public, max-age=300
x-goog-stored-content-length: 21183
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 31 Dec 2021 12:04:26 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 101ms
100ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&&ppid=61522ae545833a0b2b769c04&nid=60095c900c0799791c46d8d4&pcid=61708778bf7dc912731d1596&ncid=617088babf785615e530dfac&pasid=617088ea27611447916c422e&e=request&cb=1640951966457&asid=61b276452416b22924230626%2C61b276452416b22924230616%2C61b276462416b2292423063a%2C61b276452416b22924230614%2C61b276462416b22924230636%2C61b276462416b22924230634%2C6170890baae0e303c14a9841%2C61b276452416b2292423062a%2C61b276462416b22924230630%2C61b276472416b2292423064a%2C61b276472416b2292423064e%2C61b276462416b22924230646%2C61827b62d74b9f2d535963dc&ofpr=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C0.5&fpo=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
servt.modoro360.com/ 0
70 B 138ms
137ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&&copid=60095c900c0799791c46d8d4&nid=59c9148628a0612da3689288&cocid=617088babf785615e530dfac&ncid=6188f6678186692d1b57a0d4&coasid=6188f6fc4071e35134085f46&e=request&cb=1640951966457&asid=61939cf0906da8184159b769&ofpr=&fpo=
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 gwdpage_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 55 B
103 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 731 B
263 B 30ms
29ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdtaparea_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 157 B
144 B 30ms
29ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdimage_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 281 B
187 B 31ms
29ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 24 B
72 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdvideo_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 388 B
208 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdvideo_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e66fb907a79a93d3c9813f2f348b42bd1bf6f3bf140331fe57bc7cc30a816246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 179
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdattached_style.css
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 26 B
74 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7617 5 KB
753 B 44ms
43ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans|Source+Sans+Pro

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4c7ad602f81fcc1cb545b11260b0ee7b03d04cdaedf521e065bb7e4edb8300a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 31 Dec 2021 11:59:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 31 Dec 2021 11:59:26 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 21 KB
6 KB 33ms
30ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c51a4086e332a8b351790a53582dbba5bd78b7a1f021b829d93da3ad59ca575f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 247 B
225 B 33ms
30ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

503621190c75700c18c84fd3ec0977bf31b083d66e331d1009bb9cd17cdb85da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 3 KB
1 KB 33ms
30ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

257c9947bb8a45c4a0519f4ddc8769ecc7f889e268a046b0f05c17dfc7912eee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 8 KB
3 KB 33ms
31ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07b9621ff6886bdda3fbafc4d21319eab9a92a7922d38bacca72f5679249ac32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3145
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 7617 109 KB
37 KB 34ms
31ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:38:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4859
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jan 2022 10:38:27 GMT

GET
H3 200 gwdtaparea_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 4 KB
2 KB 37ms
35ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e99c54c8d777d1b291f68296ac99fe0c7b8f51153eb7b36b1a88b4783bfd2bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1746
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwd-events-support.1.0.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 2 KB
641 B 38ms
35ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a6a6286fb73252576c9346ddadc9c26d4e2ce795e3710d891cde7aa970a69a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 612
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdimage_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 5 KB
2 KB 38ms
36ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c3223c27067f54618683e5fdfe83536907b179e81ed9a39873aa8b8140c05f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2001
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 13 KB
4 KB 38ms
36ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ac5c3a1604eb19f5c47e157ea3b58b4297428e653b74d6def6b41661a25eb5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4332
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdvideo_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 9 KB
3 KB 40ms
38ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdvideo_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

249f537d8e7349dab5ab2e541e485351315526451ae2e8979422f33a215307c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3083
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdgpadataprovider_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 3 KB
1 KB 40ms
38ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdgpadataprovider_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fabe68b63d6140786250c4aa8afb26bd1d69d2b7af3527be611e3e70ed2ff6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1285
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdattached_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 1 KB
616 B 40ms
39ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b1b78dc0bec6c4c5e65036a6d67c15a91ae2fc807f61ddab5ddccc3483cb9c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 587
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwdtexthelper_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 7 KB
3 KB 41ms
39ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ce8bd0ee36a0c73ad575c2b1a3d8117bb51a83021a64510197960c8fe5a1e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2867
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwddatabinder_min.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 5 KB
2 KB 43ms
41ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwddatabinder_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f94da61df33854f21c6df7a5ef4574368905bd23ac88229b69478bf87ea4a84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2320
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 200 gwd-dynamic-binders.js Show response
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 7617 26 KB
10 KB 43ms
42ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/gwd-dynamic-binders.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ad58476ab825a803186b556323543d4c8a31540770399ec3760ed1473cd8719

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10433
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:37 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F9DF 0
20 B 65ms
65ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bz8a-nfDOYc3dNILL7_UP9J-C-A4AAAAAOAHgBAI&bg=!aGulay_NAAZKWFskSlg7ACkAdvg8WmV5twWuhsuoDC_KWm1mmzFAz1lAjDBH1aj0KfObOZvaBmNqtgIAAAB3UgAAADtoAQeZAwFKSADcSz2Z60w28s87IBWotCWskZHoMShAz7HfwY_RqXSobodecekqxbsJ84FsBspZTZaJ_O9JwceQGJomC4n8YN8TagmGEgYKegOadt-SHNNZsaF08Hrid06iNsh_KfKQJKfbDA3W3x8AE0F78VpimP6V9PcoYGwW8F-MoXaFsbQcCWg5HErzqhbNDK9-xJU1Kh4qYM7PE5BKiflQ665Ek4Y4CeVixM6h9Qcc7aVgYfWyWh-dZ5HMIL-NggGFvelHC8CEzql0p58yVLhEvRNV8EJRPQqkXIn3Laan7Rvy8BSRqUJYMg-UDIVMd2vMYQXxGVo1i7DGAbIUxMc9z6tL_Rje3o9-fUeKARPHZKJm7rvU4z6633VYrzmMwmUhq1aL08OXJJbyQZyc_3LAhCMqp7zWtY0SA47QU-g8FjV9x2Av95V1ygeP-u9yPmgEjs0026up0d_HK97w5gHQ6VcXoVeCbyE4smQWqA65NeJ9aL04MrRBPrQ8oOHY0oXmCl9tiLLn1Onxb-_Sjw3xtZ0ZuV89CCaKnjStiD5xTnBvZbCTtzoAbyDKDuYHfePvAi-HboTHOuhQMwFtxrqKtHfrz8Ta27YYK63aPNLQwtnQZVtgUL--Uj4xcHCt_P7mIunJIiR0YXTzeIK-8mUcunxDa2U5UbioCaw6OXJgWgYv42fPP6zCOc9xLPzBv_DIYiF4WvKNPf2e-1OuJE6A43pRmNqUm2Gf-HzJBCfAoQ2fH__fq6k9pR_JWssBzfIP6ZifKthkVc4_Y00Wosa4SkboixZrcmgTd8SSA8XULjb4GVEKUPGnvEMlRVPhATZ4PEGQ7QM156IY6XSHVEe-qI4oB5jZMJd17W12M8IRT94Sn89Iwo_avXs_Dyacvr2us6di1LQMYVBGNrxVguqqxofWg3OA_os27-HYLhLl_fZPCiP7UF43qAkf8LeKJo7a2JtqhyMN6xDagnclkPg8a_fqgenO_kggb94r5unZCsIZZO08jDpZwA4Dc-rfk7qbfF2C

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9070 6 KB
4 KB 80ms
42ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_244&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1597ea8141f3428cc213fcf89ec130e709f60d176fb09d5d9cb9bb4aee2501c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4340
x-xss-protection: 0

GET
H3 200 MuseoSans_500.otf
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 61 KB
29 KB 33ms
30ms Font
font/otf 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/MuseoSans_500.otf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd40a59e43b5d6b4a27d3007f20ed232d2030c7f9711f288e659ae314f66eb1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484428
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29376
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:38 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
211 B 27ms
27ms XHR
text/plain 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=5.20.0&cb=13039553393

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/avpb3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://weloma.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 7617 6 KB
4 KB 39ms
39ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_244&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96567cdc02c3cda2dbe6881257aa4835f67fe712f85bbe5947cfd8abc298e49c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4393
x-xss-protection: 0

GET
H3 200 23929287_20211216022034251_BLANK.svg
s0.2mdn.net/ads/richmedia/studio/23929287/ Frame 7617 332 B
246 B 30ms
29ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23929287/23929287_20211216022034251_BLANK.svg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84428155279a4032a155fb5af6cab7b5a5a76a0875659348a9abab68b3b58f54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 06:53:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18346
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 218
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 10:20:34 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jan 2022 06:53:40 GMT

GET
H/1.1

206
Partial Content

file.mp4
r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ip... Frame 7617
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/ip,ipbits,expire,id,i...
https://r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,...

2 MB
2 MB

120ms
19ms

Media
video/mp4

2a00:1450:4009:1::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,requiressl,source/signature/1837FFE4877D3FF37D95CCCB9290A413F27A3E60.787E0BC56424AB9813162347A03EBE1648716AE5/key/cms1/cms_redirect/yes/mh/Pe/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrner/ms/onc/mt/1640951800/mv/m/mvi/4/pl/49/file/file.mp4

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

HTTP/1.1

Server

2a00:1450:4009:1::a London, United Kingdom, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

f0a1ddb7878f7e1204b531b088e42b1edd9391d4c773177dd605285c8abfdba9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:26 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 17 Dec 2021 14:35:01 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-2515679/2515680
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2515680
Expires: Fri, 31 Dec 2021 11:59:26 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,requiressl,source/signature/1837FFE4877D3FF37D95CCCB9290A413F27A3E60.787E0BC56424AB9813162347A03EBE1648716AE5/key/cms1/cms_redirect/yes/mh/Pe/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrner/ms/onc/mt/1640951800/mv/m/mvi/4/pl/49/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 694
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 102ms
102ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&&ppid=61522ae545833a0b2b769c04&nid=60095c900c0799791c46d8d4&pcid=61708778bf7dc912731d1596&ncid=617088babf785615e530dfac&pasid=617088ea27611447916c422e&e=bid&cb=1640951966616&asid=61b276452416b22924230626%2C61b276452416b22924230616%2C61b276462416b2292423063a%2C61b276452416b22924230614%2C61b276462416b22924230636%2C61b276462416b22924230634%2C6170890baae0e303c14a9841%2C61b276452416b2292423062a%2C61b276462416b22924230630%2C61b276472416b2292423064a%2C61b276472416b2292423064e%2C61b276462416b22924230646&ofpr=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C&fpo=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
servt.modoro360.com/ 0
70 B 105ms
104ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&&copid=60095c900c0799791c46d8d4&nid=59c9148628a0612da3689288&cocid=617088babf785615e530dfac&ncid=6188f6678186692d1b57a0d4&coasid=6188f6fc4071e35134085f46&e=bid&cb=1640951966616&asid=61939cf0906da8184159b769&ofpr=&fpo=
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 7617 17 KB
6 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
DATA 200
OK truncated
/ Frame 7617 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 prod_studio_01_244_videomodule.js Show response
s0.2mdn.net/879366/ Frame 7617 13 KB
5 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_244_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0875aebd950afa00611210cd62e948f5b41ac72ac558c2f8486de9bb2971cadc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=UPHYtQQIFn&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 23:20:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45566
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4844
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 Dec 2021 23:20:00 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame AE4E 375 KB
124 KB 133ms
42ms Script
text/javascript 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92492a41ed7dbc02f64b8f399adef0bc87063f9011ea0dcf397d19a8d484bfa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126523
x-xss-protection: 0
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 0E29 0
42 B 83ms
18ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=7813646&p=160993&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=160993&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Fservs.modoro360.com%2Fcookiesyncendpoint%3Fpid%3D59c9148628a0612da3689288%26biddername%3D1%26auid%3D1640951966305-993100379804-005659-002-004999%26key%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:24 GMT
content-length: 0

POST
H/1.1 204
No Content multitracking Show response
ghb.aplhb.adipolo.com/adunit/ 0
201 B 50ms
50ms XHR
text/plain 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.aplhb.adipolo.com/adunit/multitracking
Requested by: Host: player.aplhb.adipolo.com
URL: https://player.aplhb.adipolo.com/prebidlink/455819/hbw_master_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://weloma.net
Date: Fri, 31 Dec 2021 11:59:26 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive

GET
H3 200 EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response
pagead2.googlesyndication.com/bg/ Frame 769A 35 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:24:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13555
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 31 Dec 2022 10:24:41 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8922 0
20 B 64ms
64ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B27XHnvDOYb2zCKuxx_APhditsAYAAAAAOAHgBAI&bg=!wcKlwobNAAZKWFskSlg7ACkAdvg8WuaMj0BLQRsomm5bDRF_SZ3F1Vmh57GzwuAaxMAmXTC1DReWNAIAAADSUgAAAA1oAQeZA2_yGVVKPthecpI4oDYAh-Y_yXU7kpR5WjKEx3eUtJfMm1eH6QbOy16FhPXzfTzbqddF9MkTr9M55nN7fF6Y_x40shOo-CUgLRVatll6WE3E59i6nYyDXrhJ_Y7m2pFGgJtjj9KMoxTLdrxrufS2Zt4UE5X43G3O441xxgPZceAhoZEaF3Bjrzz1aIckwHhumuT2VgrH397U3neqYdUGVGMkSglCWL4xmbP_sDlpjGvXwClsBcvl4x-hMU9ZIocN2jT6kGaafY-MPzkmERQ8Pd6hvHe08mCGP2K_SOABJFSMr_F7avzAHRn0C5d3iPouR8_o7-baFrbfoePG67Ll6fVWj51krh1X3Y3E96W5iWe73d9mHd8KWhQFlqeI3mweNnhcQZOPd7ZT7pFi3jrmd2Tpr17ynbN4ExCurAcrG3tZPaz-50xph4LrNgqrCTewUgJppLw_4TLFsnpIB_PazajaZS6H5rYv0veMCy51gF8y5lpKHjjvYlPlCW34MO6sWHHPGyv7YMqy7dJIkf9RrrK8c_fxSo_VuMAEsoCv--B-Wx-2yKtzQ-Orxe-QPVEC1Ztn0fHQplSPtPwbc9m7hHMFxVVN_8DZSSFynFWUlcgTeLgwcYRa5YU_Rfcaq-_PZRpGgC46WkfMKyWUDwjKE4iY-YF5BlKRftI1dCyLtQ5IEHoUJfJVZemTnmmuEOemzh1T98WeaD2UK4LYCXd4H4tFUfYzYLrZNLlBLdl1sbQGNWXAGVStBox1k9VLfZN69J8bh-phSAbkaLMoOD9BF5iL0Q4GoJg_qWkXdhkhNEbCCGYmR2YbEoje60BRjcxydri3sMaMkQRoRgadX63W_EsG6CP2o49XrBbBd1HGKezR-qhlef0gkYrZMO_Zzambn1RbFCRpLdLoD0-ar6hK1LPIKNAWOIPO87JcqLcOF7-1m7BD6mHdZKVbMJCoJp8g-vndABWznxlpbssmwp19-ZIR4DzMKIl_mSj-b9807q4O1y-f4BGK3oa-oHTekFjI-0nwe-DcjPWstD_06M4KGvStZ18SrYvxuKPc_gQjarUsV38pB033VMJLbYS85DjE36qAjDLyRZvcvYjQ4pfpOWmTu-bWTjXvFG-5esswvG2SYCuTwUn7Fu7_fEUzLwSwrsiTzC4oE9eTowaj6QcguPQ

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 MuseoSans_900.otf
s0.2mdn.net/sadbundle/1616735638739957653/ Frame 9070 64 KB
28 KB 30ms
30ms Font
font/otf 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1616735638739957653/MuseoSans_900.otf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1eb05f144037167124b21a34e4857fb72d19d1068ed65e298cd2c7afbcedc1c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 25 Dec 2021 21:25:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484428
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29037
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 01:33:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/otf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Dec 2022 21:25:38 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/ib/static/usersync/v3/ Frame 3284 995 B
875 B 143ms
39ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 8730c26defc411dd8a51f1da47e5ae3804fab6868f7914a26b09d8e0791bbe39

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://p.jcontentcdn.com/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Sat, 31 Dec 2022 11:59:26 GMT
Date: Fri, 31 Dec 2021 11:59:26 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 44C2 2 KB
814 B 30ms
30ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1640951966776

Requested by

Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://p.jcontentcdn.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK load-cookie.html Show response
user-sync.adxpremium.services/ Frame 392B 8 KB
9 KB 117ms
34ms Document
text/html 178.63.58.93
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://user-sync.adxpremium.services/load-cookie.html?gdpr=0&gdpr_consent=
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.58.93 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: tambora
Software: /
Resource Hash: 7569a8524b46bc6108ff1dd540acd43120db3e6623d1ee15e182748b2057d876

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://p.jcontentcdn.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 8606
Content-Type: text/html; charset=utf-8
Expires: 0
Last-Modified: Fri, 26 Feb 2021 09:17:16 GMT
Pragma: no-cache
Vary: Origin
Date: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9070 17 KB
6 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Fri, 31 Dec 2021 11:59:26 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C1E1 0
23 B 104ms
66ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJI7wT4clhsmnpOzT52qhPTJohCs6_yg-r2n75vzbshLajBBe_1wTZon_cApGNCFsUMtAgkKdQyx4NjYAaCuJjKygvMFrVxZxpOYchxbBILFJ-A1ScK-ciUVDp4NqV8FAI85meeY_CU1I0o6YFHAuUyznWw9DQA9wAy3FReRT19EVwOTEkKJAk2gzYLaZs06cv6h_e5CkA8gxJkWkVSaPkqncztstp7eZnuy_PPXPfLlQ9s4gKugJBijATiilSDJHyWjnUrUWZlvTYPsWI9GUoDcO_C_MS7uqTHTCZ8b0dfXJQq9gBPbD-nWA-BwfZwL96YF3PPhQaStH40o29heIRSmpNqSKwkSPWDbHBXulRHPTVKC7XbQKJGJLjxbYygsoYiq6oeccYcNmvd8NBFeIff6gzyJlRJTGRE4QQyDw_0ecNCRowSJDBdHFH9CDDA-uYA-n76wproPSfgwP4UpmwGSBGeHROlapJvCee5CYPkXC6uq1NXbOL19k4KE2u2bqxbpWlR3bEOA0uXtzng2irPidXpK4Wf5pBs5j3q1BBPlVuN0wkTxe6W7MjXkZ1L6fWcIw7kXQ1ijDQzjRh_9rhHdBQzeMrW6i3KZHEj9zp4U_bXmiv9eCmL1HrB-_wEUz_6fhjSLGZUa5Ub9SJ2k9KddNXJe15U_rfZRtLUgCOoBD9fUd_0YmbKr8iTFtH5waiZ_xYkQInywX0gjh48zcx5lp6-tu-YXHLrkeo1C1GzA6ni4M5X-91to1nLMUHH6Ixo9eozz-EcJ8JQ7jIdOrTdGelJunN-Qy3YSh5NhjrrrXP8N1dG3Xmk4NAAE7OHEWTke-G-YeqGP0WcUJhog87vfiLifMIUpYsGVFqx2Ul5qea7aac3s8ZrhfxhbvcO9UYaF4ZiyrK12s9h-ZXgx_ucPGF6J-WABlMX4gpOb4NlZYZ21NP-YSoBjDeUdmoKKjnwUc92KV4pxagthwJ_Sjp9PmlO45iOWX5G52Vk3geDd6x3iNbvwaLvcdIfAEXS4kxsyrq_XwAepoL378gYQN6AgYeRNchaXJ4DIIpvfa1Q12ZbAWl7WfJIorPuJjG6_qrflK_g1gh3bVKN4v12jwFLuIkyBDpraeH3afPe49RZwqkAp8BGnk2Fmr-99pJX4CCi1Rie3EbvJE&sai=AMfl-YTqa3ynILEoXHC24z5uCX2YXzG1qyf3Y7orb3eUsjRgGEQ40QOLTovIWKxrvxD7in9wxUCOHbErLoZu-0fvYm-NuRVE25qjJit-RTrCY4fV8mUTTq_KyBVjLb9p8YOjHo53zpMYsjScjjpS7JnAH1S5G3QLpA&sig=Cg0ArKJSzOaBbVgDVLTMEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=795&vt=11&dtpt=584&dett=3&cstd=206&cisv=r20211207.34955&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
122 B 38ms
38ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=weloma.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 38ms
38ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 89 KB
29 KB 248ms
247ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2179918186621210&correlator=4311094924772629&output=ldjh&impl=fifs&eid=31062931&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211231&iu_parts=21939239661%3A22377873257%2Capl%2Clovehug%2Csticky&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=970x90%7C728x90%7C320x50%7C320x100&prev_scp=test%3Drefresh%26hb_rfBid%3D0%26excl_cat%3DPREPOST&eri=1&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&bc=31&abxe=1&lmt=1640951966&dt=1640951966807&dlt=1640951964292&idt=634&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1150&adks=2666999317&ucis=3&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fweloma.net%2Fwem&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&ga_vid=287651425.1640951965&ga_sid=1640951965&ga_hid=1532115371&ga_fc=true&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99e3368210c45367ca4fe05f9219a36e5965addec4b02ce085aedce365ddb724

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30086
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://weloma.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 23929287_20211216022034251_BLANK.svg
s0.2mdn.net/ads/richmedia/studio/23929287/ Frame 9070 332 B
246 B 29ms
29ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23929287/23929287_20211216022034251_BLANK.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1616735638739957653/gwdimage_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84428155279a4032a155fb5af6cab7b5a5a76a0875659348a9abab68b3b58f54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 06:53:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18346
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 218
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 10:20:34 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jan 2022 06:53:40 GMT

GET
H3

206

https://gcdn.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/ip,ipbits,expire,id,i...
https://r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,...

2 MB
2 MB

82ms
33ms

Media
video/mp4

2a00:1450:4009:1::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,requiressl,source/signature/6D9906694078C2437753EE0DABBCDBA645D1F21A.08035F7D63E789D68684B001AC24155AFEE50379/key/cms1/cms_redirect/yes/mh/Pe/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrner/ms/onc/mt/1640951560/mv/m/mvi/4/pl/49/file/file.mp4

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Server

2a00:1450:4009:1::a London, United Kingdom, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

f0a1ddb7878f7e1204b531b088e42b1edd9391d4c773177dd605285c8abfdba9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
x-content-type-options: nosniff
last-modified: Fri, 17 Dec 2021 14:35:01 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 0-2515679/2515680
client-protocol: quic
cache-control: private, max-age=86400
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2515680
expires: Fri, 31 Dec 2021 11:59:27 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:26 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-aigzrner.c.2mdn.net/videoplayback/id/4b4d54512db0f8e6/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,requiressl,source/signature/6D9906694078C2437753EE0DABBCDBA645D1F21A.08035F7D63E789D68684B001AC24155AFEE50379/key/cms1/cms_redirect/yes/mh/Pe/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrner/ms/onc/mt/1640951560/mv/m/mvi/4/pl/49/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 694
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 9070 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 23929287_20211216022034251_BLANK.svg
s0.2mdn.net/ads/richmedia/studio/23929287/ Frame 9070 332 B
246 B 30ms
30ms Image
image/svg+xml 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23929287/23929287_20211216022034251_BLANK.svg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84428155279a4032a155fb5af6cab7b5a5a76a0875659348a9abab68b3b58f54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 06:53:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18346
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 218
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 10:20:34 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jan 2022 06:53:40 GMT

GET
H3 200 prod_studio_01_244_videomodule.js Show response
s0.2mdn.net/879366/ Frame 9070 13 KB
5 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_244_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0875aebd950afa00611210cd62e948f5b41ac72ac558c2f8486de9bb2971cadc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1616735638739957653/index.html?e=69&leftOffset=0&topOffset=0&c=szTv5fADE3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 23:20:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45566
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4844
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 Dec 2021 23:20:00 GMT

GET
H3 200 EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response
pagead2.googlesyndication.com/bg/ Frame B56D 35 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:24:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13555
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 31 Dec 2022 10:24:41 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 8937 598 KB
194 KB 106ms
67ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 client.js Show response
s0.2mdn.net/instream/video/ Frame AE4E 44 KB
16 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 Dec 2021 11:59:26 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 4B5F 598 KB
194 KB 67ms
42ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 554A 598 KB
194 KB 110ms
94ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 5320 598 KB
194 KB 45ms
38ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 3FE6 598 KB
194 KB 104ms
104ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197338
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 71ms
71ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame D033 37 KB
13 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame DCAF 37 KB
13 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 9B4F 37 KB
13 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 56FD 37 KB
13 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 9D00 37 KB
13 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

POST
H/1.1 200
OK cookie_sync Show response
user-sync.adxpremium.services/ Frame 392B 2 KB
2 KB 33ms
33ms XHR
application/json 178.63.58.93
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://user-sync.adxpremium.services/cookie_sync
Requested by: Host: user-sync.adxpremium.services
URL: https://user-sync.adxpremium.services/load-cookie.html?gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.58.93 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: tambora
Software: /
Resource Hash: 19ea3771737702028f85ad21036bbbc8575b631882e580ee64afe4d28fef6a31

Request headers

Referer: https://user-sync.adxpremium.services/load-cookie.html?gdpr=0&gdpr_consent=
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:27 GMT
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://user-sync.adxpremium.services
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Content-Length: 1594
Expires: 0

GET
H2 200 dc_oe=ChMIjaCTuP6N9QIVguW7CB30jwDvEAAYACDt07g6QhMIsv3zt_6N9QIVo1blCh3P0gVo;met=1;&timestamp=1640951967079;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;
ade.googlesyndication.com/ddm/activity/ Frame C1E1 42 B
494 B 187ms
94ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIjaCTuP6N9QIVguW7CB30jwDvEAAYACDt07g6QhMIsv3zt_6N9QIVo1blCh3P0gVo;met=1;&timestamp=1640951967079;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
rtb.adxpremium.services/ Frame 392B
Redirect Chain

https://inv-nets.admixer.net/adxcm.aspx?ssp=5FEC4B7E-00BE-4619-A907-C423ED15D8EA&rurl=https%3A%2F%2Frtb.adxpremium.services%2Fsetuid%3Fbidder%3Dadmixer%26uid%3D%24%24visitor_cookie%24%24
https://rtb.adxpremium.services/setuid?bidder=admixer&uid=ec5b0236ed6149c8b31436fef463dcaf

0
598 B

69ms
68ms

Image
text/plain

135.125.163.79
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adxpremium.services/setuid?bidder=admixer&uid=ec5b0236ed6149c8b31436fef463dcaf
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Server: 135.125.163.79 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3190286.ip-135-125-163.eu
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://user-sync.adxpremium.services/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

Date: Fri, 31 Dec 2021 11:59:27 GMT
Server: nginx
Access-Control-Allow-Origin: *
P3p: CP="NID DSP ALL COR"
Location: https://rtb.adxpremium.services/setuid?bidder=admixer&uid=ec5b0236ed6149c8b31436fef463dcaf
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=25
Content-Length: 0
X-Xss-Protection: 0

GET
H/1.1 200
OK async_usersync Show response
secure.adnxs.com/ Frame 3284 0
733 B 143ms
38ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/async_usersync?cbfn=AN_async_load

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 31 Dec 2021 11:59:27 GMT
X-Proxy-Origin: 194.36.110.165; 194.36.110.165; 534.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 28c116a8-3ad4-404f-939c-a5a3781c79ad
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 container.html Show response
55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 70C6 6 KB
3 KB 49ms
48ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 31 Dec 2021 11:59:25 GMT
expires: Sat, 31 Dec 2022 11:59:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C1E1 42 B
64 B 79ms
79ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsssy6qdyYPk-XpJgaRfTZVJAAOIKFkhYLeUOASkbCzNxBdeZehEbp2E6Qp8tj1FFNTBqdVlvBdAAi2gsXccrfRqd-Fbhf1IiKXBxTvF26TM0dtjuuwZyA&sai=AMfl-YSfTg-almLmvAASn0wRuBM3iV1Mq6r22QOmMSDGy7nrlXcKr0i0DCvNvDoxzxlaHgSGYW3sQZ8beV-y2qFABdmVikGT8MKGeNDkD0ELqJCWgy7-FLMIBpMaFU4&sig=Cg0ArKJSzAIfeuDiwD6sEAE&cid=CAASEuRoQcxAKqcopBW6egxhtnCq7A&id=lidar2&mcvt=1011&p=761,732,791,773&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=87696662&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1640951965730&rpt=321&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 70C6 32 KB
13 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23375fd2e0c63e3d79d1e26c31e908a63310221ff8c10e5b7bafb71ae478f555

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 10:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13177
x-xss-protection: 0
server: cafe
etag: 14559802278604478720
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 10:44:07 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 70C6 22 KB
7 KB 63ms
63ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 10:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179352
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 29 Dec 2022 10:10:15 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 70C6 19 KB
8 KB 64ms
63ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:46:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 795
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:46:12 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 70C6 2 KB
1 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:55:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 241
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:55:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 70C6 119 KB
36 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 31 Dec 2021 11:59:27 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 70C6 15 KB
6 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:42:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1023
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 11:42:24 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 4B5F 27 KB
7 KB 319ms
318ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_300&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3355477580775616&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=530441589&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967536&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=2524246148890861&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

452628d8d728491f9471165ea14b4c1e1f414e3b426c969c266d70648dd35d83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6639
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 8937 156 B
185 B 289ms
289ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F170737076%2FVideo%2Faniview.com%2Faniview.weloma.net&description_url=https%3A%2F%2Fweloma.net&env=vp&correlator=2978431022198703&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=640x480&max_ad_duration=30000&unviewed_position_start=1&cust_params=posA%3D3&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=2327783692&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967542&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=139866678381932&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame D4C9 2 KB
1 KB 217ms
44ms Document
text/html 2a0c:5c81:5139::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=601760
Requested by: Host: user-sync.adxpremium.services
URL: https://user-sync.adxpremium.services/load-cookie.html?gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5139::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 4e6defbdfbfe8b214b66ae20c3bbd6b726a23cad59aab664585a87798f336f65

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://user-sync.adxpremium.services/

Response headers

Server: VertaMedia 1.0
Date: Fri, 31 Dec 2021 11:59:27 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 827
Access-Control-Allow-Origin: https://user-sync.adxpremium.services
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 5320 156 B
516 B 174ms
174ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F21939239661%2C22377873257%2Fapl%2Faniplay%2Faniplay_075&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=1245737850270746&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=2803502750&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967554&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=355932488301658&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 554A 27 KB
7 KB 335ms
335ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_075&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=4255080380520515&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=4043538810&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967559&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=3694915920718649&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15f051f03095b6a97790eb32801d5691e5641f2f617dc20b737cbe897e62f141

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6587
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 3FE6 27 KB
7 KB 319ms
319ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_050&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3256429454275486&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=711701113&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967563&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=3794987744286825&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

cafe /

Resource Hash

632aaee93a3502011cb310b97ef7e41006897f9af071845e91ce8e6f8e1d7bb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6607
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 70C6 20 KB
20 KB 110ms
25ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=87838&q=80&r=0&u=https%3A%2F%2Fwww.chisholmhunter.co.uk%2Fmedia%2Fcatalog%2Fproduct%2F5%2F-%2F5-159-02-0034.jpg&ups=1&v=3&w=800&s=ncRGcVoYBgU7BwZm-ufhohaF

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

43155db911b873cbc4ac855e67684cb052741e7e0c1f44acd7c61f0006c94eed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 06:01:31 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 280675
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=2538799
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 20410
expires: Wed, 26 Jan 2022 15:14:51 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 70C6 4 KB
5 KB 128ms
43ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?ar=1&h=200&llw=100&m=0&partner=87838&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F87838%2F210727%2F32be03cb8af84389a2ac12adba04fd10_logo.png&v=3&w=200&s=6mtJMe-Si6DYP6JVN5JVtVYh

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

94b08c15ac39330cbe4b78f1aa86a77e4cae1db47c576f79bfd387b60835cf21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 21 Dec 2021 10:38:50 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 868837
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29102603
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 4412
expires: Wed, 23 Nov 2022 06:42:14 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 70C6 0
0 71ms
71ms Fetch
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CZqNTnvDOYaeuNMbE7_UP07So2ATkj9KxXJfS54SzAcCNtwEQASAAYLu-roPQCoIBF2NhLXB1Yi0yOTMwODA1MTA0NDE4MjA0oAG91IjrA8gBCakCGFmr7Gastj7gAgCoAwHIAwKqBN0BT9AsEyJj-k9gExSVDbUAJF9Fo8cV2rXlp4McqHIBhhVcVy6bv3VWm1qvWT__GbdDObM4iMPiY1CYCmFIqWhqaRHSaMTpTB64OS0bUh8QMeBq6nFLObbK_0IV3KAWf9km1W5-Q8BYgmeKs25Ds-TBh1FR4kB40uWJLy1TnyMAL90kHTJtU7Ow5vD_Rr4XXiTI36shk1HuxSkbROmJ25ohatAjmW-xjiFgAKVQeKNjcMvy3raDYKVFExKlDNXHthfHa9g3ZIwIHrjFGvYQwAlTrBaR7wshi8-0Dqd8M7DgBAGABofk4LTMw-K1U6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB8ggbYWR4LXN1YnN5bi00NDIzNjM5NzExNDMyNzYzgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTI5MzA4MDUxMDQ0MTgyMDQYppN2&sigh=lX0OApnXR6Q&uach_m=[UACH]&cid=CAQSOwCNIrLMEOjCliYiOYYzAr69pTLIqgZBZpIzo_AfUBAVNPYdyxXCM6cQFYPbmpOWVcYk4AoYwXkAa848GAE
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H2 200 lgn.php Show response
cat.fr.eu.criteo.com/delivery/ Frame 70C6 43 B
350 B 205ms
28ms Fetch
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://cat.fr.eu.criteo.com/delivery/lgn.php?cppv=3&cpp=QW-oWkFPgrQVyJvai5kC4hcWuHe2J5Zm3lDq3dK9vf6UDCBhMrb32LdE0KXkDRS_3qR1rXCdTi2J-v8Zvz87quaf-i3cKkKw-02TTGqkLZ-us7rWWuT8Ij03ICnQNqdX0aRcodl7O65MtaW5YeO-Ui5gAWdy6Ncdz-v6A7gN1RQumNzK3GP4rOwgHq8-zV4KD-Mn7WvSSLkBLusf8Tmfk69hjxE0mzqF6Dnd-gWyXKPjbxs-95X84v5DDwtSf9Wv-obYZ4n-6UQPkNEcbxssm3xE1X5mGOa4kzUNODYKyr1TTEnECRpNXbwEX1Plzq-6mClBvWC4Fq_yQbYCUzaHhl86d0-X4CWc_jNS8AOSkHzIJQA4UQXeNAnzbiZuSElIbKFoY-mTzXVmay_aqX6O5OK1Dogn61ErNbhsoiVYzj-sUbYkxH8V0-gErxpNp17n3Y_ieg&z=Yc7wngANFycIu-JGAAoaU6JJkieKMjApASRAKg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
server: Microsoft-IIS/10.0
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 7105
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 70C6 0
0 148ms
45ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UMvdEKm7RQAAh_pXGAIAAADZmCenOMS1CRCe8M5hXiFdlWntBklh2l0AEg&wp=Yc7wngANFycIu-JGAAoaU6JJkieKMjApASRAKg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:26 GMT
server: Kestrel
server-processing-duration-in-ticks: 260446
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 70C6 0
0 68ms
67ms Fetch
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CVrWFnvDOYaeuNMbE7_UP07So2ATkj9KxXJfS54SzAcCNtwEQASAAYLu-roPQCoIBF2NhLXB1Yi0yOTMwODA1MTA0NDE4MjA0oAG91IjrA8gBCakCGFmr7Gastj7gAgCoAwGqBN0BT9AsEyJj-k9gExSVDbUAJF9Fo8cV2rXlp4McqHIBhhVcVy6bv3VWm1qvWT__GbdDObM4iMPiY1CYCmFIqWhqaRHSaMTpTB64OS0bUh8QMeBq6nFLObbK_0IV3KAWf9km1W5-Q8BYgmeKs25Ds-TBh1FR4kB40uWJLy1TnyMAL90kHTJtU7Ow5vD_Rr4XXiTI36shk1HuxSkbROmJ25ohatAjmW-xjiFgAKVQeKNjcMvy3raDYKVFExKlDNXHthfHa9g3ZIwIHrjFGvYQwAlTrBaR7wshi8-0Dqd8M7DgBAGABofk4LTMw-K1U6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB8ggbYWR4LXN1YnN5bi00NDIzNjM5NzExNDMyNzYzgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTI5MzA4MDUxMDQ0MTgyMDQYppN2&sigh=KOU_1yItXQI&uach_m=[UACH]&cid=CAQSOwCNIrLMEOjCliYiOYYzAr69pTLIqgZBZpIzo_AfUBAVNPYdyxXCM6cQFYPbmpOWVcYk4AoYwXkAa848GAE&vt=10
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3254 143 B
163 B 31ms
30ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Fri, 31 Dec 2021 11:02:26 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3421
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3097 1 KB
749 B 30ms
30ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 31 Dec 2021 05:53:44 GMT
expires: Sat, 01 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 21943
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 70C6 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6820f6d0c897eff850b03cf7b9661c76b55c375b2deeb2e434b4689717472bf6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET /
google2waycm.netmng.com/cm/ Frame 3097 0
0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 3097
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1&google_push=AYg5qPLAdSU8zFocSRY9icBIWcnGKlQfywnvsQZojhKCoMscHjCXC5sCPmPBcDYDnEd_aeBeswrGfmNJ4MKnmVFYFdJBt7s9KKpx9w
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzI0ODU0MTgxMzEzODQ2Mjk5Mw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1

43 B
407 B

38ms
37ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEODoVyPYMngoowie1Jkphjs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3097 35 B
464 B 120ms
37ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHIGh5MORAHA0PLyoCoOiAk&google_cver=1&google_push=AYg5qPKMBEoCG9wW9qQL8Qx6rPEreR1MSzA4Ehd_SMFzXjqhuWcfyMO8VOGgmAoECNNnPWn-voDrEttE1oUcBYpvDCRJup2_YV5dAw

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 3097 70 B
264 B 30ms
29ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIKAbd6CUcRVkFw7XIklJVA&google_cver=1&google_push=AYg5qPIXY5xpv7mLzs0ho8_J8Z2lyN_OQSwrRVQFawnPKZWKffhN-6ZKv78x5g-WP7w8qgasj3GMGDZKdQdHYf_NM2RQi8JzmUTAHg
Requested by: Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3097
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEG2vB50l8RxWdbvPbxHNuVk&google_cver=1&google_push=AYg5qPKC-05yDx6sQQss3oGrV_HOIXzsg12tJRCWiImKiph7wj4MvRQQWISAIoAEPqr8KJbvJcU0NbbsvjOrvBT2DqgnnTT...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEG2vB50l8RxWdbvPbxHNuVk&google_cver=1&google_push=AYg5qPKC-05yDx6sQQss3oGrV_HOIXzsg12tJRCWiImKiph7wj4MvRQQWISAIoAEPqr8KJbvJcU0NbbsvjOrvBT2Dqgnn...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPKC-05yDx6sQQss3oGrV_HOIXzsg12tJRCWiImKiph7wj4MvRQQWISAIoAEPqr8KJbvJcU0NbbsvjOrvBT2DqgnnTT22MLQYg

170 B
188 B

44ms
43ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPKC-05yDx6sQQss3oGrV_HOIXzsg12tJRCWiImKiph7wj4MvRQQWISAIoAEPqr8KJbvJcU0NbbsvjOrvBT2DqgnnTT22MLQYg

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPKC-05yDx6sQQss3oGrV_HOIXzsg12tJRCWiImKiph7wj4MvRQQWISAIoAEPqr8KJbvJcU0NbbsvjOrvBT2DqgnnTT22MLQYg
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET

pixel
cm.g.doubleclick.net/ Frame 3097
Redirect Chain

https://onetag-sys.com/sync/i,19/?google_gid=CAESEEx0e-UbKr5bgqAn57Q0jyI&google_cver=1&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_push=AYg5qPJzWppZ0QgudJIY6FWwyzSylcfvIYCA68u3eKOi0jEfoFylwjMdlLC3UrBPLMw4YDv_n_bF17M3Hm2eQoQa3htFyMMQxT2vjg

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3097
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEHiZL2kgnt_uWYdHiZpLdHA&google_cver=1&google_push=AYg5qPK9Wv_DBjlxvNEgOACLyXja86ZSdP2QTaYT9QHEtmfZOhL9vea3...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEHiZL2kgnt_uWYdHiZpLdHA&google_cver=1&google_push=AYg5qPK9Wv_DBjlxvNEgOACLyXja86ZSdP2QTaYT9QHEtmfZOhL9ve...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEHiZL2kgnt_uWYdHiZpLdHA&google_cver=1&google_push=AYg5qPK9Wv_DBjlxvNEgOACLyXja86ZSdP2QTaYT9QHEtmfZOhL9ve...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVAxYTE5ZTk0ZS02YTMxLTExZWMtYjRhNC0wNmZjMDQwMWIyZWM%3D&google_push=AYg5qPK9Wv_DBjlxvNEgOACLyXja86ZSdP2QTaYT9QHEtmfZOhL9vea3fQWOKkVv5Q...

170 B
188 B

48ms
48ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVAxYTE5ZTk0ZS02YTMxLTExZWMtYjRhNC0wNmZjMDQwMWIyZWM%3D&google_push=AYg5qPK9Wv_DBjlxvNEgOACLyXja86ZSdP2QTaYT9QHEtmfZOhL9vea3fQWOKkVv5Qiv3d3jzowVBf9cXkbD0WXtFw5JEWa1Dca2WMs

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVAxYTE5ZTk0ZS02YTMxLTExZWMtYjRhNC0wNmZjMDQwMWIyZWM%3D&google_push=AYg5qPK9Wv_DBjlxvNEgOACLyXja86ZSdP2QTaYT9QHEtmfZOhL9vea3fQWOKkVv5Qiv3d3jzowVBf9cXkbD0WXtFw5JEWa1Dca2WMs
date: Fri, 31 Dec 2021 11:59:27 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3097 0
12 B 39ms
38ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KANG14EKUxuj4eB2cPNofPsV6rqJm5r5PRwXuZ9GFBBFozbGv_aefzjbHAJ4PO2HC_-I9Y8w

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3254
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

95ms
94ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com
URL: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 31 Dec 2021 11:59:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 31 Dec 2021 11:59:27 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 31 Dec 2021 11:59:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 publishertag.prebid.113.js Show response
static.criteo.net/js/ld/ 85 KB
27 KB 167ms
61ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.113.js

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

e6969b69570c743952ab51b9fba22410be503db91b0566753d6da10894e76dad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 12:50:31 GMT
server: nginx
etag: W/"6138b197-1532d"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Jan 2022 11:59:27 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame B2D7 598 KB
194 KB 29ms
29ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197339
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 42ms
42ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

POST
H/1.1 204
No Content mut Show response
ghb.adtelligent.com/adunit/ Frame E554 0
208 B 46ms
46ms XHR
text/plain 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/adunit/mut
Requested by: Host: p.jcontentcdn.com
URL: https://p.jcontentcdn.com/prebidlink/18992/pbm_307825_11595.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://p.jcontentcdn.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://p.jcontentcdn.com
Date: Fri, 31 Dec 2021 11:59:27 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame D42B 37 KB
13 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

POST
H/1.1 204
No Content multitracking Show response
ghb.aplhb.adipolo.com/adunit/ 0
201 B 45ms
44ms XHR
text/plain 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.aplhb.adipolo.com/adunit/multitracking
Requested by: Host: player.aplhb.adipolo.com
URL: https://player.aplhb.adipolo.com/prebidlink/455819/hbw_master_323303_10647.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://weloma.net
Date: Fri, 31 Dec 2021 11:59:27 GMT
Access-Control-Allow-Credentials: true
Server: VertaMedia 1.0
Connection: Keep-Alive

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame 91E3 2 KB
1 KB 45ms
44ms Document
text/html 2a0c:5c81:5139::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=651796
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=601760
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5139::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: ac13f515581c1b81eb3bda375d24e7c17712728d3cedf85fcff4808c9bae2e9e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.adtelligent.com/sync.html?aid=601760

Response headers

Server: VertaMedia 1.0
Date: Fri, 31 Dec 2021 11:59:27 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 928
Access-Control-Allow-Origin: https://s.adtelligent.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H2 204 d
ic.tynt.com/r/ Frame 8C22 0
0 366ms
117ms Document
text/plain 67.202.105.31
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ic.tynt.com/r/d?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=601760
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip31.67-202-105.static.steadfastdns.net
Software: nginx/1.16.1 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.adtelligent.com/

Response headers

server: nginx/1.16.1
date: Fri, 31 Dec 2021 11:59:28 GMT
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

GET

csync
sync.adtelligent.com/ Frame D4C9
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309255%26extuid%3D%24%7BUID%7D
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309255%26extuid%3D%24%7BUID%7D&ox_sc=1
https://sync.adtelligent.com/csync?t=a&ep=309255&extuid=9f70bf4b-33f0-44d6-bfdb-a8a5806f4408

0
0

GET

csync
sync.adtelligent.com/ Frame D4C9
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D297253%26extuid%3D%24UID
https://sync.adtelligent.com/csync?t=a&ep=297253&extuid=2864623943056302689

0
0

GET csync
sync.adtelligent.com/ Frame D4C9 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 02EC 14 KB
5 KB 55ms
54ms Document
text/html 2.20.157.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156813&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.157.2 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-2.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.adtelligent.com/

Response headers

server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=120455
expires: Sat, 01 Jan 2022 21:27:02 GMT
date: Fri, 31 Dec 2021 11:59:27 GMT
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 7ECF
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17184-d
https://eus.rubiconproject.com/usync.html?p=17184-d

281 B
554 B

108ms
37ms

Document
text/html

104.89.20.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=651796
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.20.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-20-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.adtelligent.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "40014-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 31 Dec 2021 11:59:28 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=17184-d
Date: Fri, 31 Dec 2021 11:59:28 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET

csync
sync.spotim.market/ Frame 6659
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D323548%26extuid%3D%24UID
https://sync.spotim.market/csync?t=a&ep=323548&extuid=2864623943056302689

0
0

GET

csync
sync.spotim.market/ Frame 91E3
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D482928%26extuid%3D
https://sync.spotim.market/csync?t=a&ep=482928&extuid=

0
0

GET

csync
sync.adtelligent.com/ Frame 91E3
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D
https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=no-consent

0
0

GET

csync
sync.adtelligent.com/ Frame 91E3
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189529&cb=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323546%26extuid%3D
https://sync.adtelligent.com/csync?t=a&ep=323546&extuid=Yc7wnm3EVMzVgitt83VqnAAA%26706

0
0

GET csync
sync.adtelligent.com/ Frame 91E3 0
0

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 4B5F 29 KB
14 KB 130ms
67ms XHR
text/xml 173.194.76.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-Dx50ohj8gUDDybJpfgq8HPWboSFNhGYEH5qQsByyajStAT4rznEILDe0dMZQ5Y4_4Yeay0HZa1qEtGspN_IPZ0Ywa-qg&dbm_d=AKAmf-A1lWbheRyNlCD_8tWF1kj3qPLZuyQldjlH1SSqDufl715iLHcwV8w3RoeaVocAsiWzYi1w_n74y5VcFuykb4Uuo8FmR9Sh_ZeBA2aYpCfCTC8QWn8RSO4_Gl40-dLbA39kf2tDX0qGGBqJkGIEkl7045J2f0EakFvZwWGsbg5J6h9LrEvZKPsBXD357CmDqUnFt6-C60dkGmv_YFPy4qDKBil6Amc1MVj7rlDcITnhXQJKeogp4_S2m1yAcSpoBJHABCgOD-lKKOF5aZYTY1Rpc3uH2Wxo0X2kQ2FK7sbatur7aDb1MtM0WhXux4LKD2n_PdxU1OOc28XHKFpMWkUz2McWJwKS_3TTjeHPn2XN8uwTrInHdQsJeW1qgwbi6r6ftIxLDOISfA3AVntrcxL2q8jIfkPBwUdvMtwgLPM7kLqDDFHCiivl39zcWa2DAIvJsVMdVRA3q7rzLRUpNT5NGLjqSg0k2B6DNkdcjAEU5c3qiKXys3ns8vObUCRC9HesH9TPB4oZsZfcWPFZXKneyLzrR2BmxaWi9Biw4LH5UXa-KDH_c-zcBQyFCXwwr63x4oYZ_XwzKh2r_gtkfQMNioDoXwvEU-rJPFvqDH73ewiRJDsWNAEpYgCjMU1au7lYQR94l3qRWqQqZj9f1EMoqk27VXDBXndHmhGHPhwmX7BMl2xxadvnKqOkovlsZw2kjwM1xY4m2vG0OhtcFYzW6M5krnm6UWm6S_dOnaZ9S2baaP6jpJ4vOg8Oy22uZMjCei1MHyffrR3HGdLjhf2piUVwZnpf-oYugP-gNXDE1c5E-wGs1zxeYsQF0IFEcOY8e6xtCXVi6nY6OH07Z9bMFSaD1563kzc3yXraBXE_FmHSqXIUW9LwUoaVhwp7BkheNi8rzWAm4WXtij5R4P6EyPaOmGW1bNpt9JcvPPBSYrY6NCpGZ5-9IdzFxaWwQp1w9FYYJVQmWabiT5cCdM08Mm3kfWEGDlIbR4UsomRFsTlw3bMuo4BhIon0K_iKysEwgmSaE9-uHEbYM2XGvJkkHcF3GBRL8ng1NDwbTyMMkbkO-e5sS-FNH_ymfd5A-w4w6dXJogO02RJCcm7rsRRXELNQplh5SY51d6YRCs3xx9cTkU1tQMRuoooqm241Am_MABhgyJy-yagJM5YHTNvV-PTzm1qLG5SUhf_SytwDyWby2fUpmEqOl4Sjc5RnUh6l5evXzkuGngkREcSGQKV2Ncksq0Y0jOFhA3t5G6vAWIWIRyLq5pb61DHawfAayM9iIdIiNPXWzzka4H7zJTw4ZCbGSbv2H25y3UnoyJR73LWbxk15mWOboXxINpRHUYTzZ64nTfw7kdlA4p0B1kqGBt5OyPuZ7NAs4LMXs6CrpQzpG_GRKE8Z6g1SF8kVY1TH4W8ft4jCFc5-Luz4cQQkPk6Jzb2L4xlBTh9_SrvxeE9UKYFhNP7vjWOmGFAHccnEn10gIXBZQ3OGB3c33JcE7J3wK19U4sVhpu5vE5snZpFYVpVQ6gMcexGXiMVF4A5ZipgiYNl3lbIQaMCXJiX2x9bo_LYMjs1AdGxqvrA8sIKK2_hw4XjGn9_KGBU1s7rQSWE_CbYqItqpwJ5DSQsKF2rmRSFOIF0PKZ_Jxmn10yg_L7LMEmBigFOBw2810C2jPmO92zWQ6lPjI6TBwk9K5whpMIS593nrfHTPrprnH2n-jmp6ktrqqFNspGf-QokmNPHSpHQ5ykdvqvLLvDXz38EcuG51g8wgA9hRNOWg6cYTG40oq2kqNk5IVKyJQOuO3jZlkyOkwy5ZHHbaqJ6hMuCQRtRsGVLC_f6C_97lvvhXC1XeFD_oyc1lgWi0T1KhckIOXot7FItGSP6azsmz8Xd7KCJGZzs5RLTT1Zh26bt--fDNoNLo6VoIsoNjINmjxQ6pooLcFsUemSvQ04VHpSqXxkJaQwW3ZABVMz9hIfU02ZMDrlFkb7IOiu4y7hkBUaGZpO3kQIxMeXP4Y3TDhkgI8Fq53hJgufcuLEwlcj65ffuIGd54T-frFHtEjIZL4rcgn683Lah1dj_9vw-TU2JPqHsEyd-fQ-2mhPIy6kmeqkyuGjYGFA1vcvfNCNe6L_NjNSpVqw7k_J1MFdoRj6hb7R0N4oW1UkLBVgrNRhRhIO_JRYgn-Ylq0rkV_LbJBx0uC0ecGwTccI4aR1R1jue6Zu_d7_nFz4o_59yeDYeFvxx8zX3oQblK5tcDJYO0VzG9jKY0jGOV8_JkgDidCVV_oi4p7478ZFH9heBYSVIFRFc9JHY-KzRuTBlb37nY7SoRJ7To5xz5tx72cLF8K9tV3hSi1eZ-9qhghK4b469zuQTsIGntB_WzpzLSgcc0eAZrElk-_mc4OEQfzeL1OqZQ0jDaG4SDs8SIRmnhGPYIlhtWZPC5QONAxRrDh41jySt9krCVN8f5IwQfGzG-P6aKrh9icM8b4XnVNnriCpLJ7IatdfuR4BMsrEnQsPPkpRmOoy9-idGjSK2XRcTyxa8cbc2IjqoGQGZXkIWKLd6y4GlwAZ7fFLTtyww7C_Rt-K945xguZc-Q7CiGk_gToph0bwec4GmONSqcTXdFjCBT0KnjTb6209indk_UkWKcU-YpXs4DssVt2lHm-AA7eAFnSUASEHmwPxk5LEVr3QnwSMfnr8jGTwKMERCXipXIvB0cu2d024jx_DDerpiPbPq5-Hok2JFZXtEDqK9VSKpxsWle_8G9vFvP4zZkYBmU0AJbp8kAgSxSHDtJQ0HmQtypfS0AAJmqXBNqBD6_Y6HQeyga-64vCAUUfRNoduN8FAfuxzyTwq6qnKq9EQYqBy-aS6r8degp1U_5NBVRiKL0Q_zO7ss6fJ8PHiszOYtvobdyTl2hrEoxytxWkBoHaHywJ-1CHdmbVqdAonzZqdm81NisnrcbsoVAvtlTqrTJc8_0uxhY6e6LPe6tJ_Xx3rIofYTbZWrlUjylklAcQs7GHHQkapcEySlvbbBdhFPQ9klBmLt5DwUqCuoqFBxQ1m2vzve-j9FRb-kFHb92smPRlq_OghrtnIXtP3DwIFa6Ac3FQv1aT0JqkRWHfyMbyCFygE-33eN3eL7UIXka741UJxncZZTExqh5194b_yJbdk2suI0wdXpohSVsF3LyEYKGet-5o8uf_d89g69GWogYA3lnxu0xqXpZxf-8T7LU65I0hpHEFkNRQa7zyCZgs95GU-vD6fgBiwAWDhE9k24OjvjvIjbmH3ShvPTlZY2702W8&cid=CAASEuRoOaJGninYGYU5kvn7_jjqPw&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&hl=en&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=530441589&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967951&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f156.1e100.net

Software

cafe /

Resource Hash

17d0957fe8b773fe99c39911d19c3254866a044437213457e1f171cf907ea0c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14039
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 3FE6 28 KB
14 KB 116ms
56ms XHR
text/xml 173.194.76.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-DgWKwqZ9HENr7dRfdZCwGTUahQQPqieUiQTUSb92WFEZTrLyb8ZtItj_Oj0v99zpMG6yE_BVZN1_p_cPSQmNCLM4PX3w&dbm_d=AKAmf-DLjL1oXW4KuLa1fyfEYa0LkR-ksAksIouRl4Phoospj7jjJNvp40UfSNEl6KSx5St_Q-2uSS_JHIpbTQNHfvTyPNisPjjo92FtbH-cMu46u7iUCoC1z-mNupEATq05d1AEgiPSf_myIvZufTlQ_-_QVd1FeBvM66jjyUgiUP3UXAl9GvDCLgH-R0_9MNClYhpW748jDPW-e1VFII4zSYTWeaiv3Yb9cNuX5Zyq1WpEw01jSRPcNu5eDrQ8pT6WVWBcdJOEwIAemmdq5YHIJRVXn1L6YEx6Akyd2_FfDNAWXIsVEMJSS-QqRDzYJbKRgwsTyPz2aZXdBHC4Zka7bzffzYbo8JJDTnSdfFDz1qt9qkwWOpQSWgd5ORVQB3j6fyNxqdh-nW2pf70C1xUlCGrk_NuSLbMR0gFORFbGwi_WTvSvTijNwyyb_zK_-KsmZMZziNqQDbQckDxTrwJQkAXnRjBUIuZcLWQRf7Ig6ZzMdHl6AKfAlbUsTQhxyTdMsi6zoiwUcIPPpX3XFf2vaDoDediJPEzNDipbnQmJFMBK5auMyF2SduzNq_01k0fXqyANp-kMzaj628NQAMfW0QQ4pYYXnKrt2mPJDRu4pDg9rssHPRVVwQzmS4htGxAN4aY2GjLOJn48t51rJ37IyaOR0K387GvJRPTGJO-CQs4qAph8F-o_Z0n0D1g9uG2rNHJ-Ge9PIQMRsVb7sHYqhEbHLyDz6dO-56ctxpJIGnfRYVHCmA3LHbq9-pHcXPGxhLq6KU2bvfZP6QiOuE17uu1AlrLkq4M-NAlmZUxeOEF91byy-FAo88vb7nO0xXHztJwVxwfIJDQMxf0Vi9GnQoq5T9xwb97sw1XiTs_9uiwS7FN4IcpyUhj0ZWrx_4D6RPh5bur83ZABQfynsS0iPQeAuYuFP15EyAX1EcxomHEJRLmWexWOP0Cj90HK1RXbKzSWBjXV79l7luxOeKlRlCIQAfsJzJhbA89vCbYTc8rQHnfvZ5D4zyoMmeW3_K-eF8lOjwJ0C9C61xrevhVY11LUN6BwlzA3bpzop-lS_92nuf101v1n-m5aDjcKbNcO3WN_TUSWhtmKmX6n_66NLsfW9Szvp15XA1SS1o17sII25_8XFyqq-MK-iiBXEvGk-izDoImoQFx8wFZVc3OcNrLJBWhx_jcZIb6j-JYpGto88vuzcn0ReS9zq66-GnyJ6i44iK9yFq3DxNqZg7NOb1E26jAJboZqnz39uWG6PprybqTo_JV5H1cuVtRn8zPyrftTv-6AKn6W4m8sVnfbb9ri51de7xO6RAuGBaP6CoHCK0ZYiASOngW1-1x2-iZ8blSfyEXzVM-0K6F1UFeGRc18YjG-cB9wiOO4EOYAS1FhIrb3Ezf3xTOZX4r00rNwDW2UmxPJt78XYLQo1SlZB0sIwDyZ5YY4tvmUqGMmcTSu-noZCaz-rbWOq5O0NWMD0vuwWu_baCiszj6iLUyiKqBurx5-ajZRrPP7KZbpHEdKc4biSdwLbvH-UtZYG7mH40KANKkUIFTQn44ur22oeX6gDZPvduT0RReaLV2H6tWNt6Gg1WN3g-bwubnlOk3O4M23wBNMAJwlIL5Pc3HNydUjYqbNAUAzG5yFFIasGCwNGYcAxKzJRkIHCeNFyKw5DsdKNZyJGCfu3hWcP4m9Rt1Xch6wuYibGwCrcXlFj6AncMzK5E27HuEmJSL99funghhLLr_KieLHF-z1O7u6Plyou727DmnT5AsAIAQTRpkb1oyftwQjSl0_KiCiPIii-50BBwf1EDYCMK8gjcWyRWY7XR_rllCaVllFSzbv9elkaUIcLaFOZ33nCbc7U2hroB64HINMFJWbJOhcNr43EdBKLL9i04Q7Jyodbyq2tnOSyPp9N3sjd66X9kU5Hhoxq8PW7hh-yxp0yIUP9G9jtY0VqDM7VMapoezmL9OzvkFqxYYgejptA8CvTJGv8Y-aqh-Xn5S0CXECWqRVRYzLNK8BWBxDd-t1a4bXQsofq-8_czUYrAI_7SQCw8uskqjKsBaxqlDX2Fz7mi_nUQJDgZh1vtNbytphVUJS4duCGG3T4-UWev931kKdHfpjvDQhLdrZnZIUgdGpVR8Q0qfPyJkIdV9dpIlta_nPOmVbMSKtgvdNOuHGRnnhMBQUzmvmJ9Mp8_QhMaGna8Ur9yAfo20MFOLMfEZ5NQTbgXVbVqJTtgopnKXhU3Gblf-Bqn5ZTy_FfrzOdSJKYXRyouRikqxA9QPxY2KdyXPx3qx8R5d9QPu5q1VyAyuu66p3uO2Mt0lvmZBRoI2C3XdDnSlZUlt8C45Vi8OzqNYhdCqe0piTt78WCsxAXmSw04Qw7nRbmOJ--QhmiNXQqt31QG_jEIMH7GVZeFV-ftUdOhbRSspMWAfdoj2PTxKWoLnut5jgynZFQDUZPzMsuSGI0CSZOHgU3i4nUFFKzhHu2hPBiO0eOkhEgmUJOZSFTVcugRviUxGHatVmSEoNmnByK4hmgQQKllGqOn8K02cJFcWHbfe1aAEZUApOlSplgy5D7y8cBMk4dxj6R17sOlRt6v5GILSEtAkaYSS23s_82ugs6QmZbrxQnJXIPyCxKoiqAteQs8jd8g-v71PTFwNLuOFPqhntQqj95SPd1CYB9b68KL_YQV_GM9VDUMpmhyHpLdchlMZq1dGYhXu2vWpNzMmhH5bshdMVtvWdzbYeatKGN5BCWWkVLzeHeoMnEGTtcVgD2Zqrvlw_tnPTR_LvZOVOxTT8xZGWMJVA6perxat1FXj-0KeAQatlEytJDEHVEFWcKuMRl4IQKTjwYfBnZGAI-TsdYFes8EjTFgG6AAls5gxU8NE3Sc8ZNQ7nhefUSeHoBI6jHwC8gUvQsKBYMInHkygGgamgI6ZWiq4Rg0IFaCQM1WQwYtpH6imM_9re7P2B_VVrRej9r4213_-tGw9L6Atj_r0XS3biv1WsPzdo6FsViXukUI6KrTR9xnpKqLmPJTWzfao0EIFopCAjJnbt53MjR-1IYZLkDoXH_vDbqMm0Oc6l-dl0dTFxh-A3ubakwc4hXEJsydbVpo1EU-H92J0G9vI82GhGBnYp6sE0luwjuO_qcAdnyJEOv9KUSvH2Bme0FofISwKSrWZxKFBEW6qXHb-QHluuTaxxwlly0hmUwDVyYLS6AaPfEMutK1ytNT72efmwll-mDR72mFzKik16s3bLngt0l7ZFmV5NBRas8vLb05YhchJIPnm8f9MjoLBKKTCk&cid=CAASEuRoNMqqPIARbKPi0tTdbq5IPg&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&hl=en&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=711701113&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967954&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f156.1e100.net

Software

cafe /

Resource Hash

1740ffb309fb4bf8e8b326b48400fb949e09c77a639053e13a1bc816dc82c314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13886
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 83 KB
26 KB 178ms
80ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.113.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

3d1ed1affc8bef9859778b9821375af240dff09e4aa8411456d3168206ed6fe7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: gzip
last-modified: Thu, 11 Nov 2021 06:35:11 GMT
server: nginx
etag: W/"618cb99f-14b33"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Jan 2022 11:59:28 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 554A 27 KB
14 KB 132ms
80ms XHR
text/xml 173.194.76.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-DQRxQguHilmNzqe1f9h3zkOgvwXYJoSsbZutLJbKlp-OFHumshVzhkqjNrwLZGeuBs3nW8A5oc79IkRM_bgNZKsQjMqA&dbm_d=AKAmf-CkXVUPvTr0Wj1bTQ6VriJyiG0PB9rzo4gOwOHaJtMRSBgmA5UNWUCrpjr0PfzHgm4b9JJ-UkOl9v3L5JwvYVpT6CYmbJpFXanaAfJbJDa1oBsyR8Fm_V6DI7ZgM5fEEgF3mgo69Y6KzpduRA180porinPmU85H6ni8JeHQ6sj0yB8Hs3CnWP5BF66bCHAAbsaMvpMrCxyuwlIMcXhGSjKvu4-QGIeanBM3uKzMAgL8V4Lexgq0MVjURZae9naXNGixFkoZd_Hb69i8uoG4vHipfBaQm2lQGYnzwvLyeMU6bAz9yRuzK6FV54tOe4aUsofmTyxSW0N0feN2bMr1_ajn0JjuGxNuaiQvTRnDlog7MdtgFjbnYtg6MvR2YWo3ZQLBUQ26RCa77-vhELOCntwFNnAAP5LGd2ycnb_2KFgYgO8iBVvwWk59lJ4xqd_nQxnmrC0XRdvLZzaIk9RFSMdGbas7dAs_wBP2cqAXYT2BwS7okDPpsYvNaiNn59SI77ZgtDL_GhpCgeLaWvHlUAWa7Zm2X8g27mR-ZiqyaDc_V-MQLqW9ZRnB3p1Ezz_EhToquRO3E1pZsj-6WI4fR5XkzQCPJmAfHNYpR7rNn1mVbXg63gwvaaChrI6r0A3asKNX--0cLwTTClv-3V0Nj4nZVoIWSjHfhAfcJO2qzauxg8HZOJyzbYXhb6xtg86uVcHhz969Q-pnf2cllyaDxpNRdkcPYi0ag2-hzVR532T3XAnIV69rnYjfVzWWEcf8J5kYXbaCtaDivM-aE1bGnyz5sSqCVa4JNCrttFGENGUKRA1EzSTf6-fFFhfJMP5wSPw5cWtILL0kt-W-gS-VJHyvoBBfAVJnyNdwtrD1XoRqyujC3trb04oDOx7aeKq54491Ua4dZYiunS0kKj0WUlNmpgY_88BS3mII6R5KoDZUf4nbEzdYnY05CvqGNkCB3jOgwkOwg1m5Xl2ZF69Ak-tn5MwAVrPw8c3xPAlf7vmS9MBVPvx7oKSh4eV6v0sXDakOOHOAA1W4y729tEE9uGBDobh_lFEowRrS3m0_Ra7l5RRX9PtOd3Lzq0ZAOhOUjegSlv1QTHh6PhK7I_vKcNTVVg4YxSKSatkQSDASIx-V2zRBjlGORXZurBmozCOV2WRMIGosbNwMEsOsQ4e7zGPpmKBiVHuA8O1xjePbxoNtPeYhNE59tXB20rgb5IkdF21QL5-BoDjawcG-EPsy-UT_Eqie9e-TLhUPX3roCnHLeXtC7VQN8aQyALh3dGsobb5obw4K_4KcB5R9_g4J0s73LXutPuf08VsPwMCL-09--ieM4xjRxP76jz6z9NEncI_V5lRzeab453aRJmd-p9R9oyeu6gd25t_ps18YiFgZBzhqzMbk065-eJKdI6-V3IwjSoH3TGwetQ4nhihtR_lq2-HSFL6mxPqpkbWpkoB5-QeDDMiw7980eJn5Rvtq-hfC1zyNoNbd3__g-Nl6bjjHOBJ9VQsYhpg_fmSAbUEUdxCPdq-h7A0nZwGcv4HUMirrQbuY5Occ6bKoY_YrgLhRyBubZ_pSYr5cSKMFiOaaPIm9x5bB1zBaJeJuifn7WsMCaRaBPEy9E7KTT_sF4NCxxebdUCIMEsmKXjRGJ1FXnkKNKGXPADw3SUtKtFb87YHFbohuz60jZtXTq60rQ6LKleVp6m-XMy6SSDGyA5kdKq-lNM9r9nE6jxdPyHF3QVndXt2NdFAOVJcWXB-cXK99BvcrfloQbsXz2iSsDf678Z-5wHyc62g9tC8TjWHcbtFfRP3s2dfaOCHy16Mby4fE5mh6YoG0R-rmzHIbRsiCDdh8gW02jhvDwgPFzqXN2-vIYtpc5uqOjUizxld9H0G_2QieRMf16efdf2PJhq4KoSlJj-Ud2z6WWJMdGETaOkY-n78rPMByU0ts9NP8XH5UNHJzV8dLJ7SnlVnOtqRFziTAPmGRhMXr4k8fkZDVYhQj-hHL1MzzcYK3W-QbDSsVgdc69al03FYwFyGP6urqZH-90uRk8tfFTcHQQ4vbq5yLZNlsFhwmaENxxYf0DV-pLxSmVWTAUvOA4Nu0MYzpKLYfE8nF3BxdbptysKJP5sWhBQY8_BFxmwLpwNnbHoPJTk9W9uVnI29q8pmAg8_bCggUc5nmJa7jahLHAkI7DC-CCiUg6bw0jAN50p77vpA-P3s7lHYo5dI_KqQrGUS8RXnAN43AMsMD_8RQDYKeW_7o8AVXSP0YKgkUI25jN4136XRMviOZ671MvdvOevGEajGPiLDyhvPBnn9NO43gCrzCqi4CBcWuM-2avhZ3ftszpa7hWX80vfmbe0XQRtrRpriPBlrQXwqYpSpBAkhomC8LWefB2GFmzsGSZd2-ahJB421yNTQkPP0gx7uvonRAjbuYZydGXNevYENAzCf_DQ67Y26cBfL65_qGjLTvx38aXj4KT86OKWzDzr28WNoLqNycoibshW1NU_ltHGcTOrs5Jqf1sLp94AxNyRHPiXCqXWqWTjIomS5cjHxUpMczCPFOVFwKdFNDC5WRhzKUASvER6nqfk4uAhXFR4P15Bw4VY-OwW0_PhUs4bFskdqIJwg43xzxnmpXYO2qOTXfElY0ZBTtuJYzGgBRPCkSngtjhL3M4RpCIcsFwQ1v4N2SrfP8uuTLd2ujXRSkQIsv5NwfYp5o8-0e_t3_JK3L0vuulplsF0g4EGVW40lyebfxWnWm3ld02YKJGJLecQS3GdN0jYodVObHo3J6PVHOdbL1zMugjZI8OWBNdlsBg05YIYeq-TfERHNaULC9VFJ6-BsV8HYTrtu-_yQ-skGb0jD4RSw6W2dqgzh4-QqX17lCvsbszWRZLV6pZBIKrqQWIaykq3nsydpp0MD1RUiyBWxDwJbbsviC5mBGVKGXhmzLzKfQBOM536AvzT0wUEZjIJgbs4w5eEf0fZXlMVk6Xo_M-rky3kSR2n7-Mayo5b-C-MUDu7r-gP4fbuSYDNMWtYply01QAalHe1WeGAk9wLGC0qFd1dON91N9Ab8uuZnBrg9lKJvwZjqLr_ZHBswkidYwIjmJyunGRyj4VcpU19dkMdOtwz7C1F0sr8GFFCBZRvL2CuNrKw9GFVUnT0rbejQWmsw8bLsbaMHxTE1wXhUeQxgXVok3acnnY8Y1cNdPS5H2KgYWWdTBNBUabgg8wsLm6pzm7zN1VffOoxqHLwNvyWXra98b-8qm0Qb4E9nqS929raKi_Ow_w6E7NpzKlz8SxyGH&cid=CAASEuRovZ2ZxXQfqChfbOD_DXv4OA&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&hl=en&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=4043538810&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951967961&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f156.1e100.net

Software

cafe /

Resource Hash

c694d867a647073962b327101068268b2aa3e0f4d913f5c26e4625a42eece9f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13853
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
servt.modoro360.com/ 0
94 B 286ms
98ms XHR
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 31 Dec 2021 11:59:28 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 0B55 598 KB
194 KB 30ms
29ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197339
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 44ms
43ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame B2D7 156 B
142 B 160ms
159ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F21939239661%2C22377873257%2Fapl%2Faniplay%2Faniplay_650&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=1467987639691650&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=4137401565&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dlt=1640951965587&idt=2300&dt=1640951967978&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=2550514942208800&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 7CB0 37 KB
13 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 0B55 156 B
142 B 175ms
174ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F21939239661%2C22377873257%2Fapl%2Faniplay%2Faniplay_550&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=1635327597876473&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=395720405&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951968135&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=576602175107354&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 3FE6 0
327 B 780ms
252ms Ping
image/gif 2800:3f0:4001:82e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kxucfllc&c=982503030237&slotId=491251515118.5&qqid=CJz-_bj-jfUCFRAEiwodnhAPng&gqid=n_DOYanfI9C03gP1-KCIDw&fb=ima_html5-lima&sdkv=h.3.493.0&mrd=4&aab=1&itv=1&eee=missing-element&bi=missing-id&wta=1&ghmsh_eids=44730464%2C44750604&vmfc=18&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2800:3f0:4001:82e::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://imasdk.googleapis.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 41ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
pubads.g.doubleclick.net/pagead/ Frame 3FE6 0
0 70ms
69ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/pagead/adview?ai=CdZxGn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAZgEAKoE7wFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMjxBjfcndsL0-bPcNznQLAL8wNBg80mmvXNruJ9TgfncsXJuTzcKO_U9NAOUxQ77fsjgVB5c1k8hujAG8AE1qiP0scD4AQDiAW_oJCvLpIFBggbEAMYApIFCAgiGAFI-qdTkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcKEM-5ehjYlNW9AdIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA8gLAbAT1JvNDcgT9qCdCdATANgTA4gUC9gUAdAVAYAXAbIXHgocCAASFHB1Yi00OTAzNDUzOTc0NzQ1NTMwGOTDDg&sigh=cRSeNfav_fI&cmd=Ch1jYS12aWRlby1wdWItNDkwMzQ1Mzk3NDc0NTUzMBAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&cid=CAQSOwCNIrLMiCKPJhE-nesSPsglB-UbBGPVn5zj2fu1cOwRAx43vDOdxxoSP31uYhnLQ9ak9IvaxO7KfZLX&vt=10&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKbggBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVIzCNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTVAAWhAyU2RDWHNqOHZrZERYTi13GAE.
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ Frame AE4E 0
54 B 750ms
254ms Ping
image/gif 2800:3f0:4001:82e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kxucfl4d&c=982503030237&slotId=491251515118.5&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2800:3f0:4001:82e::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame B5E9 598 KB
194 KB 29ms
29ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197340
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 42ms
42ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H/1.1

206
Partial Content

49
r2---sn-aigzrn76.c.2mdn.net/videoplayback/id/f00f8e4b569c5b36/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855676/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m...
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/f00f8e4b569c5b36/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855676/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
https://r2---sn-aigzrn76.c.2mdn.net/videoplayback/id/f00f8e4b569c5b36/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855676/sparams/acao,ctier,expire,id,ip,ipbits,i...

3 MB
3 MB

110ms
21ms

Media
video/mp4

2a00:1450:401f:6::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-aigzrn76.c.2mdn.net/videoplayback/id/f00f8e4b569c5b36/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855676/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/670F5CEE0CC1FD97790279F559FE1FF2515D0319.421D4087527355F967C4727BB7DC7764817EA40A/key/cms1/cms_redirect/yes/mh/ws/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrn76/ms/onc/mt/1640951560/mv/m/mvi/2/pl/49?cpn=2SdCXsj8vkdDXN-w&file=file.mp4

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

HTTP/1.1

Server

2a00:1450:401f:6::7 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

30a328372875c0d240dfee18ee9fa26627dffaa22f8764f717cab1bea89e878d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Dec 2021 15:01:15 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-3224000/3224001
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 3224001
Expires: Fri, 31 Dec 2021 11:59:28 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r2---sn-aigzrn76.c.2mdn.net/videoplayback/id/f00f8e4b569c5b36/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855676/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/670F5CEE0CC1FD97790279F559FE1FF2515D0319.421D4087527355F967C4727BB7DC7764817EA40A/key/cms1/cms_redirect/yes/mh/ws/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrn76/ms/onc/mt/1640951560/mv/m/mvi/2/pl/49?cpn=2SdCXsj8vkdDXN-w&file=file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 678
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 59A8 37 KB
13 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7ECF 32 KB
10 KB 48ms
48ms Script
text/html 104.89.20.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.20.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-20-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 74f332fda98824d1033add01751ac3b1ec510886383b348fdb14fd1ad91f77c9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=17184-d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:28 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=65902
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9702
Expires: Sat, 01 Jan 2022 06:17:50 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 7ECF 284 B
536 B 155ms
34ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Content-Type: image/jpg

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame B5E9 156 B
142 B 169ms
168ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_700&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=2133512510710224&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=2455626994&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951968339&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=2802406022182780&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame A482 598 KB
194 KB 30ms
30ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197340
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 43ms
42ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 0810 37 KB
13 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 7ECF 0
239 B 312ms
35ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=17184-d
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 70ms
70ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame A482 156 B
142 B 222ms
222ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_650&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3539652959722475&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=2432591800&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951968499&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=4147317923593367&ged=ve4_td2_tt1_pd2_la2000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 3FE6 41 KB
15 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 14:56:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248567
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Dec 2022 14:56:41 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FE6 0
20 B 98ms
98ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3FE6 0
24 B 121ms
118ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv9vvabUOCmOu3-3iWr1KqQcfXMPBeB0o7Roq8Itr8iM9pextYn78DKQ5t3aDjr2U5lNEpUQOD7_gafeFS58WJl73jv34Tt9WZwjulA-viw91HSDSSpefjbk0Oh8Rm-eAtc12nvk8fv1ejCDD5GO3pWJ9nLzk50E0NzkjhGgyenneUdXtRG4X9Hs4i-qSAGkcLZDUemRxz-qh7c78v3ge009KkIAUrTM1Vk-uZXzl51jtwGKPvE6FDGjedbKkiVpD27cAKr8O1TX8DaqvJVMWoVBnoouOoOyj5Ol5NJZJbp6fFChOcxw2Is2YDuVnrFejgnAnhDjupVt8RORAHr_NgedpqhwMg2VWKdx0kvwfkMiNSGokRFHgLlhVZUjgU-kDYsG-1iOjK9EumJPGa2L4BL4IpNj6anmRj75xTP-PKorEg2kKDVmVafFSUVHraunQM7gKjqY9hgp1YQ9AEm2Bf9Et7inge9Tobe0VFOMMTUPiYInRgLDK_TV3wupECyxu6fl32B4aArYOZIpN45Pm9W2TmRtjnBK8TejJNn7LdNmhEam4D7IVpPVqaJlSAL5vGlz74_50M_YTTHN-pCJmH_hm1paGwJDvgzpxIoo8pwYMyPyVNwssBsh29hjRFMqEUMtROt9Chb0ReEe8BwILHKqXn61_kYlH9Oy-XF6xkLD5F6YfXFJKbmcySRrOVhdQTVETKxVf7GH0-3y4WUdbQ2WZ2JGsCfMdImqNp9VvxNiQGPm7g79umbA7XgVh1w1UU55lLBCOhSqdNIwavblcssBOHsH6Qap8Gj7TvCfb7EfiCQbqM8bu6xEgHu8ur5mQFRPidaNPSluB0NEy-gOj-68poLoe5GalFBqpbUfDWAHaSguXfrsHOzLnjeLphg5yxvXD1y7_Mwuvsd0AHvfyIjJ0xhhyrBe7FAYHg4xV1_RXKGyPN7K5H8PbfIJqMC1PnlBXYHKXuQUxpC8GMjOSjAhA7Q20ZZUM5nuWnngua8rZnEeg3HEg4OgQRQCdgY5XRXw00ddg6amB1zRB9vetRoEOfNU5xVokmumQk8qZ-hebmQEQUz_tn_YDkOmMJezmBIDsilRELZWUgi_LtghP3BANMWgLf3utwAXKvD33C3hKgsXv945Ug8Pq9lAE6MFmtWU40YjH8SB8yPay3LwygCn6A1FuwPaqtSxvRGjxmVKtqhBFfHkiLyqijoPq-6aEv5VSXK&sai=AMfl-YRvnJ9Zt2St8-xYd5rryPYzKB9Smu_ENozDMhbx_IPRP2b1hht2cVVgSEVLDS3HLL6Tk-styizDFiqqEBjIbacfsl9ahf0qPodUo59L3ZvuHgu9aKOzkmK18bLK6hQsz5pxfFIprBMX1jCwTyipTf1aQN7aDg&sig=Cg0ArKJSzELdsDgmksP6EAE&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&sdkv=h.3.493.0&adurl=

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 31 Dec 2021 11:59:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame 3FE6 0
0 65ms
61ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNf8bBCW0cICGNiU1b0BIAEwAQ&v=APEucNWHTsB2YuHKbXSqu1PK52thsMTNlfl8Qbo7T-F9hX_8f4ZfrXmZvAohr6zKXle2_LweqtkUwYQGWK_DicjsY3D6ZjJm5Q
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 64ms
61ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=vast_creativeview&ad_mt=0&acvw=sv%3D914%26cb%3Dima%26e%3D19%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D21802%26vmtime%3D-1%26is%3D275%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1609%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26am...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 188ms
125ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 3FE6 42 B
64 B 116ms
113ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvMJLiCOlcQmhWmlrIMtTR3BUc69WxdwfqHSIZtGGD9Utmc2G0UhuvMNyuyBB2JjOof0l65NVbzkjzlPcwwJ3Db-PPss87-BVCPpMLBJcfFDPOJCBJbYg&sai=AMfl-YSl3LipNj57y6q6YGDYosKD4I4eBdZ86iqOOPEUMaxRYHA_pw52vWUhUUvfNfY7PUlh9aYPM6ZDto8x2Qr1zbjrCZNQYUjWdPzis5GA-nCyiiLKZvFfTKtztvI&sig=Cg0ArKJSzM8rwm2_AEY0EAE&cid=CAASEuRoNMqqPIARbKPi0tTdbq5IPg&id=lidarv&acvw=sv%3D914%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D21802%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26ic%3D274%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1611%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951968203&avm=1

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amt...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 187ms
124ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D21802%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26i0%3D275%26ic%3D0%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1612%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951968203;dc_rfl=1,https%253A%252F%252Fweloma.net%252Fwem%240;ecn1=1;etm1=0;eid1=11;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 63ms
61ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=part2viewed&ad_mt=0&acvw=sv%3D914%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D21802%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26i0%3D275%26ic%3D0%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1612%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D13,0,0,0,0%26mtos%3D13,13,13,13,1...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 188ms
126ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 63ms
61ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=admute&ad_mt=0&acvw=sv%3D914%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D13,0,0,0,0%26mtos%3D13,13,13,13,13%26amtos%3D0,0,0,0,0%26mcvt%3D13%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D13%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D13%26pst%3D-1%26dur%3D21802%26vmtime%3D-1%26dvs%3D13%26dfvs%3D13%26dvpt%3D13%26is%3D275%26i0%3D275%26ic%3D4096%26cs%3D4370%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D2%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1615%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,13&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 209ms
209ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=impression&cb=1640951966453&ad=21&vi=100&d4=1&d5=2&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
servt.modoro360.com/ 0
70 B 208ms
208ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=[AV_ADDURATION]&vi=[AV_VIEWABILITY]&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=start&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:28 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame E559 598 KB
194 KB 76ms
76ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197340
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 97ms
96ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 225D 37 KB
13 KB 87ms
87ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 665C 23 KB
9 KB 87ms
87ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Tue, 28 Dec 2021 14:56:41 GMT
expires: Wed, 28 Dec 2022 14:56:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 248567
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 csi
csi.gstatic.com/ Frame 3FE6 0
54 B 309ms
257ms Ping
image/gif 2800:3f0:4001:82e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~kxucfm3j&c=982503030237&slotId=491251515118.5&qqid=CJz-_bj-jfUCFRAEiwodnhAPng&gqid=n_DOYanfI9C03gP1-KCIDw&fb=ima_html5-lima&sdkv=h.3.493.0&mrd=4&aab=1&itv=1&gpm_i=18&gpm_c=18&gpm_a=15&smb=1000&br=986&mt=video%2Fmp4&vs=360x640&webm=4&vp9=0&vamt=video%2F3gpp%2Cvideo%2F3gpp%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fwebm%2Cvideo%2Fwebm%2Cvideo%2Fwebm%2Cvideo%2Fwebm%2Capplication%2Fx-mpegurl&hvmf=false&vms=1&bit=343&vsrc=doubleclick_dmm&met.4=ff.kxucfmd7
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2800:3f0:4001:82e::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://imasdk.googleapis.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 70C6 42 B
64 B 62ms
62ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsueACTPu1ffnZw9woHCZpqxlAHk_w-HYh-HQn53iSZovcXT8nGHf9zYvlXD-ugLXax3t916UE4bAzvj9Zb6o3d-kw&sig=Cg0ArKJSzOlj5uTNLi50EAE&cid=CAASF-Roxzpu9ID9JSwhHX9Lcb9pumSdL0KA&id=lidar2&mcvt=1016&p=1101,641,1139,961&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=9&adk=2666999317&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1640951967195&rpt=509&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
servt.modoro360.com/ 0
93 B 94ms
94ms XHR
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 31 Dec 2021 11:59:28 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame 665C 35 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:41:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163090
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Dec 2022 14:41:18 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 6E6A 598 KB
194 KB 30ms
29ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197340
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 41ms
41ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 422D 37 KB
13 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame E559 156 B
142 B 166ms
166ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F21939239661%2C22377873257%2Fapl%2Faniplay%2Faniplay_200&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=356434643042148&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=3677803291&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951968930&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=1198949308323861&ged=ve4_td3_tt2_pd3_la3000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts1_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 6E6A 156 B
142 B 166ms
166ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_400&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=165850183753007&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=749032206&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951969061&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=138949599353950&ged=ve4_td3_tt2_pd3_la3000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 665C 0
22 B 66ms
66ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.3.493.0&bgai=BJMP9oPDOYYmWAs_1bI-3kKADAAAAADgB4AQC&bg=!xMelx4PNAAZKWFskSlg7ACkAdvg8WkEZQYe-3dPOqsGz2JY4RanhCi9iok0M5t2oFRmgLHv3jcbgtQIAAACqUgAAAAloAQcKAJwTvgXehqLp8N-oj5untCylD-C8-K25u0m8nChyreViRkcplFvJOx_XTDZHEkoaD3tJL9Cyv4ivOmXKknkfAa1EZg58eycVeYZmz9B5xQX0f_KB2jSS1dfZHPSiTU-kOXqtku8JH_y5PJ5mk6ARu_L7S1RqrZzbUqTvPqti0-eyQmyPi8hJiWCHPEMmLo33bNJQW6vA3Q_7iy_CCi2ZAthdSfnk04O76rrLFnvJaAVFShEpIG5Wh8_JMSpu7Egkgpl6EdHyxMlALIPidmg9Ft7VwxY_r6CJ5_kdILUOpnkAmMiuJJe8z0UHxjk_JDmGOOMmZEfdM7QvEUS3f1m8mXFGXbWEIEII-lB2RBTe6a0aJJHpvjGrClpnNTbYDPG7THbvzAuGQiI_4DdD0Hk28nuSzdRd_mc9KvKUnzFwQoLzdqjhIBdgTSiJ3wi4DJiU21HnjmDuDUkWtSICaAwYxUgp-AyMp1mJQAleej4CB8lLe0X46N4jr1LwEqpW97exTCwBL6FvxA3Ec6R3vXmaQKj49DOJ9QS-40tU-XbZtvImy8MV9_9le0hFZd5HN-Wmz3dJWunAENSFdSYxpUX3nDIprvAKCnD45QXJaP-lZ0W-vMtXYQ43BcLBFCzVroynFtA1lllhAtThK4B1sXaK81uKcCChNsj5c3CdVNCdelmh0BB3kXchBNBvKb9_v22SUoIuSadsHTcwPDsRkHpjjOAF2IrGNHW-hb9LE3p19upnXpC0qj3t9o2PFaUUS1zEne6rsxvg0cVN6Y76pwC-tPrgVwkrQunV3mwDFxqOlkJsvzuDybe6YxnANZwQ29wt7xTu40Zw4ElPXkHK2hG_6Q3zLihSy6yfiJ9FcoxeR_W9tYMKDIc8jhGwEEV-FTZTYHsL5ZHxdvY3chxaeWfyNl_oP2Jv4QoxQPf6-w8OIsHcbPtcyf3lnSioAs99asAagNSLQbqzmd_62Yzoqg3v7Jpovms6VoB9p6sVKvv9IChE5HCZx7ubZ21a4dmPnw8WT4J8FHDi5lngkEa8r-eZGpVVKeYriHsKjN-4ubmL6L57h51IH2UOcYy7j8i2kIE401Z3t4MpYdOsbrTre3e0_pGGsjOrRj36m6Nt7uEoUXAIsW3snoSKdz_I3rDPWgJjGk8cMhQreOtzxOvjxspTFM_6Y9ZRXSbQNw

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame E6CF 598 KB
194 KB 30ms
29ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197341
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 42ms
41ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 4F24 37 KB
13 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 bridge3.493.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 88F1 598 KB
194 KB 29ms
29ms Document
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef447194c4f88706e59e91d4dd03aa925cd6f5d30ae87b863c8fe282153c2fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198942
date: Wed, 29 Dec 2021 05:10:28 GMT
expires: Thu, 29 Dec 2022 05:10:28 GMT
last-modified: Wed, 15 Dec 2021 20:12:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 197341
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4E 107 B
122 B 40ms
40ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=weloma.net

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 31 Dec 2021 11:59:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 020F 37 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 31 Dec 2021 12:56:35 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame E6CF 156 B
142 B 141ms
141ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F7047%2C22377873257%2Fapl%2Faniplay%2Faniplay_550&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3090255421406928&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=2518298614&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951969373&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=757430584755303&ged=ve4_td3_tt2_pd3_la3000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 88F1 156 B
142 B 160ms
160ms XHR
text/xml 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F21939239661%2C22377873257%2Fapl%2Faniplay%2Faniplay_450&description_url=weloma.net&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=4448088894489091&sdkv=h.3.493.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=3783232292&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.493.0&sid=682724BC-1632-415B-90D5-5D810FC6C92C&nel=1&eid=44730464%2C44750604&url=https%3A%2F%2Fweloma.net%2Fwem&dt=1640951969462&cookie=ID%3D770a9a7b9ca4a162%3AT%3D1640951965%3AS%3DALNI_MbVhz2-q2UlA61V4GRkFC6zxswLeQ&scor=3101675758622404&ged=ve4_td3_tt2_pd3_la3000_er870.9.1025.309_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 76ms
25ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fweloma.net%2F&domain=weloma.net&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://weloma.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: https://weloma.net
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1779
date: Fri, 31 Dec 2021 11:59:29 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fweloma.net%2F&domain=weloma.net&cw=1&pbt=1&lsw=1
https://mug.criteo.com/sid?cpp=xtWObXxHbk9uSDhWZVU3a25idis5eUFEWk1XUUlXSjJLV2hRMEpsNUtFMkJoVjlvUjU1TDVTYXBGUmhFRkMvSXRNUWVTbTNoMjZ4Z0o5Yk55QlErUzA0RXozckFjNUp2R3QyVVh3TG9LOVBxVUFISnk4QzhvV2JFQVhaQm...

342 B
611 B

77ms
26ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=xtWObXxHbk9uSDhWZVU3a25idis5eUFEWk1XUUlXSjJLV2hRMEpsNUtFMkJoVjlvUjU1TDVTYXBGUmhFRkMvSXRNUWVTbTNoMjZ4Z0o5Yk55QlErUzA0RXozckFjNUp2R3QyVVh3TG9LOVBxVUFISnk4QzhvV2JFQVhaQmhCWmJVUEl1djJkcE9pRnVWVzMrVVI4TmpraVFpbysxL1ZYRmxpODMrR2hmMm92QXA2dTNaSFhvcEl6YTQwdzFvbkRhQ3QxVkdUc0lnVVAxZElCSU9oZ1F4dlRrbDdvM3k4ckxTazZOT2g3b0k0dlFkbVNvPXw&cppv=2

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

84ed16f685fe2e709756f9bbb4528475b39c4312c4ff9c27a1d5c3b4db8f2697

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:30 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2395
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:29 GMT
location: https://mug.criteo.com/sid?cpp=xtWObXxHbk9uSDhWZVU3a25idis5eUFEWk1XUUlXSjJLV2hRMEpsNUtFMkJoVjlvUjU1TDVTYXBGUmhFRkMvSXRNUWVTbTNoMjZ4Z0o5Yk55QlErUzA0RXozckFjNUp2R3QyVVh3TG9LOVBxVUFISnk4QzhvV2JFQVhaQmhCWmJVUEl1djJkcE9pRnVWVzMrVVI4TmpraVFpbysxL1ZYRmxpODMrR2hmMm92QXA2dTNaSFhvcEl6YTQwdzFvbkRhQ3QxVkdUc0lnVVAxZElCSU9oZ1F4dlRrbDdvM3k4ckxTazZOT2g3b0k0dlFkbVNvPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://weloma.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1825
content-length: 482
expires: 0

POST
H/1.1 200 692.json Show response
id5-sync.com/g/v2/ 213 B
528 B 133ms
31ms XHR
application/json 54.36.109.183
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/692.json

Requested by

Host: player.adtcdn.com
URL: https://player.adtcdn.com/prebidlink/455819/hb_323303_10647.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.36.109.183 , France, ASN16276 (OVH, FR),

Reverse DNS

p08.id5-sync.com

Software

Resource Hash

8011ad13e61c0d9d287685f6505c5b79472744099ca0177d8d010537e05dc661

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://weloma.net
Date: Fri, 31 Dec 2021 11:59:29 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 386ms
26ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1341
date: Fri, 31 Dec 2021 11:59:29 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D2106,0,0,0,0%26mtos%3D2106,2106,21...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 66ms
66ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D2106,0,0,0,0%26mtos%3D2106,2106,2106,2106,2106%26amtos%3D0,0,0,0,0%26mcvt%3D2106%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2106%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D521%26pst%3D439%26dur%3D21802%26vmtime%3D1798%26dtos%3D2106%26dtoss%3D1%26dvs%3D2093%26dfvs%3D2093%26dvpt%3D2093%26is%3D275%26i0%3D275%26ic%3D16777217%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D11%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483645%26psv%3D-2147483645%26psfv%3D-2147483645%26psa%3D0%26ptlt%3D3708%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2106;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203;ecn1=1;etm1=0;eid1=200000;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 3FE6 42 B
66 B 69ms
68ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvMJLiCOlcQmhWmlrIMtTR3BUc69WxdwfqHSIZtGGD9Utmc2G0UhuvMNyuyBB2JjOof0l65NVbzkjzlPcwwJ3Db-PPss87-BVCPpMLBJcfFDPOJCBJbYg&sai=AMfl-YSl3LipNj57y6q6YGDYosKD4I4eBdZ86iqOOPEUMaxRYHA_pw52vWUhUUvfNfY7PUlh9aYPM6ZDto8x2Qr1zbjrCZNQYUjWdPzis5GA-nCyiiLKZvFfTKtztvI&sig=Cg0ArKJSzM8rwm2_AEY0EAE&cid=CAASEuRoNMqqPIARbKPi0tTdbq5IPg&id=lidarv&acvw=sv%3D914%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D2106,0,0,0,0%26mtos%3D2106,2106,2106,2106,2106%26amtos%3D0,0,0,0,0%26mcvt%3D2106%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2106%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D521%26pst%3D439%26dur%3D21802%26vmtime%3D1798%26dtos%3D2106%26dtoss%3D1%26dvs%3D2093%26dfvs%3D2093%26dvpt%3D2093%26is%3D275%26i0%3D275%26ic%3D16777217%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D11%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483645%26psv%3D-2147483645%26psfv%3D-2147483645%26psa%3D0%26ptlt%3D3708%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2106&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 99ms
98ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=adViImpression&vit=2&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:30 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
servt.modoro360.com/ 0
70 B 99ms
99ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=sec3&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:31 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

POST
H2 200 track Show response
servt.modoro360.com/ 0
93 B 92ms
91ms XHR
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=61522ae545833a0b2b769c04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 31 Dec 2021 11:59:33 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D5606,0,0,0,0%26mtos%3D5606,5606,56...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 68ms
68ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D5606,0,0,0,0%26mtos%3D5606,5606,5606,5606,5606%26amtos%3D0,0,0,0,0%26mcvt%3D5606%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5606%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D594%26pst%3D439%26dur%3D21802%26vmtime%3D5532%26dtos%3D3500%26dtoss%3D2%26dvs%3D3500%26dfvs%3D3500%26dvpt%3D3500%26is%3D275%26i0%3D275%26i1%3D275%26ic%3D0%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5606,5606,5606,5606,5606%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D25%26emuc%3D0%26emb%3D25,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483585%26psv%3D-2147483585%26psfv%3D-2147483585%26psa%3D0%26ptlt%3D7208%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,5606;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203;ecn1=1;etm1=0;eid1=960584;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 43ms
43ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=videoplaytime25&ad_mt=5532&acvw=sv%3D914%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D5606,0,0,0,0%26mtos%3D5606,5606,5606,5606,5606%26amtos%3D0,0,0,0,0%26mcvt%3D5606%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5606%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D594%26pst%3D439%26dur%3D21802%26vmtime%3D5532%26dtos%3D3500%26dtoss%3D2%26dvs%3D3500%26dfvs%3D3500%26dvpt%3D3500%26is%3D275%26i0%3D275%26i1%3D275%26ic%3D0%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5606,5606,5606,5606,5606%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D25%26emuc%3D0%26emb%3D25,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147483585%26psv%3D-2147483585%26psfv%3D-2147483585%26psa%3D0%26ptlt%3D7208%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,5606&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 101ms
101ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=firstQuartile&ad=21&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:34 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 publishertag.prebid.113.js Show response
static.criteo.net/js/ld/ Frame AE4E 85 KB
27 KB 51ms
50ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.113.js

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/avpb3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

e6969b69570c743952ab51b9fba22410be503db91b0566753d6da10894e76dad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:34 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 12:50:31 GMT
server: nginx
etag: W/"6138b197-1532d"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Jan 2022 11:59:34 GMT

GET
H3 200 dc_oe=ChMIjaCTuP6N9QIVguW7CB30jwDvEAAYACDt07g6QhMIsv3zt_6N9QIVo1blCh3P0gVo;met=1;&timestamp=1640951976567;eid1=2;ecn1=0;etm1=10;eid2=12;ecn2=0;etm2=9;eid4=14;ecn4=1;etm4=0;eid6=16;ecn6=1;etm6=0;eid...
ade.googlesyndication.com/ddm/activity/ Frame C1E1 42 B
63 B 64ms
64ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIjaCTuP6N9QIVguW7CB30jwDvEAAYACDt07g6QhMIsv3zt_6N9QIVo1blCh3P0gVo;met=1;&timestamp=1640951976567;eid1=2;ecn1=0;etm1=10;eid2=12;ecn2=0;etm2=9;eid4=14;ecn4=1;etm4=0;eid6=16;ecn6=1;etm6=0;eid8=960584;ecn8=1;etm8=0;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 116ms
116ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=sec10&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:38 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D2%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D11106,0,0,0,0%26mtos%3D11106,11106...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 67ms
66ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D2%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D11106,0,0,0,0%26mtos%3D11106,11106,11106,11106,11106%26amtos%3D0,0,0,0,0%26mcvt%3D11106%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D11106%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1121%26pst%3D439%26dur%3D21802%26vmtime%3D11031%26dtos%3D5500%26dtoss%3D3%26dvs%3D5500%26dfvs%3D5500%26dvpt%3D5500%26is%3D275%26i0%3D275%26i1%3D275%26i2%3D275%26ic%3D512%26cs%3D16782099%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5500,5500,5500,5500,5500%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D47%26emuc%3D0%26emb%3D47,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147479553%26psv%3D-2147479553%26psfv%3D-2147479553%26psa%3D0%26ptlt%3D12707%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,11106;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203;ecn1=1;etm1=0;eid1=18;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 41ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=videoplaytime50&ad_mt=11031&acvw=sv%3D914%26cb%3Dima%26e%3D2%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D11106,0,0,0,0%26mtos%3D11106,11106,11106,11106,11106%26amtos%3D0,0,0,0,0%26mcvt%3D11106%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D11106%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1121%26pst%3D439%26dur%3D21802%26vmtime%3D11031%26dtos%3D5500%26dtoss%3D3%26dvs%3D5500%26dfvs%3D5500%26dvpt%3D5500%26is%3D275%26i0%3D275%26i1%3D275%26i2%3D275%26ic%3D512%26cs%3D16782099%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5500,5500,5500,5500,5500%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D47%26emuc%3D0%26emb%3D47,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147479553%26psv%3D-2147479553%26psfv%3D-2147479553%26psa%3D0%26ptlt%3D12707%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,11106&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 111ms
110ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=midpoint&ad=21&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:39 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D3%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D16606,0,0,0,0%26mtos%3D16606,16606...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 66ms
65ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D3%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D16606,0,0,0,0%26mtos%3D16606,16606,16606,16606,16606%26amtos%3D0,0,0,0,0%26mcvt%3D16606%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D16606%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1623%26pst%3D439%26dur%3D21802%26vmtime%3D16531%26dtos%3D5500%26dtoss%3D4%26dvs%3D5500%26dfvs%3D5500%26dvpt%3D5500%26is%3D275%26i0%3D275%26i1%3D275%26i2%3D275%26i3%3D275%26ic%3D0%26cs%3D16782099%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5500,5500,5500,5500,5500%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D69%26emuc%3D0%26emb%3D69,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147352577%26psv%3D-2147352577%26psfv%3D-2147352577%26psa%3D0%26ptlt%3D18207%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,16606;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203;ecn1=1;etm1=0;eid1=960585;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 41ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=videoplaytime75&ad_mt=16532&acvw=sv%3D914%26cb%3Dima%26e%3D3%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D16606,0,0,0,0%26mtos%3D16606,16606,16606,16606,16606%26amtos%3D0,0,0,0,0%26mcvt%3D16606%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D16606%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1623%26pst%3D439%26dur%3D21802%26vmtime%3D16531%26dtos%3D5500%26dtoss%3D4%26dvs%3D5500%26dfvs%3D5500%26dvpt%3D5500%26is%3D275%26i0%3D275%26i1%3D275%26i2%3D275%26i3%3D275%26ic%3D0%26cs%3D16782099%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5500,5500,5500,5500,5500%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D69%26emuc%3D0%26emb%3D69,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2147352577%26psv%3D-2147352577%26psfv%3D-2147352577%26psa%3D0%26ptlt%3D18207%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,16606&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 102ms
102ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=thirdQuartile&ad=21&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:45 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 dc_oe=ChMIjaCTuP6N9QIVguW7CB30jwDvEAAYACDt07g6QhMIsv3zt_6N9QIVo1blCh3P0gVo;met=1;&timestamp=1640951986566;eid1=2;ecn1=0;etm1=10;eid2=12;ecn2=0;etm2=10;eid4=18;ecn4=1;etm4=0;
ade.googlesyndication.com/ddm/activity/ Frame C1E1 42 B
63 B 65ms
64ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIjaCTuP6N9QIVguW7CB30jwDvEAAYACDt07g6QhMIsv3zt_6N9QIVo1blCh3P0gVo;met=1;&timestamp=1640951986566;eid1=2;ecn1=0;etm1=10;eid2=12;ecn2=0;etm2=10;eid4=18;ecn4=1;etm4=0;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://55e124c7872cf061e33b370734c03616.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D4%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26p0%3D870,9,1095,409%26p1%3D870,9,1095,40...
ade.googlesyndication.com/ddm/activity/ Frame 3FE6 42 B
63 B 67ms
66ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIieaXuf6N9QIVzzobCh2PGwQ0EAAYACCCkepNQhMInP79uP6N9QIVEASLCh2eEA-e;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D4%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26p0%3D870,9,1095,409%26p1%3D870,9,1095,409%26p2%3D870,9,1095,409%26p3%3D870,9,1095,409%26tos%3D21939,0,0,0,0%26mtos%3D21939,21939,21939,21939,21939%26amtos%3D0,0,0,0,0%26mtos1%3D5606,0,0%26mtos2%3D5500,0,0%26mtos3%3D5500,0,0%26mcvt%3D21939%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26a0%3D0%26a1%3D0%26a2%3D0%26a3%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D21939%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D2954%26pst%3D439%26dur%3D21802%26vmtime%3D21802%26dtos%3D5333%26dtoss%3D5%26dvs%3D5333%26dfvs%3D5333%26dvpt%3D5333%26is%3D275%26i0%3D275%26i1%3D275%26i2%3D275%26i3%3D275%26ic%3D0%26cs%3D16782099%26c%3D1%26c0%3D1%26c1%3D1%26c2%3D1%26c3%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5333,5333,5333,5333,5333%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D90%26emuc%3D0%26emb%3D90,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2143289345%26psv%3D-2143289345%26psfv%3D-2143289345%26psa%3D0%26ptlt%3D23541%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,21939%26ss0%3D0.04%26ss1%3D0.04%26ss2%3D0.04%26ss3%3D0.04;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203;ecn1=1;etm1=0;eid1=13;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 3FE6 42 B
64 B 42ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=Ceq5cn_DOYdyyJZCIrASeobzwCc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0O-YVM2LXz9dtKr5VGtJpd4q1WwyB3hERNDGPv6F_oC1cDhWhYER006f8ogH1yselymgVyvdnRmpPtwPFP3iXRTBf-X9ng4-lqPxbBbKUvfnh2R0zP71nnXyVh8Ajz06Wp7uac3p6zDqqlx4yMtpQarNoZkdCdUov8oQKucgdaWJRlidjM1mPRRtncvU3JVlMiJT6nOdYitdxzjJXUoXxk_P_7ajHQkYUGf1SSrEpnl0eMipB734lcml4XQ-yH3h3xE3eL1NBXNxPlStD2szUA1beOzRK4JlSE5XBsQgS92gS_elHZVoX0HPC1HGhIS3OMAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=679My3cBSyA&label=videoplaytime100&ad_mt=21803&acvw=sv%3D914%26cb%3Dima%26e%3D4%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26p0%3D870,9,1095,409%26p1%3D870,9,1095,409%26p2%3D870,9,1095,409%26p3%3D870,9,1095,409%26tos%3D21939,0,0,0,0%26mtos%3D21939,21939,21939,21939,21939%26amtos%3D0,0,0,0,0%26mtos1%3D5606,0,0%26mtos2%3D5500,0,0%26mtos3%3D5500,0,0%26mcvt%3D21939%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26a0%3D0%26a1%3D0%26a2%3D0%26a3%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D21939%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D2954%26pst%3D439%26dur%3D21802%26vmtime%3D21802%26dtos%3D5333%26dtoss%3D5%26dvs%3D5333%26dfvs%3D5333%26dvpt%3D5333%26is%3D275%26i0%3D275%26i1%3D275%26i2%3D275%26i3%3D275%26ic%3D0%26cs%3D16782099%26c%3D1%26c0%3D1%26c1%3D1%26c2%3D1%26c3%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26qmt%3D5333,5333,5333,5333,5333%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D1%26ces%26femt%3D701%26femvt%3D0%26emc%3D90%26emuc%3D0%26emb%3D90,0,0,0,0%26avms%3Dexc%26qi%3D42371945%26psm%3D-2143289345%26psv%3D-2143289345%26psfv%3D-2143289345%26psa%3D0%26ptlt%3D23541%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,21939%26ss0%3D0.04%26ss1%3D0.04%26ss2%3D0.04%26ss3%3D0.04&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951968203&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA5gIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4NkCPAVI2CNoHEA8lAACoQSgBOgsxNjMyMTk1ODYtMUIER0RDTUjKAlAAWhAyU2RDWHNqOHZrZERYTi13GAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 99ms
98ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230614&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=21&vi=100&ofpr=0.5&imid=90211155ab5d360092d035058011913b_1723157180_10619070&e=complete&ad=21&vi=100&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:50 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H/1.1 206
Partial Content Pantaloons-low-2-1.mp4
play.aniview.com/5fd9c7d93f2f4c6ef13a1ec7/60c13d842df1d37746608cba/ 77 KB
0 320ms
71ms Media
video/mp4 2a02:26f0:6c00:2ab::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://play.aniview.com/5fd9c7d93f2f4c6ef13a1ec7/60c13d842df1d37746608cba/Pantaloons-low-2-1.mp4
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:2ab::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash

Request headers

Referer: https://weloma.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 31 Dec 2021 11:59:50 GMT
X-GUploader-UploadID: ADPycdu-w-wwzJkzr2uUhGWM93dnQT2uAlmB-aeA2inMX0FskTuVHF4G2AgVda4ZUbTt_Zxy4RPQD9YyyxDwhlFsJSc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 1523979
Content-Range: bytes 0-1523978/1523979
Last-Modified: Wed, 09 Jun 2021 22:17:15 GMT
Server: UploadServer
ETag: "51bd3e2b33df6685925ce90bfa23eded"
x-goog-hash: crc32c=hq0RPA==, md5=Ub0+KzPfZoWSXOkL+iPt7Q==
x-goog-generation: 1623277035122232
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, range
Cache-Control: public, max-age=604800
x-goog-stored-content-length: 1523979
Accept-Ranges: bytes
Content-Type: video/mp4
Expires: Fri, 07 Jan 2022 11:59:50 GMT

GET
H/1.1 206
Partial Content Pantaloons-low-2-1.mp4
play.aniview.com/5fd9c7d93f2f4c6ef13a1ec7/60c13d842df1d37746608cba/ 112 KB
113 KB 159ms
53ms Media
video/mp4 2a02:26f0:6c00:2ab::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://play.aniview.com/5fd9c7d93f2f4c6ef13a1ec7/60c13d842df1d37746608cba/Pantaloons-low-2-1.mp4
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:2ab::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 987f4a360c146ca953ce2e8044cb9cf8827b1c6d81c31d9c238b2ca530c31066

Request headers

Referer: https://weloma.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Range: bytes=1409024-

Response headers

Date: Fri, 31 Dec 2021 11:59:51 GMT
X-GUploader-UploadID: ADPycdu-w-wwzJkzr2uUhGWM93dnQT2uAlmB-aeA2inMX0FskTuVHF4G2AgVda4ZUbTt_Zxy4RPQD9YyyxDwhlFsJSc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 114955
Content-Range: bytes 1409024-1523978/1523979
Last-Modified: Wed, 09 Jun 2021 22:17:15 GMT
Server: UploadServer
ETag: "51bd3e2b33df6685925ce90bfa23eded"
x-goog-hash: crc32c=hq0RPA==, md5=Ub0+KzPfZoWSXOkL+iPt7Q==
x-goog-generation: 1623277035122232
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, range
Cache-Control: public, max-age=604800
x-goog-stored-content-length: 1523979
Accept-Ranges: bytes
Content-Type: video/mp4
Expires: Fri, 07 Jan 2022 11:59:51 GMT

GET
DATA 200
OK truncated
/ 240 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eaa3d12c6890efadb732d28d679f37a9d9f513ac686e7de453e82000612a7536

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 206
Partial Content Pantaloons-low-2-1.mp4
play.aniview.com/5fd9c7d93f2f4c6ef13a1ec7/60c13d842df1d37746608cba/ 1 MB
0 54ms
53ms Media
video/mp4 2a02:26f0:6c00:2ab::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://play.aniview.com/5fd9c7d93f2f4c6ef13a1ec7/60c13d842df1d37746608cba/Pantaloons-low-2-1.mp4
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:2ab::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash

Request headers

Referer: https://weloma.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Range: bytes=65536-

Response headers

Date: Fri, 31 Dec 2021 11:59:51 GMT
X-GUploader-UploadID: ADPycdu-w-wwzJkzr2uUhGWM93dnQT2uAlmB-aeA2inMX0FskTuVHF4G2AgVda4ZUbTt_Zxy4RPQD9YyyxDwhlFsJSc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 1458443
Content-Range: bytes 65536-1523978/1523979
Last-Modified: Wed, 09 Jun 2021 22:17:15 GMT
Server: UploadServer
ETag: "51bd3e2b33df6685925ce90bfa23eded"
x-goog-hash: crc32c=hq0RPA==, md5=Ub0+KzPfZoWSXOkL+iPt7Q==
x-goog-generation: 1623277035122232
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, range
Cache-Control: public, max-age=604800
x-goog-stored-content-length: 1523979
Accept-Ranges: bytes
Content-Type: video/mp4
Expires: Fri, 07 Jan 2022 11:59:51 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 4B5F 0
17 B 508ms
253ms Ping
image/gif 2800:3f0:4001:82e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kxucflh2&c=982503030237&slotId=491251515118.5&qqid=CJa2_Lj-jfUCFRn2dwodx6gBGg&gqid=n_DOYbKPIoGBjuwP1qO72A4&fb=ima_html5-lima&sdkv=h.3.493.0&mrd=4&aab=1&itv=1&eee=missing-element&bi=missing-id&wta=1&ghmsh_eids=44730464%2C44750604&vmfc=18&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2800:3f0:4001:82e::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://imasdk.googleapis.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4B5F 42 B
64 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
pubads.g.doubleclick.net/pagead/ Frame 4B5F 0
0 67ms
66ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/pagead/adview?ai=CuQCYn_DOYdbqI5ns3wPH0YbQAc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAZgEAKoE7wFP0H3YdG4Q3Otxt-XHBtNIq16RvLTHgoHgGLTIs9ghlkz9Uc0zZHw0XgLGIOJYWhLhX5a6DxbQwC1Wb3Rd8bDznEwV50k98W8CjIvnqDip7oYxspFvJy398uMBcJYw5F06i1wQPiJXtKEvnjL5TeMZghRR0ypkExShPChSKqXZL9ylG7RQca0VHcZSn87UEFfJIaWru5begXkZN0xUdbIKsMliEuYnVgChR_7nokMGZAewrcEs07_rLgPK4GdabXiHF9Gb24Gl1PmT4poarm_H-LbdSHkcOnEqBstHIGjxEgFbHLBnaNl2xfhXNG5wB8AE1qiP0scD4AQDiAW_oJCvLpIFBggbEAMYApIFCAgiGAFI-qdTkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcLEPrXiAEY2JTVvQHSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTQwMDkwNzc0NzAwNTY5MjiACgPICwGwE9SbzQ3IE_agnQnQEwDYEwOIFAvYFAHQFQGAFwGyFx4KHAgAEhRwdWItNDkwMzQ1Mzk3NDc0NTUzMBjkww4&sigh=bVwGDOACo3s&cmd=Ch1jYS12aWRlby1wdWItNDkwMzQ1Mzk3NDc0NTUzMBAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&cid=CAQSOwCNIrLMJaPOUkysTb75u3yX4dqI5sNa4b2SsrgmITjcHztI3_1PKIprzqR3-w66RNOcGdM_k8O2Wk7m&vt=10&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA9QIKbggBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4MECXAVIzCNcHEA8lAACwQSgBOgsxNjMyMTk1ODAtMUIER0RDTVAAWhBqWDFsazY3VDNTbm5xMXdEGAE.
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

POST
H3 204 csi
csi.gstatic.com/ Frame AE4E 0
17 B 475ms
253ms Ping
image/gif 2800:3f0:4001:82e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~kxucfm4f&c=982503030237&slotId=491251515118.5&met.4=hvd_lc.kxucfm4f~hvd_src.kxucfm4f&ps=400x225
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2800:3f0:4001:82e::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://weloma.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

206
Partial Content

49
r2---sn-aigzrn7e.c.2mdn.net/videoplayback/id/a140f570ecf32b16/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855708/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m...
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/a140f570ecf32b16/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855708/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
https://r2---sn-aigzrn7e.c.2mdn.net/videoplayback/id/a140f570ecf32b16/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855708/sparams/acao,ctier,expire,id,ip,ipbits,i...

3 MB
3 MB

108ms
21ms

Media
video/mp4

2a00:1450:4009:13::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-aigzrn7e.c.2mdn.net/videoplayback/id/a140f570ecf32b16/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855708/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3FEFF1D0FE058261BA3AD44E748965703F0A05A4.1ED014554B10113141976E3FB50A1882AB42D3DF/key/cms1/cms_redirect/yes/mh/B-/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrn7e/ms/onc/mt/1640951560/mv/m/mvi/2/pl/49?cpn=jX1lk67T3Snnq1wD&file=file.mp4

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

HTTP/1.1

Server

2a00:1450:4009:13::7 London, United Kingdom, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

c74cb11a3af333e0ff965b2381e17f9d66514c20e73052fa953202984fc18ccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Fri, 31 Dec 2021 11:59:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Dec 2021 15:01:47 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-3357050/3357051
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 3357051
Expires: Fri, 31 Dec 2021 11:59:52 GMT

Redirect headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r2---sn-aigzrn7e.c.2mdn.net/videoplayback/id/a140f570ecf32b16/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3783855708/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3FEFF1D0FE058261BA3AD44E748965703F0A05A4.1ED014554B10113141976E3FB50A1882AB42D3DF/key/cms1/cms_redirect/yes/mh/B-/mip/2001:ac8:31:69:260::1/mm/42/mn/sn-aigzrn7e/ms/onc/mt/1640951560/mv/m/mvi/2/pl/49?cpn=jX1lk67T3Snnq1wD&file=file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 678
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4B5F 42 B
64 B 40ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 4B5F 41 KB
15 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.493.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 14:56:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248591
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Dec 2022 14:56:41 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4B5F 0
22 B 62ms
61ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4B5F 0
24 B 75ms
74ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu0fDY63F89KzeW7oy3oUJl_IXV3ZCkLnlQh43oCX6omYptAxy0liCKznOG_hqOdBlxupTBkNM95j211UkYGOfizg7FPc5NZ8abgaKjMsgPDrhs5KGy1k3aME4akJacfDwAINskA2IoVPM8bMUQP6oyxYhaOS5AOpvR3sV2UNoPQTiLSq1DsG-WSIIPKVwWTSeJlSbn2QRxe6x5Tq-NrJpTAJgdF4zlWATEPhPTN9a3GHuYbeRR7-Ahf1golxY_3Cb4iRqP3DP6amx_9Q6YHYPE3UOYBSHPfJHYO551l_98cHW6xmwfjyS4_aRellB_DTFLEi3mR0wiSvbbXquWEkSrT55DbHPQBP0My_4aahpPcnfhLNI3qdt5IUnG6G_NFZwiVyCsMYYUNQ3Hky49vuRglX0KzezbPwAJcbW7YRljNJPclBiQzWf50jBBiBarbnVC1eS0ib9FwHSDsXeztTyF9s6NVYtEmZCUvI0fy2AAiHQUJ1RmSQAA8XSujB4iC_XvJyfduOx3JWUIa_nexycXseSSGSdoOg8f4VATqTk0Qb7Bg_Tz6CQp7zyzjfqgW9Oj8901i7Bd-n0o8Z5Askpt_3-Aq-Xwq63xKeGTT3uwJRDExy3Wkx7YaU6cJEC0QWI0A1y4se1iOfDWudCdQwvgjtwuhwAOOzkAffoVnk87gf9RJQvp5llY_KjrQsuwVEYNLL8A_PaHjJ4kz5g7032XfA9GQpOjelwDDrxSxBHR9rv-Qf0VdlaPdiMIAiD1CaNjKELViHg-anXnew9K5dY-ireCDIm-kELq80hFjGSvdFyqpN88b5LSfwPg5NIoO2DpQpzCK4eNffZ078xyeYbJQ46gV1FSJdpdIFkIGPJ4G-A7BJnz6g2s-MyL56tnN63LhfA2tayQv89-9Nba5jd_-xzDu4Og1mr97tbkC-bwU0h4agYpvd5jidf2OII4_FGnixybMSMnfZRoz7-sub32_YztjQeV57gzb9mwRXwceCBd4V9viSaWHaSQ9pdsdUXmICfCvJvARYNtjgNUsMUh40T9NDJypEbueE4iOk-sjxAOSEIOYzP7Zf5xU2sMV8bBFiiGX_KjHDFJ6u_iHlTklkx9tQG5bRzMYOJ031WidHKGSnOudw__UUjuoKq79muyqhxPrlcj1SoMtr_1wAwA_SNryGZsiefRMkRPcPTyn2bVVr-IWNfVfwDlCgAxoIDI_p8B-g&sai=AMfl-YToHhLI4o8P_FGf3rryOLFgOaPD6GGgsLGgvveWXbd57J1tyQC51XNGu2mClYdRhMIV8g207SPSfbG54X-FeRq48NDfwjsLq4UDbPMMFLCHY20Y2ck28yIGrvTjQix6N4HS_xKl0_L59YvdwYnx-oq8OPk55A&sig=Cg0ArKJSzFVdUChhtxFdEAE&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&sdkv=h.3.493.0&adurl=

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Fri, 31 Dec 2021 11:59:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame 4B5F 0
0 42ms
41ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNf8bBCW0cICGNiU1b0BIAEwAQ&v=APEucNVmifq0nq18waZJIva8zx_QeLqigH9xF_PqeqNWG8tidcVsmxr04duHRmT_QeQoKzaWKNNbxv3UKwdizKteiJr8Dn5Krg
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4B5F 42 B
64 B 43ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CH5oBn_DOYdbqI5ns3wPH0YbQAc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0H3YdG4Q3Otxt-XHBtNIq16RvLTHgoHgGLTIs9ghlkz9Uc0zZHw0XgLGIOJYWhLhX5a6DxbQwC1Wb3Rd8bDznEwV50k98W8CjIvnqDip7oYxspFvJy398uMBcJYw5F06i1wQPiJXtKEvnjL5TeMZghRR0ypkExShPChSKqXZL9ylG7RQca0VHcZSn87UEFfJIaWru5begXkZN0xUdbIKsMliEuYnVgChR_7nokMGZAewrcF00jXPJhFk0vWr1dmBiHCnUD-pUkfERjt6D-aJ5rxhQlAEqM-TZmrE0nzfCsjAurzh9Bxn6eCkudd2mHyJ9sAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=3rDTFTzr-oQ&label=vast_creativeview&ad_mt=0&acvw=sv%3D914%26cb%3Dima%26e%3D19%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26is%3D275%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25677%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0.04%26t%3D1640951992033&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA9QIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4MECXAVI2CNcHEA8lAACwQSgBOgsxNjMyMTk1ODAtMUIER0RDTUiyBFAAWhBqWDFsazY3VDNTbm5xMXdEGAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26am...
ade.googlesyndication.com/ddm/activity/ Frame 4B5F 42 B
63 B 67ms
66ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26ic%3D274%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25678%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951992033;ecn1=1;etm1=0;eid1=200101;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4B5F 42 B
66 B 67ms
65ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsudy6IabvrHBgLdwlwFoLcQqUQrgAENGrXur92ZMz4bAPDlR4xmQ8tHh4lOjJn4NmyNUEB7xFqovlW8PR8pVB_dq_5-sXBluaRJgOk7Oi_gS-HSRvpR_A&sai=AMfl-YR4CSSQarWWFZbiK-OQvOmWopngeM9LGKRVatf7hm2GGfK8v7wIrxR0bJ4rn03vStgOISAUAS_sccFyxjAJ5qZOxC58WJI6FofjANl2rs3bPMnfeamvxInPGyc&sig=Cg0ArKJSzAPtGu0i7B0LEAE&cid=CAASEuRoOaJGninYGYU5kvn7_jjqPw&id=lidarv&acvw=sv%3D914%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26ic%3D274%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25678%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951992033&avm=1

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amt...
ade.googlesyndication.com/ddm/activity/ Frame 4B5F 42 B
63 B 68ms
66ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26i0%3D275%26ic%3D0%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25680%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951992033;dc_rfl=1,https%253A%252F%252Fweloma.net%252Fwem%240;ecn1=1;etm1=0;eid1=11;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4B5F 42 B
64 B 43ms
42ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CH5oBn_DOYdbqI5ns3wPH0YbQAc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0H3YdG4Q3Otxt-XHBtNIq16RvLTHgoHgGLTIs9ghlkz9Uc0zZHw0XgLGIOJYWhLhX5a6DxbQwC1Wb3Rd8bDznEwV50k98W8CjIvnqDip7oYxspFvJy398uMBcJYw5F06i1wQPiJXtKEvnjL5TeMZghRR0ypkExShPChSKqXZL9ylG7RQca0VHcZSn87UEFfJIaWru5begXkZN0xUdbIKsMliEuYnVgChR_7nokMGZAewrcF00jXPJhFk0vWr1dmBiHCnUD-pUkfERjt6D-aJ5rxhQlAEqM-TZmrE0nzfCsjAurzh9Bxn6eCkudd2mHyJ9sAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=3rDTFTzr-oQ&label=part2viewed&ad_mt=0&acvw=sv%3D914%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26i0%3D275%26ic%3D0%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25680%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951992033&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA9QIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4MECXAVI2CNcHEA8lAACwQSgBOgsxNjMyMTk1ODAtMUIER0RDTUiyBFAAWhBqWDFsazY3VDNTbm5xMXdEGAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D42,0,0,0,0%26mtos%3D42,42,42,42,4...
ade.googlesyndication.com/ddm/activity/ Frame 4B5F 42 B
63 B 68ms
67ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D42,0,0,0,0%26mtos%3D42,42,42,42,42%26amtos%3D0,0,0,0,0%26mcvt%3D42%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D42%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D42%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26dvs%3D42%26dfvs%3D42%26dvpt%3D42%26is%3D275%26i0%3D275%26ic%3D4096%26cs%3D4370%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25685%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,42;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951992033;ecn1=1;etm1=0;eid1=16;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4B5F 42 B
64 B 42ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CH5oBn_DOYdbqI5ns3wPH0YbQAc-uwdlhjLPFhIsPurPAmuAdEAEgmYu9L2C7vq6D0AqgAbSl7c0CyAEFqQIYWavsZqy2PqgDAcgDE5gEAKoE8gFP0H3YdG4Q3Otxt-XHBtNIq16RvLTHgoHgGLTIs9ghlkz9Uc0zZHw0XgLGIOJYWhLhX5a6DxbQwC1Wb3Rd8bDznEwV50k98W8CjIvnqDip7oYxspFvJy398uMBcJYw5F06i1wQPiJXtKEvnjL5TeMZghRR0ypkExShPChSKqXZL9ylG7RQca0VHcZSn87UEFfJIaWru5begXkZN0xUdbIKsMliEuYnVgChR_7nokMGZAewrcF00jXPJhFk0vWr1dmBiHCnUD-pUkfERjt6D-aJ5rxhQlAEqM-TZmrE0nzfCsjAurzh9Bxn6eCkudd2mHyJ9sAE1qiP0scD4AQDkAYBoAZOgAe02pKyAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDAwOTA3NzQ3MDA1NjkyOIAKA5gLAcgLAYAMAbAT1JvNDdATANgTA4gUC9gUAdAVAYAXAQ&sigh=3rDTFTzr-oQ&label=admute&ad_mt=0&acvw=sv%3D914%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D42,0,0,0,0%26mtos%3D42,42,42,42,42%26amtos%3D0,0,0,0,0%26mcvt%3D42%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D42%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D42%26pst%3D-1%26dur%3D22762%26vmtime%3D-1%26dvs%3D42%26dfvs%3D42%26dvpt%3D42%26is%3D275%26i0%3D275%26ic%3D4096%26cs%3D4370%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D3,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D25685%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,42&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.04%26t%3D1640951992033&sdkv=h.3.493.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NjkyOTY3NDIxMDhA9QIKcQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MTU5MDU1NTIyCTE2MzIxOTU4MECXAVI2CNcHEA8lAACwQSgBOgsxNjMyMTk1ODAtMUIER0RDTUiyBFAAWhBqWDFsazY3VDNTbm5xMXdEGAE.

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 track
servt.modoro360.com/ 0
70 B 99ms
98ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230626&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=22&vi=100&ofpr=3&imid=90211155ab5d360092d035058011913b_1723157180_10619067&e=impression&cb=1640951966452&ad=22&vi=100&d4=1&d5=26&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:52 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
servt.modoro360.com/ 0
70 B 98ms
98ms Image
text/plain 52.86.1.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.modoro360.com/track?d=Chrome&cou=GB&cos=Windows&r=weloma.net&rs=weloma.net&sid=7075&t=1640951966&cip=194.36.110.165&sn=&tgt=0&osv=10&bv=96.0&brn=Chrome&wi=400&he=225&app=&AV_PUBLISHERID=61522ae545833a0b2b769c04&test=2&aafaid=&proto=https&uid=1640951966305-993100379804-005659-002-004999&cha=0.7&stagid=6086ba97c979b40b712ace46&stplid=6049d3f140d88e45f4252456&d35=&d36=6.1.2.92&cb=53799290906&d9=1000&d37=realtime&AV_WIDTH=400&AV_HEIGHT=225&asid=617088ea27611447916c422e%7C61b276452416b22924230626&pid=61522ae545833a0b2b769c04%7C60095c900c0799791c46d8d4&cid=61708778bf7dc912731d1596%7C617088babf785615e530dfac&h=2719c3f380277e69010a518a4ae4d2216fdd7f4f&d9=1000&ad=[AV_ADDURATION]&vi=[AV_VIEWABILITY]&ofpr=3&imid=90211155ab5d360092d035058011913b_1723157180_10619067&e=start&d1=vpaid&fv=1&cb=1640951966459
Requested by: Host: weloma.net
URL: https://weloma.net/wem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.86.1.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-1-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://weloma.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 11:59:52 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame F9E7 23 KB
9 KB 29ms
29ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://imasdk.googleapis.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Tue, 28 Dec 2021 14:56:41 GMT
expires: Wed, 28 Dec 2022 14:56:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 248591
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST csi
csi.gstatic.com/ Frame 3FE6 0
0

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame F9E7 35 KB
13 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:41:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163114
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Dec 2022 14:41:18 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F9E7 0
22 B 65ms
64ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.3.493.0&bgai=Bqhx4oPDOYe-fAoz6b5_fgZAPAAAAADgB4AQC&bg=!Xl2lXRnNAAZKWFskSlg7ACkAdvg8WkElscIBGn1Ei1VxfdExlu8yuG1PhdvHdBXwqgdIp7cWevffdwIAAAHIUgAAAGVoAQcKAJITvVhZ7AWVdphRrmMcAsS6CXoxMQ4KzuM60JejjSwjXAkuqqbwCGOfO0yIK2Ji1v2YnOuvXBtHwNJSEcID2KkUTrbVT9Z5pXcs8xyIHg1Fkp8QRa98KMTR9nnrJBwMF4sA7oc5w4XIAoZb0ktMuSjPdP3-Pel0TUF2I0LE-kqtFKDcu7cxoSWkcdfv21KIZp_dS5kC0m4La41wdpQu-xdglSbaZKyzPQUfTHIj_p1jqBW3yt8QrVMmKxx77iaFVHtTiQqACvEUGd13Lu9W1uhT0EfDultoLiRTHRktAMESXZAsqi_tXEyr5XsWLDWQUrQA0ewyvBe8PcqM55EoyWPR5LVm_TISNKWgQ0JJ71r2j-1ZClENo4EYdVKXa5-GZbjEPmbvINOGdY4vBp7Pz_DxKxQzxCJgoxD4FGP0i9stPP0YofReMbUcfcyWaZ3Hwm2Cns66XNTsRFOqn7VP180DIwtnFSPHSXn0Oucq5RGxtxYRsf7WSlhgtSgVIJ84Lqm79xVB65GnhzYKibxgY6PTYkztm7X9Ado2LL5GbWx5l8QUcI0zytwq3lLl6hkUQRjdzAmsQsNaJgnA_RZJRMpMJHJEHisZcxvN4wphw9khl-AdSa8lCz1M2-y13NP6hB-GkwqVTmXeeM4IjOdr89R-_jgEf2ZHXRBVT673Av0i2JvJwWowakW5kP3MBHpqHKMgzbWGSycLSZljZga1NG-LhKP_aCBRaIcpGBJuZMf-ha9W15VlB6vzKhicMC3s54t_o88sRFLB5ao87rqoI8TNnajvNOdNHrt4o-4ldbyrFmS4aXRcMFfVQT1pO_plFaMCUdbREnD6Ewk-KGqohS8w1-L9-lLXo0AF5pwPAzYranX-jitzmIbYgsObBHKSoMKzoOXIfnOzhelGdH2vMgX29GRl5_NJN3JZ_N05ZUb1UYuIK32x2QMF85Njr2PuhFyq6EuTEc8Y-rH2mZVeeenzv8kBLczQUPlGRDIYS5Zb5iUFPVNnio3-pr2EQ8ZlFf0KLNZm0BC9wXClMIKbP_84kgACdBeBaQhBTrTiYVHXPFs9r9I2YqozBEWtJBxMZARDlOVYGUKEjl1t8-sxV28Oj4YA6JL6j5T74epadazPnIBLVC2vdm27Jlz6jrnojxatFoGKlGXS

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 31 Dec 2021 11:59:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D2197,0,0,0,0%26mtos%3D2197,2197,21...
ade.googlesyndication.com/ddm/activity/ Frame 4B5F 42 B
63 B 68ms
68ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7--Xuf6N9QIVDP0bCh2fbwDyEAAYACD8kOpNQhMIlrb8uP6N9QIVGfZ3Ch3HqAEa;met=1;acvw=sv%3D914%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D870,9,1095,409%26tos%3D2197,0,0,0,0%26mtos%3D2197,2197,2197,2197,2197%26amtos%3D0,0,0,0,0%26mcvt%3D2197%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2197%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D298%26pst%3D530%26dur%3D22762%26vmtime%3D2051%26dtos%3D2197%26dtoss%3D1%26dvs%3D2155%26dfvs%3D2155%26dvpt%3D2155%26is%3D275%26i0%3D275%26ic%3D16777217%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D24686%26femvt%3D0%26emc%3D12%26emuc%3D0%26emb%3D12,0,0,0,0%26avms%3Dexc%26qi%3D442506126%26psm%3D-2147483641%26psv%3D-2147483641%26psfv%3D-2147483641%26psa%3D0%26ptlt%3D27841%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2197;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.04%26t%3D1640951992033;ecn1=1;etm1=0;eid1=200000;

Requested by

Host: weloma.net
URL: https://weloma.net/wem

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS