castles4kidshamilton.co.nz Open in urlscan Pro
35.244.118.36 Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:01 GMT
AN-X-Request-Uuid: ba358686-5c0b-4f1f-8dbb-b33469e17e46
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:01 GMT
AN-X-Request-Uuid: 533fdd10-baf3-4950-a5b5-5e9dad714fd2
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4644
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODEwOTQ5Mzc5MzcxOTgyNjUz

170 B
243 B

248ms
247ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODEwOTQ5Mzc5MzcxOTgyNjUz

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 07:19:01 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8cf66090-bbbe-4705-82c0-487355ed81f8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODEwOTQ5Mzc5MzcxOTgyNjUz
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5205
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1

43 B
632 B

389ms
349ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y0u-YzAEwAQ&v=APEucNWNuaSSnchv8Lpse4xGgbRaEq1Hs1pOsWAMLTblpumCK64stmUfKAtGDqs3tGqwvayfLM_SsQERzbNqgcLiJ8e69rMlhA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5205
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJVHZtEEYAerqoM5KffiLAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1

43 B
632 B

359ms
358ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y0u-YzAEwAQ&v=APEucNWNuaSSnchv8Lpse4xGgbRaEq1Hs1pOsWAMLTblpumCK64stmUfKAtGDqs3tGqwvayfLM_SsQERzbNqgcLiJ8e69rMlhA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:03 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 5205
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEG5uTqJHmqMc57xHRmJouxg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1

43 B
1 KB

505ms
273ms

Image
image/gif

104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4Y0u-YzAEwAQ&v=APEucNWNuaSSnchv8Lpse4xGgbRaEq1Hs1pOsWAMLTblpumCK64stmUfKAtGDqs3tGqwvayfLM_SsQERzbNqgcLiJ8e69rMlhA

Protocol

HTTP/1.1

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:01 GMT
AN-X-Request-Uuid: 758b4685-7881-4080-9127-03bdbf6d67e6
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:01 GMT
AN-X-Request-Uuid: b02a652e-8563-4025-b225-48d9012acb42
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5205
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk5MTY1NzY5NzAyNDQwOTE4Mw%3D%3D

170 B
232 B

247ms
247ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk5MTY1NzY5NzAyNDQwOTE4Mw%3D%3D

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 07:19:01 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4c685eea-376a-4a09-95d8-48934784e4e4
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk5MTY1NzY5NzAyNDQwOTE4Mw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame CC1B 37 KB
15 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201585
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AE6C 0
56 B 237ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6897312162871&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AE6C 0
47 B 238ms
237ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6897312162871&version=m202301230201&ct=76&x=1&cor=9812311831627504000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AE6C 90 KB
37 KB 407ms
406ms Script
text/javascript 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A1pQRNP8G1K71kvQhJP-U6naA6tMYrYvM46f0KYKfjGzkvlwIaf1mwjh06ObKDuOBcxTsm-htleNY53QvQ8H8ELlo3zQ1eE2ZsRD_SUD-uYy_UhNU&cry=1&dbm_d=AKAmf-BjU9CPBfV6QBT87DJC9ER9omZqyTnrr8G9Jo_S9aFWcn1KhS9bL1BzaUCgmpio3ctkEjwWjSGxlIQGAzqS1zhRyFAWa9ImWPpWO4xO9mVNNBYT9SmL3CmXSgOeg5HbsmI_S5zNeeC0MvH1ByVBa7oCyePUNJNuTxHJPT_4X_PLFPzQWI_DBeR065usNGLFb698Gu-hJ0XI0HxhI8H7welER17urFhqwiLTiQVqPLnlCQhgGgsTz_bvP9TCU5SYBAqHUeJye1ZtggIxxUd_zrzfcsq-YeHts_YGo5_3WlrYF0V8sZ6KfnEE4A7fPoFw58W4gQG4aWQ-9UlE3WbVQ7l_8mhm1ZVmhdzH0G9oRptfz5Ceds2-K7smjdLYNlytfuDzqHj3ZHkwAKl7sV7S0IZBwTbaicSHdqIqSmyJ-wIAMqlSCFWXRTu1ZY1b2jzTeWArtiOFL_6b15kQNvOxkUy5q7jnJd5ZB7D1u6rcT4xmoGPU3iFJogFyXt6yMzvJ-Zx7sV1WFHe1JtBuJpop8iEG3zfQU6CaBs6JrTVeO5V6l9obduHK4jtL7gaAzGUuJ4ql9OI3OmEXkXvpcZaoJRFKmq-Ujvj7St8dskZzlmkldUQWm_YLVl9W2amt6qTzHUfP709UkY6BNv31UohYmxWqo3rcw-SeXyHRuxKuhpz7Oijd3PkDaojCeOwBcuQBvDwkhLBcPHubcmAvoVPzojLI0bQAgwlvliXRD5cCYnC9yUofZZ6Z1fQu7E64AKXaO3fOPZy9lHCQ_3Lmq0lOc-PSLelYISgcRt1j3_hCA9cQwHr-1NJ40hItq1DJGZmjsijC-hDwC3ZbYuOODOFo0OlXjruMTPK7YAcKzNH_mgh27KNAzxyI54UzjoZ_OtGXeSmDXFu69gGdBViXWa15FR53gGpi07UTw8n6v5TKC8NxAVBkriIpZu1LBw8VRnRogsLBNMAfh4CJ6LMcQq1LYeFjA9VrGfGo6nXfVful9jo6IfeZmL6U_NBsvyBGnW4JYvaLrXcAjrnBcFO5JNV7823O9SQMW6eC59gLCIzUOLvmqbZChh9Hgc_SmWZL5HdB1qGH1a38qDQlCH39vAobXJ1hDQWNs7AzDsnDdk6OwdZUn6IutBWPsM4gj0Flyae9A1yPT2GMLbVs1AInOtIruifab1ngdfJlECN4yKd9p8YoG_7nLJkH53nF0nDL2XbYYuJ1dVYW6pD54W3AETh0otBdwDcd5cr9-QRrbrIlTl2jCZ3d4H-OBQCX-or3TgiJBJvX_wBHjGG2PfaajLsNNY3bOGs2jLER98fXUX6ERl6_1sb9aVumliWbHfh4OksmC9MlPbZHN0KgJbn564uLvI_snLQDZcVxIzrz1E_DTWyQUVFFLksGkEnX7_erwAb6Z-BWvI-gcuq0Xdirawe9CdU0Vde6Qf-QN1Ax_an_Wqg4Vfm56W_En7JeKl28hsnDXT_jklCLENIzgcv5RlNkNUbkLSIbP4ReXqZhtj-M8ywv_q-tourY6wSH9Y7pYhTODsWQ9AHDKlhlSMAJGfSECL8dU5SP9XIg7zLAuZsH5j8j3fgXgX3HOdyOrcQAE9753_SaFg4ltiwUhhwygqc1Pt1UtSzz7Is25OV1_-ysJkb7q4Xb38OmoGKRDKEEF_Jb4L8VvjP1FV8epLf5ursukkA6iGfKHN2E5nsoP-QP4S52xZzemTVJ2v5l_o8iFAFdKSsWxLAHZOdDWa8Csj9M1EY4AKum2XHDUgPRJVz5GdvhjYc8O5CdpFzANlY8mfBvPIyp9_funIc1QgUJeS2Z-lt1aE-f1OXp9Vt-NsF0pLoNDZt9qTPsiBs61C_H0cjp6TzpU9ATVlpx6vdy7TIxyMGTNMF532tLE8OFewR5jWyt1yIeHx7MoKIy6SWm8rqvPxiaqKxMzpVUgfMojwMS6hcNRPNAx_gn4kNDBOUjkoeVX4XZPALMemgRIt1IMRRhlD2y7zCEbiikwzoL_BJHx4FX86ZtR2DacJAKuy4KWEAnX_9SVTm0Kd3au09TPZlLx4N04h1Pr0ACCnt8fhkx6EqAge2a1rmEuQlA2nUliM65QvYIfCShY_dJWOuh_PeHbO1AEnKbNMgNL5eWESWMoq3bsAaBfwfw9FYdQWDeGxN0wxfxJDoqt7p5pVUOx0eS3OhOR3MvmVRlE7wWQtZKwwUF--D-MAPTVglZKRLAmKtYG0pOukcYYM3ZK371ksJ2-_kka0tQ_XqmHrK99gmA4aAvhAPfze6MmK_7yjwYvjXF_wfom2Ln6t-76k-pTTLyUPPBE0vlY_STIc8JuZGGYK41p0Vnhh5G5heWUBCV5HaHhSmjdGNn4Jm15q0FJz2SU-8vh5OHCJJuVFyY5l7LXXMxNUggH0JK3wmp18Jpuo3iQccgS9l4Z3Aw6errW5NLMMDuODn_xymZ2JRo2s0KH13MDdrsSFEKZrMYbRlZYvHPRe7PZbn-FtGsWtni_p3P_MtqcTqfnoNnDBwxa5T4qbXyx4H0SUG4CC4DOiFvCdRqDJopBzp1Va7ubnNGfbXxk-xnk4zdD1Y6UeqwdEhaIHDP9YxnDY92nHBDbxqlrEHmzkMAuLIMfGP6DEK7bA3mX2irQixZ9fPwjiWtByxb6VDrKNpUNB60Mx5Sz1SZBTgCHO70_LOhrIfrTsZ8kxdhtcWN9f0Y7bz0fnGIhLWSZDiMeUgQEmmsDD-lRPalu2dRg15aYYCjXJVk4P4CWH2JTQm88MGjYML7kczG-LMpleyjJ70dclcJbMPAMCDMPAgmbiRIHukclQENs491P45BHz6ib6KpSRReB0Q8UWj0oZ9Ph629MT8c_W9ovG_yg77ud_x6XWuEA8ozxfAG_XTC_JeUmMc0MpW02x3Adu_Hu_pbKEy8nuYZ_FZDxT73kTbOnAk8tiehwqOo4VPRZOXJM0p8-JTT0du7Q6zdwm__bqM928CaUIuxeXA38X6NKjWHAnOx7sRLdkFRz0hg4YMSH89zdsGyvwIhXCidO6YR2OFB1dKV0leuyHhkTCHFvaHiVAwniEt6y8XuxKN5k9W-o7AkDDYsJTLBQmFKgsIaAhhfgrzla8a5yEprpOFjNvW0vZEmZCOvoPLqjn6a0302_bc_dZfZ6DZbvF03VQd_FA49Zh8I-qAX4V6ri--XXwBu8j8qTJrORQM7fqYxjFyec-RCcm3xM_QqrmeqWQpDGl6AhH-rbsCfdxZiXX-FWFTQ8-Aadks5KAmriKr8WGu7ZoK6k-_XmlFZu7kVQYzygew5NXvG4YbT8GomLZit_JP5saMrrnqVlwcYHwYPUp6towCUqaDwiYqkWFeAzYYZhfn2zFo25qfx2mm1cZYz6Q8Y50MYI_V0Ew1I0XTd5tRNvcLDmMKdZABpDrA1-OPLDjXSfUVTtA&cid=CAQSTABygQiDxwvHbdhQ2eCftmXCdpQ-8zgHnXETrd4qwA5LNWsyDoMsqLvM7BeehNaNyxRmqlZ18gFz6s-HFpOVmhCxDFHdCQjKKS3QAmAYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=9812311831627504000&adk=2228999115&idt=569&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be152963b1ef60c61fc13a905e80c47c6c93b696b2aab08ad13fc9c4e5786cc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 85E4
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=castles4kidshamilton.co.nz&sn=ChromeSyncframe&so=0&topUrl=castles4kidshamilton.co.nz&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=zNJLw3xNWCt2NGZDcFJFaExiMTVrYy84RnZ1KzRBd3h2QWx2SDlDdy9INEpmV0ZPZ2xIaHV5U080aXVvaC9jb21lUVFyay9BendacjMrYXBPYXVmWjQzbGRFV1hwYldLcmJYOExVbTZubkRKZ2RPdkZDWlpmZ1JkUGlVZX...

463 B
675 B

1027ms
341ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=zNJLw3xNWCt2NGZDcFJFaExiMTVrYy84RnZ1KzRBd3h2QWx2SDlDdy9INEpmV0ZPZ2xIaHV5U080aXVvaC9jb21lUVFyay9BendacjMrYXBPYXVmWjQzbGRFV1hwYldLcmJYOExVbTZubkRKZ2RPdkZDWlpmZ1JkUGlVZXNhZXFzUTNPZUVYRnZ0TEIrQi8wc0lRTGhlUTFGM1duQlVhSTNvRDQzbTF3b050V2VFeFJxNmNINkcrZ0l3Z0FYTE80N3F3OE9lVzRJdjhoL095eFdpb1MxYTFNdVVDS2d0amxqeEJFVFloM1Nqd1VTWlhyMGxZOVRkd0p5L1ByK1N3RDlSZXljdmFES2pYWmp0QjlBdzYyWVU5WDdRcGVqbEVJRm9mOTlIRDhEMi9SZ2xiTT18&cppv=2

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e8bc383fc3c36ea4eeadeb80f9537b150622209e353f3ead8eccf8b7a1a3a1e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1139348
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=zNJLw3xNWCt2NGZDcFJFaExiMTVrYy84RnZ1KzRBd3h2QWx2SDlDdy9INEpmV0ZPZ2xIaHV5U080aXVvaC9jb21lUVFyay9BendacjMrYXBPYXVmWjQzbGRFV1hwYldLcmJYOExVbTZubkRKZ2RPdkZDWlpmZ1JkUGlVZXNhZXFzUTNPZUVYRnZ0TEIrQi8wc0lRTGhlUTFGM1duQlVhSTNvRDQzbTF3b050V2VFeFJxNmNINkcrZ0l3Z0FYTE80N3F3OE9lVzRJdjhoL095eFdpb1MxYTFNdVVDS2d0amxqeEJFVFloM1Nqd1VTWlhyMGxZOVRkd0p5L1ByK1N3RDlSZXljdmFES2pYWmp0QjlBdzYyWVU5WDdRcGVqbEVJRm9mOTlIRDhEMi9SZ2xiTT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 258635
content-length: 0
expires: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5F08 624 B
285 B 547ms
547ms Document
text/html 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBC5tFQY8M775wEwAQ&v=APEucNUMkmLDObV_nknvVuL908eB-MYCOMy9bk55roPRO_xNgNfptVaIon9UjSeKA-0p4SsbBKL_-JJwZsiHyFLBvlIqOI4VNA

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:19:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8B5B 78 KB
27 KB 242ms
242ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B5B 42 B
107 B 239ms
237ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C4jyIHg9ruFOFBI76lDEN7F7vT0OeqttsT3bCnXMmKinIpF0f-TJ3jzlT1PYV3sX7TWH3KKwUxVPdXyGx_tKqSe3UUhbLLYSZGWZC69Je_zhruqdU

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B5B 0
56 B 238ms
236ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16503900528818541423&x=1&ct=76

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 8B5B 3 KB
1 KB 274ms
273ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 22:51:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30421
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 22:51:59 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 8B5B 19 KB
8 KB 235ms
234ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:04:45 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8B5B 179 KB
56 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57242
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687383875062185"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1BA4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1

43 B
632 B

662ms
355ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKekxgIQwNKMgwQY9reP5AEwAQ&v=APEucNU7ZaL8esAG7Xv7Q63tmJxWcNYi-KI5UmnYpA6oQ4o4paQPLrqvjndVLCbNZHpW3kvnQ6m8DF8IPHc2zMAwly-ozTcV8Q
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1BA4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJVHZtEEYAerqoM5KffiLAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1

43 B
632 B

389ms
353ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKekxgIQwNKMgwQY9reP5AEwAQ&v=APEucNU7ZaL8esAG7Xv7Q63tmJxWcNYi-KI5UmnYpA6oQ4o4paQPLrqvjndVLCbNZHpW3kvnQ6m8DF8IPHc2zMAwly-ozTcV8Q
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:03 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 1BA4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEG5uTqJHmqMc57xHRmJouxg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1

43 B
1 KB

423ms
273ms

Image
image/gif

104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKekxgIQwNKMgwQY9reP5AEwAQ&v=APEucNU7ZaL8esAG7Xv7Q63tmJxWcNYi-KI5UmnYpA6oQ4o4paQPLrqvjndVLCbNZHpW3kvnQ6m8DF8IPHc2zMAwly-ozTcV8Q

Protocol

HTTP/1.1

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
AN-X-Request-Uuid: ac84126d-d44c-4821-aee6-21911376d8aa
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:01 GMT
AN-X-Request-Uuid: 04e662b8-e5b4-4e02-9f21-8a173630fe25
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEG5uTqJHmqMc57xHRmJouxg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1BA4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzM1NjA4MjgxMjUxMjE2NTA4Mw%3D%3D

170 B
232 B

249ms
249ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzM1NjA4MjgxMjUxMjE2NTA4Mw%3D%3D

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 07:19:01 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2f64feb6-d83f-45e0-9981-9319da9ee533
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzM1NjA4MjgxMjUxMjE2NTA4Mw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9868 0
47 B 237ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6173808683617&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9868 0
56 B 237ms
237ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6173808683617&version=m202301230201&ct=76&x=1&cor=15046402328671312000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9868 15 KB
11 KB 428ms
427ms Script
text/javascript 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DAgC9useZdW7YXlhuhlRIG2TS71tUrT42fXS9TKDBQ2kZnhHgMLr48y597IUeHH2uu6sbWWIQQBlU6bob8vqAfs5SlmTS_3lKH0r9WNmgFI-wIEtdn_-L6kLGvYNEznIrCmIBgPwF8ORxNa4ZwQ-6e-W9fcKnWzzb9VWvYk_H4xoYwz_M&cry=1&dbm_d=AKAmf-Apg2PFF90hUgzxKJ_kgO-5LaIgLo6SMFh8HeoNQ2Pc5ADqbqV_UZnslopeg9UfYdDNC-G6ySADPOL2hD-ZGzr7ucHRemcSI_sT5r44xwpk_sE6zghXEY5HWvit3wPrdwzvYyE4OBrbJhRoBaqcJD_VOgurG7S1cCiT4qcS7NEoVLQNFZZt2iEDDAI51YG7a2TH_vLjgPIzvFB_4de8gqBtkfGZN3sJsgP9yiJ8RTwB1UCOj3ud3_ietzd6cjlRzeNvRT5KHeW3PTumKUUD9WBD0qxDRlyg8auetUiZ1I-93OZvF_SjlEs6zUgKy-N8ftXo6-h7Bvy5B37l5s_a-eSwZI5txjfVyw1X1PVsNgUO9yBYZwNk78Us-LgKBhUleA2h7mRFHKVyrGXZ_6hA7XVIR2B9st8J4ugllmWh04qAxXVpCrfDLwnQzoJ-AvptAyazSsLlZ73R4mVh72EHmyV-eACh76YmSYTVyi9KYlMs5l_AxiLxPpNjjfP0Fjqm6cD8oChTy51pKqb5wx9Mzm3dYQSaGWKFzFrWHOt290QI2HCch6Rr5OcYnY0GRnH5gNBj_8ye8FoJOPeIvQFxsAJIfXJsELF9bZjxpEePA57j9ieCRh_zefJlKquzAsTNdZngRxBZcWdZwCaJGiQOTdPJpPlQiOuTwwGOIxC9GBXlea0lb1DpnLxvA6Qn9PNIcICCDd5jyINeMhpIqWA0leV9BCPYr-uLYiVHeP5shwVR0-dvuNGY-AUkGKDsbB7HFPZ0XlLIqzNXjRRxjNKgzkb2YgX6rPfH9mEhnx7RzgHGVNfWJJSbkPjqpSSfwZOb7LxMzbwxlnplgNV8t8i3Tbcu_Uccua8xc8fhS0T_feQBO_TcjEmrWfYLwtJtRTk2-rqmT20bgo0CDTG-AeWmwH2lHKy_bj5qHQzd8mf9sQSQS4QzYxF63d0rRIXuG56Qkk-WnCnMIiTMIN5jckXBE-zOTRlxNM1ouUnlHTlvJeGW7Hi2muVDvkV6J4VPSInfoL450YAsCd40BzRSesHOmFCYpkgmDuDTm4BWq7oeQsaAtYleYqCQpnbGXwC6n8VGzR57xPDRKYAb3iXpJiv9pIf1VmmzjrpLQSMhvBQqY6j5jus-TOJv5ziRj0YozEzFPuMIlHxtIVByzyWocdQxHkyl9FSyUARH5ihGPWNMEMuL80tLExGlxjllZFg0WbPysPvjth-CngyAGC847d9rt1xWHRyyntUc3zODrEcwpZbvepPOOJ3dVrm_alrY3-9HmG8KmC_h7eKZZwosRLPoLGAbmfRU64i8cq55mUsHemJHnd_qI58YbHlTBPIb7q3R9FVDxLj8Z8pR5Z9GERTchP4TZ3D83uy5fiEDW1M_GGDCM3r7t-l62-NjS9RxFx0RgNTpjp1Ba1jJFbWfU1FSS3BQcnga3L9Ocj64nBloP5fXcj3pITtaKT8XDQISAUcmT41hL5sdxur40nMxxf53Va4i6sOS7czElBd8pxBDr_VVVWER_WD2a0mbWwANuzKiJVhBvIpZY9w-XPFdsZGW-CmGZFzbiy2rthzcLrIlYwMueN6ATnB1yYRpnQ_q3n3qZdjL7BItOEFRb8yrn8g8z4XhqEbWqVkDtmZCUaMSr4OD_Kk8-zuNTVYsa6KO47LyS53B2icSg-Nbt6Lb5_tzvsdlb9fOUzxEfQLwm7_oklgTEqv5lvGOHZLCmLH64PNvzMnAkmLgP0kdDRd7Mpr5t3Moosh52EZRqalxlNx5GddQtZnvZM7iCdmJIS_cuGWhaYoxm0FwLjVGpxlNss4qolc8tMcfph26KuvG-8xa73RsVRiFoI8Bk52O_wQZba7Oh2icXN5m5JssDk3HwUejbnslaGiatV9LtTch50lpsxNM2ZnMOPkBboGWZsrqFF1OZz0TIZ9WXdhSt9VQbWQ0CKhHsqiY--njeT0L4zqxqVUZVzY-N5oZ3QN9qcFy83mXXMad8RD7mw4PoPZKSMbIhwvXNMR-QvbukhF42nU7pK7GQ6MdPqVSWA-1V_ZOVr4EoS2NDJuJslPgmXTjcNsbvMLZ6D5tOOPEOVhvGh99Avc2Iv-wTZ2aWeyhMavPp0o8_LZdAeoIUDpoOoK-xX7V3qQJlkDhQAgZzOAsYKPA-1F_eaaZbvO2l5nXHRPgCDxlaEZ85kjJnBdULLYj7xYedpI-kyFnbpmXTycxBak_BQyYg3JyvKW7AX5xspMDu8WuDau8yQun34GeLcJKUWy-pvnjV1vXTI6SPv1BPNHnBa5NpT-aa1bEGdfCjpgIj2NKkuGeh1mokcZVoMzJ9ZHsN1HMmXfQ-52XE7oDDNABCQpitRce4YDPPaxQORp1ulhT6MaYYoN9ra4Nf6e01cd-hEdhD733xuGTo65pXeHwAuTvBygNUXHq9hA8PbrZDVR3D1lLBqWY1x6rnsRTTNM7hFCwODctC-uai52CGWpiUzIwoo3g4-VTtEjoNOYiGDZy989HmGRSLgHq3lUux_bc54GW6pJD3TOtDSzob_SjnXCHNluB9O48gq2EeBfRu4xddv2PFlb9p23lbaykbd1bqoZTUUuAIM5nUjS6t6s92xueo0cL2rkPoScPmguFD6yIzjsX33Ez26791V9jJa2e7Hp8z_jPzs9C6-wapyxIHifgc-i43Gimah7qq64CrrU63sKknyypYua0y1cLvkGzlyMHkBgJv-1A9G7tvs4oS-GupVkb32x51OTfIGNqYLOvz56kpnkd-qTnc0ZcBYepKwmmHWbyXIjUuqGlTjIp4f1Xm9xMzeBGo-TRa1sJgFOvlyZv6IQkSAcYdW2OXA0bMwBmJJLmn1GLf9w78Z2f7AmoIabEhdCjOCEYkApABgxuOe8tqbwLIWJUAgZYJhV_OL1BlqrYoAkkyhiBonUuQP-8UYp4ShTGQN-mZlKlRW0xpy9uYCgh9a0JDxHbDrSXYYDE_9SOMvpIoltRglCzQRAT4nlesm5Bpuc6mSghu8Nd6ERysbFMHSVYa_YmzasMA_8gFRt8vg&cid=CAQSSwBygQiDqM-XVVQwEhRIIhJZdgGFbvKDpwpMI5MIfP_rNVXMI66V4G_zkyBHG-1UYcUDW2Ojn6arvdQfJplGJ9eybO3SW_h_St_IyxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=15046402328671312000&adk=3047537735&idt=329&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a56a78d8195809a64ad0e14f9b6937f1685cbb0e42e79024fb704593202bdafc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012305252018000/ Frame 6FBC 222 KB
60 KB 237ms
234ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4135cd61dfa379bb61b0718f3a20dc8b25d0b8f4e3f2e52ef4d0e5be736136c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 15:30:50 GMT
age: 143290
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61795
x-xss-protection: 0
server: sffe
etag: "7347aa4c83612bf7"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 15:30:50 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame 6FBC 15 KB
5 KB 321ms
318ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e2ac756b7d18a0715d66cff4a48f4ba89882b3bcec6cd4fda5455387eaff84d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 22 Jun 2023 12:08:21 GMT
age: 69039
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5238
x-xss-protection: 0
server: sffe
etag: "6efdfbd3c81d03c9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 21 Jun 2024 12:08:21 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame 6FBC 94 KB
28 KB 346ms
344ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a9344144d755ac52f3d8405003feb8eab3b79aebc78e330537ea10861d6f32e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 22 Jun 2023 12:08:21 GMT
age: 69039
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28864
x-xss-protection: 0
server: sffe
etag: "51fe97ef57b83921"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 21 Jun 2024 12:08:21 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame 6FBC 5 KB
2 KB 326ms
324ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a28b55f41413d16c71a76b7af3ff9f707323bb3906096b85f7a581415aaeff55

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 19:31:49 GMT
age: 128831
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1896
x-xss-protection: 0
server: sffe
etag: "fbb7a7837efaff21"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 19:31:49 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame 6FBC 40 KB
13 KB 329ms
327ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45352935afb3119009abbfa8ed5bf7b67fc4edf64e8b718a134975410823ace9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 22 Jun 2023 04:11:01 GMT
age: 97679
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12956
x-xss-protection: 0
server: sffe
etag: "bd37dd4c3b7b688b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 21 Jun 2024 04:11:01 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6FBC 21 KB
1 KB 239ms
237ms Stylesheet
text/css 2404:6800:4003:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::5f , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d888389dfe8da504b233c3698d941ebbf649bfd865d100e4f5b18c28b95a944a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 23 Jun 2023 07:19:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 07:09:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Jun 2023 07:19:00 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 6FBC 3 KB
3 KB 239ms
238ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:04:45 GMT
x-content-type-options: nosniff
server: cafe
age: 29655
etag: 15880770647744369592
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2982
x-xss-protection: 0
expires: Fri, 23 Jun 2023 23:04:45 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 6FBC 344 B
368 B 236ms
235ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 15:29:07 GMT
x-content-type-options: nosniff
server: cafe
age: 56993
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Fri, 23 Jun 2023 15:29:07 GMT

GET
H2

200

B28999036.362004127;dc_pre=CJytrIXt2P8CFY6KcAodj-wKAg;dc_trk_aid=552824919;dc_trk_cid=183313769;ord=4232950527;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=
ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/ Frame 6FBC
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B28999036.362004127;dc_trk_aid=552824919;dc_trk_cid=183313769;ord=4232950527;dc_lat=;dc_rdid=;tag_for_child_directed_treatme...
https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B28999036.362004127;dc_pre=CJytrIXt2P8CFY6KcAodj-wKAg;dc_trk_aid=552824919;dc_trk_cid=183313769;ord=4232950527;dc_lat=;dc_rd...

42 B
118 B

258ms
257ms

Image
image/gif

74.125.200.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B28999036.362004127;dc_pre=CJytrIXt2P8CFY6KcAodj-wKAg;dc_trk_aid=552824919;dc_trk_cid=183313769;ord=4232950527;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Server

74.125.200.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f148.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B28999036.362004127;dc_pre=CJytrIXt2P8CFY6KcAodj-wKAg;dc_trk_aid=552824919;dc_trk_cid=183313769;ord=4232950527;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6FBC 0
0 247ms
246ms Image
text/html 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CIomDZEeVZNTiCsOemsMPkM6o4AiZ8qibcbnA96CwEdrZHhABIJHDoJwBYKvssYXgGKABpO6NryjIAQHgAgCoAwHIAwqqBIQCT9DpNGvv_txPM8JDW48_ZAKEJ0nHeNDrTNAnn7_jccpWWdS8ZgkzU-842Bkx2Vx7mT99n8hXP6GkWLMuD1oZZWca_GCGMUpKkzskgi4OKF0Ob8RreGDxrckG4P-2ORKCVzC1YE1jTSLZnkgMnjq-lMIuAKxi0utKY42Vl-fHwfAqucll0MYRm0U7cgiIwb842MQj-txeGA2-TwRiN55Y3EaXe5TGVLHqnIk89NsJjemU9HhQ5HBUC5dKZGZt80iaYfczs_WuhRk3F05H7RDBwuxg3KLRzDojxohcfX8T0BIA2v2cBfAHsHW4-8ExMujpgk2Ey745JH4qSKiJO2VRlt1jPUPABJb-3ImVBOAEAZIFBAgEGAGSBQQIBRgEgAep6LIvqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQr6Jr0ggUCIBhEAEYHTICigI6AoBASL39wTqACgPICwHYEwzQFQGYFgGAFwGyFx8KHQgAEhRwdWItMjEwMTAwMzczNDExMjc3Mhiy-I4B&sigh=ZbtoD5bhxRY&uach_m=[UACH]&cid=CAQSTABygQiDq9N2Fb3hdbaosq8lR0mpmltwei4XbHjN84AA5oOwoG_FeAEIrc5dWM0btRUzL2YJtRjntrRKZcuZQcQklYi5ke-zZ7hfWfwYAQ&template_id=5020
Requested by: Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 6FBC 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a663467e111fd2237a1bc5255e8d702b099f29cb553ecab24efe98cbf898b5d

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 6FBC 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 507e785e40bb7c66df08301d5a28e3eb5c23ff4a3d6ae6b94f06d6dc84f8858c

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B5B 0
20 B 236ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8072199970496&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B5B 0
20 B 237ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8072199970496&version=m202301230201&ct=76&x=1&cor=16503900528818540000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8B5B 79 KB
36 KB 276ms
275ms Script
text/javascript 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AfV6go08j6J2qhbxDMY0VQQ4etoc7KPGOeg4rcTkyBrYsUz4xhgoOEuPIPRJR-MkrUrHhY6IIdLTS--e6QOXcl0-LFuw&cry=1&dbm_d=AKAmf-A8hcbqnk7QJDVH8qMAlQ6W9J4BSIvebkuafWNbinnNk_3WR0R2bJvSfqYC3yuSHgSMAZfAzLYDOOI1y5hdFRb29gVszB_hw02gmwcPE-outRV8wSHZ-yD1I0xQxjcdxomAAEpfs-lFbJZlPcG8IRAWywJ7UcgJERLTZFR6be4-Ul4EEIluboHhHEP-rSZVw_xQV_HyrEdkmlo98xJB4qrhBVN5CkuIo-aztZei5p9R-4SkRQI4Fziw_8OSoR4KmVPc3krRUKIln3UchuhLY8KE-XLA_rBinfuRwZCXnmyv0X3B6TQy4wwEaPocrl6jRZZALGV_Xg_9OZMz2u4Qd-K8ONgalOXrB2ocCbZ88kDEWVYZ9d2bCcf_J--loI2PSNkrq9vGTVxXwxx2J1cv_x_lHyeGSX6TROD0HzTEv3g4fl51Dsrx8blFpAQptKcppB_r3uVb3KWAGauXthiYnOCfc3HgXxCIa03oOp3L8xONI_hjL6-z1ADY1IuKKNgWMfDfxLr6seNMduplpWcD0xNE8OGqd0Ah4RqtzCjSVdh4ztb-VPusOSJOkHhVI_hYPNc_YcMEee6LnN72h_BB13BMgHqS0ZYJK4ZTURGi56hEERUn2xg8hGLxmmaf-DQLWdXFdiD6_wczKF9rG0cFqXBkDPSU4pHWnTjMF4k3wDCCDLWucDGfNYevCAHgtJ8wvp0sJq_2x_y9faWEttYIfAEN9yljnHiGdmZLUYxeMlqtnK6qx3gztbUuLv0QqU0dzJ5c230_fQTc3BOK7depyJOfv3pGXR1wHFdUToTYqqipmHbLeWNW3h7tCRIa0iy8n7Y1lho9v_7cNLrgY7S-R2TfhblTQo6T1Fk3s7tdX3zwkd_bIZI3LCVAhlGUE7JQD1BwFHGRTVb_fhgQb-08R3j9K__fdlXvP8_btNrXYtnhrKGatKnWSBDWRLZ06aRWwIXmyd-R8B3nfCkklOLZ-Rwc3F7eDzzjq2hRnB-Z8bSmUFg55Y2NARczoyMNM4hkz6weWo2xfbUt_LZ18GGdgGkxgRw0bhplWJ7Zw_1NxFR2cNb5DpQ8Edfe92O2BeUqNxe8snXt86hcWSXuVyTVl1lDLjGDd1ZtvNWJh4BeqzmWtMJQwvVO2MPzvyIr-tpR1WaboqwgEVIeVamFwFmu38SYi8GAD0CulW31wp32AUgGF7F0HzlRXsjoXBdKW5akBlkX66DcpAZwH_zQFT-DN6zTYzjeY94X7U_JHhrp7WQ9mUuEF8aefunEhNTcT9CvbfinSQ-jB6w7UMFQuubivcS6vMu03dq40od-6DcAJ0mhlFs6mbM1ifVoeTY24EcsVhOHh-0OZDIzYRklvkiduypcXl_SEV3QYNo_YCGzYuR29CLocOEBGSQtGqIno4QjOv3ZMaTYJT_JCAWLPbYDrqVVQLXXwJDby42gDo-2k33GlaGA4D2X6bsPPp6HGqbEzzW4DnScamUY3uKngy_O1yeBDAv1Ac7og6n0h1S5kLrkDj1lvedxhpiIRIlJkGV9sqreUvmptWfPbGPGGWgIKdeIfBA62kcOFvMIR5tdYbtBHHAakdKqYQS0GKmDFHSDet5hB8rQrtopH6H2lHc-UFhOCJJ6mBpTrQL56CAo8OYtEOrgdhYelc6R7C753hzjYqjelMcuRQNAxJ_Nnjz7LcpW6dtN6ZdnhPaoV-U3aeFjKv1tn7gtsDA2D6I2HObYNubjd3IJO4er1ToV9_kwLtWk-aduLH2lODF2gJef8srnBM3BXG0pnLIbvCxf_Ww2yJk7snI3toirhWh0GYX3NJ6fDDoU_3lZ7wujP5AiIKXmIf4Uk2F4j7hNGfJIaneqwAf4pzQ6X-JtuaI39q8GY14VyhKveV8mhZXxOFCjlANkF5Jiyq9h0kXAT9e9VQoNncAH2NSngTkliDG4qBb880a-WAxNuOf1UhF1Ctzny6Sj0OCBGIwPXupylwrwN2bzvKrvpI9FNHG3tKb3Coxm3SARNnowCZOBErscsRHSlYkwzQc3NrbueFvXxk5d7T4c_OOEdKnCGKM5gdFeUghE8FjPdDIgjo18TmipBaACpajc7zzK5Je8Ov5rkVEwIKeraDFuiyxr2N6UWVVCAzbSgq4PL1FSW6xGixoRbteRSssnbVIhzYmZNu8rHzGaFIRZoQoBAwmYU3tWq-eumhsfnVc3Hi3KIm99dD2LgbO_FAyaHRPo2aTeuYgdH13Hayj3cYoCJ9ARXpG57z3xqiu8De1ojdYRTJ4MdesJqt_w_5D-vK6w8qQfXXP70ZcmuoVGdtejk6IP1-OIdHaBrWiofGp2px_Ux3GnUGRaDnd2tss_NWsNnF9wMQFrh_J6M8as7eURD9NJablLGktifl_ADXSIFAuuSNhUTD_QSh_trz8JaPcLyywtIBnEN8ua7EfS9WBeT5bZaGg1g1wsFrPPJvXAL_MDCXUbSgIvqHbBBg_oeldss0bMGq5I_3SGR1Ijo_shQTW-BbYP07kOL_K8jMOqYXcqaNCGkjifjHHdKHq00BKCehFIbBeXITuA42YifykX3wVAHS7wl0DZ0BcAiDtD5KclbMQpvrPDvDJs9qckRpE_Yvlig7cjSKqxQw17F9DB40ksSWTWgwKGkzor3NzuyC0cXQ4-6J1XhgsR3BD2lFWKjCn1Y338BZqfzjsuP0ZNaqzdxeosQwLDIaOKS-4H-OtT0gg9V_vAkZ3_DCVTI2ghsWCsbASIglFFWa4Sv4qGL1t0a37fHFQQvg2JmtYjyjHbYi7T5H1MOvylh_PUWA4QS7feyWB1ct4csjKmGToBj_Buk8nS_-RMQrSwNRnAnHMXqoGJNbQlouyQfz3xdy4K0qzmq-EtpSl8HBciDf9MSJrOiUAOq4ETdC4AgOw-8fgA2y_hQHdFVjpBpxxUfAUam2lFSbjvZrI90UYRSajiooowNR247_4pYV-_E9l-k7pc-jAkmKJ_hM5DOKqFlM5DCYrflTB8fBXYY0ORSGN4ftdmg9nWOkY4npHSuihWOsp-cny5B2htderR95dzE2r6z0YBoFGywpcmX260UioJyIrmcSjdWSn0OjOvOPuNiwEnGDE2KG52TkyN0SemF2VbkELs4jm3AqsH6LRnCmTCAHQHlDpRU97yXlP6iPDx6WqpgwWbJXR8v6-_b0G0eJfe6Twv2IhF0Tv4ul-aJPYb6X2WXy5w6n42pYCeoT_TxxVoL0RkTZA9X6t-U5xkVxGlPdFeGZhVrBg6N62eIJf9hIRjiaU1FQ_Td7flok4FGJWRvnoMNTR7vMypvDzXl_LZtWTlNJKyDk2GZb2695ux8ic8t0hAZothFcZtfIMn6lhqTcGvDjmIdOzlj8EEX18oD8r20ysAmuK-1E99F7dhUH2t7k0jMOOOhoEMk1XED1Hk-fE54MH8hQ3EoVPPjM6j609y01Y7oZBIyXFxXhdgY4kbVo9OZE6Nr7Gh1zSjcZkoyqY2_48tm5FsWT1H-0Z7BnbpVkvgfwWL_t1tMyj0cNVF&cid=CAQSSwBygQiDur6N33NOvjL3ibWl3gozBFUtUZF81mdA8bkVPFvC8AIT4DYGOsHnG55clYXXC7q8HZlNNxHGvBYukVVEnVSuPU0AxSLsNhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=16503900528818540000&adk=2857193498&idt=303&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6cc2d9ce9cc41c5b2a028aa2aecdcc04693f296b56bf70c04349a8d450d34da8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame E293 30 KB
11 KB 236ms
236ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A8DM0d1JmI-vSjDes1iOluJm1WnZG_EbHkWhxiuCiTftlmDrifyoPL77Px_vYuR9wxMfM7txpWmPG5vXIlsugKdn3cxA&cry=1&dbm_d=AKAmf-Df7B5oBYEV1ST_5NIJaR2651BTKl889mQMeM0ttFTeTFsMw7duFh1pQ9aVDA9Lork0avVk3XPOY8jEaAbpDTEsME-PCRZv7hqWxDjpYPwv32FgYkoga7gGBThXGJ3Ay0xbYMpvomfW_KepDZdRBPfvotUglLtyXyk2w7XH-BvTUp50OgSHCqY-DVvDaIVqL5OaZiFtjXZKZK5zD1A2pn73xa1QiWq_Dplo2ljz13AYUBL3xYOWPMY-46QUxM67dp2WgobueEidIvrhgN3m3Z-CkD-00TwPYiGTx7E7VC98w93IpEtcwMBH-e9h3JTiTzi5UeGs3IBVssaw0SbQRGiUMWnOzJp1h6sJWUAaXaHtDMHhOoxswomAsfGxscPlIN_5Yi_UqO2-8kmJr-BQVSDuV4piM42joFuYzazcBbBMIpAqw-fESsBNyDo6CbQAnRnz6lCv1ejLa6sCnEAd0SIID16CvkFSub4dkM8VYKapaNR4hDyxekkgRIAt2KwDTDNnMJ18kTNdFdtHTIBXijDU1WFh8nFPpXJssesfK-qLUTsTtErz4de_BXcnTK7Ln30rxrpcWn22n9pd4TEnvio9mp4QD5XJPR3d01oNLmcbnFxWZNBvtFsuHmsy8R5-aktdlkQhqEBAdOAOldK0AJAZ_u7v3Usp3AATTpfVwIfj7kL7e_6BcLK8rR9NtJ8vJozlWII1VXQvCEnOqBRWuQ8Wi3uurUrKDwVG_r_O-4vmUPBRzVYghqJ90WvseTbikOIxJUhkYoE9yBRZDlrufKoy54lAxk82HzqUbQATZPwkMf3If7Wb6_7ymSw575FLXjCAuPardaCssEM2Lu-aYn8QLk28KU5aE7DX3DYPktGbMuJekxYFPg5SERdCbGIoAj03njLOSojsj24eeBnzXipquoGKQg6Kiry-2ieKwsVe7gQ30vZ2MY2IxwKOpaNvVvSuB49SXcgKNU2fP3gu4wDTIWtgYmfYy2-8EigJ8OhCqQtNGXHoc0wBaWOLxvioKp47drBjYeINLJdzqFv5My9bUv5mz46Thq3kw8X-L_bSKvFYu2CMXtE-XHeGyg0NfGEt3Ocy3gwzI1q3PUlOwNPgKMJwzKW21x9_q_ne057NNXBMv9X911SrL795QfaqDMniRTaM-tGX3ErxzY_4YEq6vgjxdz-ZRweq4Y0iYGDlwe9v7nVpeq5GspmKxg_Mb_UvsK5FaS6-Vu1o-KSTIj0-BbH7dgV6yJoGsugGTQ_WsREPFQ-X7IsIL5seqDBT47qTzGdNBh7KLHkHrLXQraZEF5_SDT_3JIOnjXVqmPylanSuOO3ZG3fBV0E24OKIQtFSgl6z6EIn-Nis60Rv4RaqzLTfgI-YRXKGYKvevwn3Is9eFSxa4wgI4O4qcq4-bEQsV_0dalfa1HT_1iNE8F9zaeB7oqtZ7ZqqHNYxog2Oqqtm8ud6ooGsnov3ZvQNwABXjcCk22N0dIAReIFlNLPaKKlyoU8-fF3tCK7vCFS_FqQOM0llkra2XKuhIOd-tkIrZJ3kG_isS3b-WHBUfahqiKwgo4FRTqsD-eS0b0re4cu3If70n8kcowFu99TgUV9elOQotXyoVjTerRyLBy4xJyTY8JkPyA9NpYsCmxh0s1x9VckkZw7qkK4V1zAAXauaj7M5RNK5cc25Q2a6IsN7h98YYWoWKnOeEuSvc-Atlx0M00JmgVedw5znYMf_DtF8D8XCvEMe9jnCyfnsv3vN6iBNpXouJFgAOUIm3Hje3-4aVAz4VdilGtKXsKnRZoXYFmLyTblqwX1HOYx2gRMJVZntVbVQylCHzh6HlME8NARND5oU6jJ2DFQvMObngLw7STjYkjm7mp2y3O8L9wOBKUjqPSDGY3ExLJrGS48dpmXEP5oU_EAty3gEm7QafFzKGt75bTfZot4tLQ_jaxTVrZPd_gm3gLz--_UHX3vpsPCu0Pv2novUICKcLx1A003dRDcOHahgoy7lz3dLEzD36inMKgP-gMH-BCjE6tHKddFLApF5MCWbZyH-0XFN5zEJgVkDobEtpHI5iPty-_H2Vvs8C7BpPetiiov17AbI8vz0akVyjvhVnmFa_c0PrY2hY10xFtPWfcgqfVSjXx398269XTyfCn0tU57gm7MPpKNcfhKHhKanE-hSwTJuXQmudIaR7Bz04zS_db0O8mYDs0vghf05bplAJxOQadicTcHNUGQJeBhQYBFm4PeBZQbIrVpMPFd2OKdPdg2lkUYwg0hz47rwuKqdL496HztgCwebiC-Z3DbfAhCRKh-plcP04ezerLArvUYX3GnnjjC08CCSJWjZH1RaWlEj1lI3PE6Hiewn0OEW8oAF8Ewdy4YMKEwiSVEqEi__P19GkLigqOzZSJ3U6rWpEkBGJGQ4lPJ2IE8bAx-NBd8-MU5KGTYIUXX2v0zQhVvPLUbcVup8FZgNffXwaqQUz9GwIlxiDz17_SbM95AmuWK3PgI9Jm67GBuRIkWSSFU9aeiPJA4g2q-g5nUb5F99tgRZhBI3HFOV6DUXKyIXk_Gor4KuWJ2sCS_mFG3S0_5r4KCeNN9IP4DKQyi2AyERX0oEhK34BsDTso087mJTMWMbh7ALmjUE0adX5JBg9c-PjpOuyZdKKCyNe93nz9euaNQ4n4abs73CNZiWEeo-AsHe72tKhb7UYho3F5KHV9PsCoYX2MQC1ahZMTJffSvaj_ZRiHMhRyW1129JnhZ3NneEVFw0BeFDAnXgTWe40Uq7JFV2hgfx0fuTvd6n41BxkXPVVG9DukaTTU3tCjtcGk7VpG6G_ZpIP4jypoJ0Dlt6QdFg3y7oq5kuiunXKRhbUO4XLEVcT0I9JE9t_wwrp9CkYNesmIcgVKJJCubUVzPQqaOIrojrRMR0-Lh17paEWBCSb_tmKOyLCLnQM1DJa8vFZWnbjn_N971e9K5nkndO2KlnPifh2dKolCTqgEG2WogiIEsWQiNTsZVfD9PGEWz_pdD-b5weqthOu7SPi15FNbe5VGQDplTNKj0K6-04e7pNmNblEZEEYcX1uzPl8g1kIZjoxI6Cmb-XPNM-dlOZhjeQqrFXW9AEjBH041GA0Cr3i2q8ujL533vjPqBIttwxBJ5dpFeJ1Zy0IaTtZuYDDzQfs5L2t3SMtv4au4vUE5-eK9FWfd6PlV3cf315mLu_8OBnVx6NiBNmkLLCeqJSHyJGTmaKkV3DeNsdZFXTyDM8V1_urVlUMqwD6zjuR2XRw5Tb8DZo9rudQcIy9XvnRUe7jb37247An4IuqqTyiA7t3ZAk2CcggOiaem5RNf9K9qphCMzJg-6-zRYhjlazzoUSnFxQDwn4K4CjL9yT-g7xoe9UDpxlhCJuKy4M2pGq82VKzltA4JWHqowQPNiacCTe0B_54-3msUggnjbt8hha_Tv9J0s1_3xm-5PG3Iw2hY4k4f7Hcuo0dE_HlpoPshBmWa-jhktT598_YMFp5x-rr3jAhQkwcLre4Rtv5zghJrx1sMdM1LbO&cid=CAQSTABygQiD59VdI9IDvQybd3hWvCrtmzbVfT-PGgDDl1oE7iA9WNZOPUzyvbcly496AmPr5933CPlnhGKts93-3mrdiX76Ds_Py_l-tpYYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=12163029002883744000&adk=250412560&idt=667&cac=0&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:24:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28500
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:24:01 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame E293 11 KB
4 KB 291ms
291ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:58:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33649
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 21:58:12 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E293 0
0 751ms
254ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZXMHlcWEIZfvFTb8zmvgOyTi3YXKrTz_bnVVaGYQfL-B_KyvLaNG6FIHC78wkj9U1UeUKvtGSRmMrag8KpN9tQf8y465uvqCh4UvMYJSjyOlzeBG67FtD9ZPF3jDftBNDMZaVE8bF-TVh8Z1HNluyCV3xemyzCQJ6YoVQO5nznFylWvuJrGKBvWYil_VNMgihNqOPuL--lCnTV8N6SNrY55X4epHWCEw0AnDEqRJ_dAXycgPfepnRIFri_STrsPHqdcn9cHU_XuastaVxn0ufNK1VDYeg7-TmhqhAC6vBSHJ7_IcQyCuj1DmaPgCDpU4FmeVUMX5K3Q-UrmUOwpL51N93Q0cN8uR7Qw6B6TnCwxUUxPCehGbq4Dtubps-o6rJigvS_InwuLxty5gu8Sl98enIgZCO2NaMyVvjxfQPAMhgHBIVa8Nfy_sj_Jy6aRa3WDSsQZdaVvynFcR5LV12w3_BsA7qK8fTjKe48912YSy03AmUzWs2hN5TpoUaUaBU7qXlONSctUPWpigGvT8reeHKxngI1uGwdF1EVh8l7fowzdQwArMk1a_WJxGYTn5vEWBuvLLPUSsjAf7KbDFv_xOd_S6-nt5gXm4Iskg2YfO-nVDc3-luXNf-U_pJsVwgRxar9JWjbz0BLDdQ-WrHwqDwlhtO0VeaC4XkV65oqPN8k-efuk-LrI2rjKsnioVANSZSHDIolCHfciXT3SyojUPlaZYhedTa1wgsKysl0LccUCLVNjv3Wiv-sidL0MJiTCviqZ_DYTdpKPub9nqqPALevVLFcvQXwyACaqAkOizy0S_8YCL6KOJhx4LAI5Zv4b6oKVU1KrA-a6ErSFMFPb73-7rtDDMlIKZaYHU29CkPGERQ1JhRGy1oXaEogUundsXUD2_h5RsORubkiYuFIatZMX61VN4NTiglHoYpah4JHQTZc37ODp0M9QDMTejr2PRjsZtEUb6H4G9iqiVSA-Q2JUvdtdaMD46Ul4FA1a4bL2JFwvybHrdvx0MQLfG30pg936KlFjXzY7kwhGQuGkwtSgjoYjTC90me2giNirbU6ycFG2TQ65CTHgLfSNnbOespEcIcoF_hOBiXJywXRZZW1xxUKG-VgnInvTn3yR0_Tbiyzs_Rnt_QRkXNQBdALfPhhBmqW-_IkIcatBYI-88LiVX7hYnF4PWsWVaXxAUVTTaUFndtmSqKZ0UEQXitG-wa_yaKvU6p7V7S2yQGE3mSDYNn3sa2SPk7P3_0N-guC3XCAqg&sai=AMfl-YSiYLbHMUpagmw2ZsZsYjgkODch7MnsGPfpFJWI8ziQcS6rEAwo_cktd24ylDp1lzUlhtwr1ecuWmKH8ngzHE4tMX0-cNKwbkBKIS-z-2p8_UotxM3XwH27u6TKLwq30pgYCJ2RdNC9hMef75ksBa3hGSXBB7U7ZAYCzmA757L-PeWxYhhwmUpku6duuH7DQxIVB9emtYFLvj3SODy8HkN_87ZBZuoLjCnRRi8XVIe0ptCRqIaLVGw4Z65d1r5uBEd_ZOcQFdp03fJmW-B92GPjx1_Sfv19EmdL&sig=Cg0ArKJSzPWwN51hmXQFEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230620.37579&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:01 GMT

GET
H2 200 amt.js Show response
attentionxyz.com/55-15e40ad0/ Frame E293 132 KB
132 KB 794ms
300ms Script
binary/octet-stream 18.155.68.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=5417733&attrCampaign=26800795&attrSite=1589324&attrPlacement=323863712&attrCreative=162000675&attrAd=516312665&attr1=%edclid!&attr2=j
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A8DM0d1JmI-vSjDes1iOluJm1WnZG_EbHkWhxiuCiTftlmDrifyoPL77Px_vYuR9wxMfM7txpWmPG5vXIlsugKdn3cxA&cry=1&dbm_d=AKAmf-Df7B5oBYEV1ST_5NIJaR2651BTKl889mQMeM0ttFTeTFsMw7duFh1pQ9aVDA9Lork0avVk3XPOY8jEaAbpDTEsME-PCRZv7hqWxDjpYPwv32FgYkoga7gGBThXGJ3Ay0xbYMpvomfW_KepDZdRBPfvotUglLtyXyk2w7XH-BvTUp50OgSHCqY-DVvDaIVqL5OaZiFtjXZKZK5zD1A2pn73xa1QiWq_Dplo2ljz13AYUBL3xYOWPMY-46QUxM67dp2WgobueEidIvrhgN3m3Z-CkD-00TwPYiGTx7E7VC98w93IpEtcwMBH-e9h3JTiTzi5UeGs3IBVssaw0SbQRGiUMWnOzJp1h6sJWUAaXaHtDMHhOoxswomAsfGxscPlIN_5Yi_UqO2-8kmJr-BQVSDuV4piM42joFuYzazcBbBMIpAqw-fESsBNyDo6CbQAnRnz6lCv1ejLa6sCnEAd0SIID16CvkFSub4dkM8VYKapaNR4hDyxekkgRIAt2KwDTDNnMJ18kTNdFdtHTIBXijDU1WFh8nFPpXJssesfK-qLUTsTtErz4de_BXcnTK7Ln30rxrpcWn22n9pd4TEnvio9mp4QD5XJPR3d01oNLmcbnFxWZNBvtFsuHmsy8R5-aktdlkQhqEBAdOAOldK0AJAZ_u7v3Usp3AATTpfVwIfj7kL7e_6BcLK8rR9NtJ8vJozlWII1VXQvCEnOqBRWuQ8Wi3uurUrKDwVG_r_O-4vmUPBRzVYghqJ90WvseTbikOIxJUhkYoE9yBRZDlrufKoy54lAxk82HzqUbQATZPwkMf3If7Wb6_7ymSw575FLXjCAuPardaCssEM2Lu-aYn8QLk28KU5aE7DX3DYPktGbMuJekxYFPg5SERdCbGIoAj03njLOSojsj24eeBnzXipquoGKQg6Kiry-2ieKwsVe7gQ30vZ2MY2IxwKOpaNvVvSuB49SXcgKNU2fP3gu4wDTIWtgYmfYy2-8EigJ8OhCqQtNGXHoc0wBaWOLxvioKp47drBjYeINLJdzqFv5My9bUv5mz46Thq3kw8X-L_bSKvFYu2CMXtE-XHeGyg0NfGEt3Ocy3gwzI1q3PUlOwNPgKMJwzKW21x9_q_ne057NNXBMv9X911SrL795QfaqDMniRTaM-tGX3ErxzY_4YEq6vgjxdz-ZRweq4Y0iYGDlwe9v7nVpeq5GspmKxg_Mb_UvsK5FaS6-Vu1o-KSTIj0-BbH7dgV6yJoGsugGTQ_WsREPFQ-X7IsIL5seqDBT47qTzGdNBh7KLHkHrLXQraZEF5_SDT_3JIOnjXVqmPylanSuOO3ZG3fBV0E24OKIQtFSgl6z6EIn-Nis60Rv4RaqzLTfgI-YRXKGYKvevwn3Is9eFSxa4wgI4O4qcq4-bEQsV_0dalfa1HT_1iNE8F9zaeB7oqtZ7ZqqHNYxog2Oqqtm8ud6ooGsnov3ZvQNwABXjcCk22N0dIAReIFlNLPaKKlyoU8-fF3tCK7vCFS_FqQOM0llkra2XKuhIOd-tkIrZJ3kG_isS3b-WHBUfahqiKwgo4FRTqsD-eS0b0re4cu3If70n8kcowFu99TgUV9elOQotXyoVjTerRyLBy4xJyTY8JkPyA9NpYsCmxh0s1x9VckkZw7qkK4V1zAAXauaj7M5RNK5cc25Q2a6IsN7h98YYWoWKnOeEuSvc-Atlx0M00JmgVedw5znYMf_DtF8D8XCvEMe9jnCyfnsv3vN6iBNpXouJFgAOUIm3Hje3-4aVAz4VdilGtKXsKnRZoXYFmLyTblqwX1HOYx2gRMJVZntVbVQylCHzh6HlME8NARND5oU6jJ2DFQvMObngLw7STjYkjm7mp2y3O8L9wOBKUjqPSDGY3ExLJrGS48dpmXEP5oU_EAty3gEm7QafFzKGt75bTfZot4tLQ_jaxTVrZPd_gm3gLz--_UHX3vpsPCu0Pv2novUICKcLx1A003dRDcOHahgoy7lz3dLEzD36inMKgP-gMH-BCjE6tHKddFLApF5MCWbZyH-0XFN5zEJgVkDobEtpHI5iPty-_H2Vvs8C7BpPetiiov17AbI8vz0akVyjvhVnmFa_c0PrY2hY10xFtPWfcgqfVSjXx398269XTyfCn0tU57gm7MPpKNcfhKHhKanE-hSwTJuXQmudIaR7Bz04zS_db0O8mYDs0vghf05bplAJxOQadicTcHNUGQJeBhQYBFm4PeBZQbIrVpMPFd2OKdPdg2lkUYwg0hz47rwuKqdL496HztgCwebiC-Z3DbfAhCRKh-plcP04ezerLArvUYX3GnnjjC08CCSJWjZH1RaWlEj1lI3PE6Hiewn0OEW8oAF8Ewdy4YMKEwiSVEqEi__P19GkLigqOzZSJ3U6rWpEkBGJGQ4lPJ2IE8bAx-NBd8-MU5KGTYIUXX2v0zQhVvPLUbcVup8FZgNffXwaqQUz9GwIlxiDz17_SbM95AmuWK3PgI9Jm67GBuRIkWSSFU9aeiPJA4g2q-g5nUb5F99tgRZhBI3HFOV6DUXKyIXk_Gor4KuWJ2sCS_mFG3S0_5r4KCeNN9IP4DKQyi2AyERX0oEhK34BsDTso087mJTMWMbh7ALmjUE0adX5JBg9c-PjpOuyZdKKCyNe93nz9euaNQ4n4abs73CNZiWEeo-AsHe72tKhb7UYho3F5KHV9PsCoYX2MQC1ahZMTJffSvaj_ZRiHMhRyW1129JnhZ3NneEVFw0BeFDAnXgTWe40Uq7JFV2hgfx0fuTvd6n41BxkXPVVG9DukaTTU3tCjtcGk7VpG6G_ZpIP4jypoJ0Dlt6QdFg3y7oq5kuiunXKRhbUO4XLEVcT0I9JE9t_wwrp9CkYNesmIcgVKJJCubUVzPQqaOIrojrRMR0-Lh17paEWBCSb_tmKOyLCLnQM1DJa8vFZWnbjn_N971e9K5nkndO2KlnPifh2dKolCTqgEG2WogiIEsWQiNTsZVfD9PGEWz_pdD-b5weqthOu7SPi15FNbe5VGQDplTNKj0K6-04e7pNmNblEZEEYcX1uzPl8g1kIZjoxI6Cmb-XPNM-dlOZhjeQqrFXW9AEjBH041GA0Cr3i2q8ujL533vjPqBIttwxBJ5dpFeJ1Zy0IaTtZuYDDzQfs5L2t3SMtv4au4vUE5-eK9FWfd6PlV3cf315mLu_8OBnVx6NiBNmkLLCeqJSHyJGTmaKkV3DeNsdZFXTyDM8V1_urVlUMqwD6zjuR2XRw5Tb8DZo9rudQcIy9XvnRUe7jb37247An4IuqqTyiA7t3ZAk2CcggOiaem5RNf9K9qphCMzJg-6-zRYhjlazzoUSnFxQDwn4K4CjL9yT-g7xoe9UDpxlhCJuKy4M2pGq82VKzltA4JWHqowQPNiacCTe0B_54-3msUggnjbt8hha_Tv9J0s1_3xm-5PG3Iw2hY4k4f7Hcuo0dE_HlpoPshBmWa-jhktT598_YMFp5x-rr3jAhQkwcLre4Rtv5zghJrx1sMdM1LbO&cid=CAQSTABygQiD59VdI9IDvQybd3hWvCrtmzbVfT-PGgDDl1oE7iA9WNZOPUzyvbcly496AmPr5933CPlnhGKts93-3mrdiX76Ds_Py_l-tpYYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=12163029002883744000&adk=250412560&idt=667&cac=0&dtd=34
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.68.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-68-13.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 46b7bbdbbd9f6de3ba0e7478f8817b1cbe92b513b6ae02f149af0d84e7256707

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:03:32 GMT
via: 1.1 4376bdbc2156cdc5e55ce044165e0424.cloudfront.net (CloudFront)
last-modified: Fri, 23 Jun 2023 07:00:38 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-P1
age: 930
etag: "5c3b72c0dd30a599329697f6e19ee06c"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: binary/octet-stream
accept-ranges: bytes
content-length: 135045
x-amz-cf-id: 7_c_Sge4V7AKzu8ossiBXRLK65dKZtufy17Asy8KpVfZG3bphZu6SA==

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E293 41 KB
15 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116383
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
H2 200 3719703112507930740
s0.2mdn.net/simgad/ Frame E293 2 MB
2 MB 1223ms
748ms Image
image/gif 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3719703112507930740

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

492e86cb7bda3646a58805f8214d5ec09b34d8be2f64ea99bae276c7015aa896

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1841607
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 20:20:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 07:19:01 GMT

GET
DATA 200
OK truncated
/ Frame E293 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44729306ae9b2601c792ff55c408ee904945401b6ae06b7abfd0643643a7d587

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 6FBC 33 KB
33 KB 235ms
235ms Font
font/woff2 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c05::5e , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://castles4kidshamilton.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 14:31:53 GMT
x-content-type-options: nosniff
age: 492428
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 14:31:53 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 6FBC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

237ms
236ms

Image
text/html

2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/
Protocol: H3
Server: 2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Redirect headers

date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame AE6C 172 KB
61 KB 707ms
235ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:19:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 11:19:20 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame AE6C 11 KB
4 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A1pQRNP8G1K71kvQhJP-U6naA6tMYrYvM46f0KYKfjGzkvlwIaf1mwjh06ObKDuOBcxTsm-htleNY53QvQ8H8ELlo3zQ1eE2ZsRD_SUD-uYy_UhNU&cry=1&dbm_d=AKAmf-BjU9CPBfV6QBT87DJC9ER9omZqyTnrr8G9Jo_S9aFWcn1KhS9bL1BzaUCgmpio3ctkEjwWjSGxlIQGAzqS1zhRyFAWa9ImWPpWO4xO9mVNNBYT9SmL3CmXSgOeg5HbsmI_S5zNeeC0MvH1ByVBa7oCyePUNJNuTxHJPT_4X_PLFPzQWI_DBeR065usNGLFb698Gu-hJ0XI0HxhI8H7welER17urFhqwiLTiQVqPLnlCQhgGgsTz_bvP9TCU5SYBAqHUeJye1ZtggIxxUd_zrzfcsq-YeHts_YGo5_3WlrYF0V8sZ6KfnEE4A7fPoFw58W4gQG4aWQ-9UlE3WbVQ7l_8mhm1ZVmhdzH0G9oRptfz5Ceds2-K7smjdLYNlytfuDzqHj3ZHkwAKl7sV7S0IZBwTbaicSHdqIqSmyJ-wIAMqlSCFWXRTu1ZY1b2jzTeWArtiOFL_6b15kQNvOxkUy5q7jnJd5ZB7D1u6rcT4xmoGPU3iFJogFyXt6yMzvJ-Zx7sV1WFHe1JtBuJpop8iEG3zfQU6CaBs6JrTVeO5V6l9obduHK4jtL7gaAzGUuJ4ql9OI3OmEXkXvpcZaoJRFKmq-Ujvj7St8dskZzlmkldUQWm_YLVl9W2amt6qTzHUfP709UkY6BNv31UohYmxWqo3rcw-SeXyHRuxKuhpz7Oijd3PkDaojCeOwBcuQBvDwkhLBcPHubcmAvoVPzojLI0bQAgwlvliXRD5cCYnC9yUofZZ6Z1fQu7E64AKXaO3fOPZy9lHCQ_3Lmq0lOc-PSLelYISgcRt1j3_hCA9cQwHr-1NJ40hItq1DJGZmjsijC-hDwC3ZbYuOODOFo0OlXjruMTPK7YAcKzNH_mgh27KNAzxyI54UzjoZ_OtGXeSmDXFu69gGdBViXWa15FR53gGpi07UTw8n6v5TKC8NxAVBkriIpZu1LBw8VRnRogsLBNMAfh4CJ6LMcQq1LYeFjA9VrGfGo6nXfVful9jo6IfeZmL6U_NBsvyBGnW4JYvaLrXcAjrnBcFO5JNV7823O9SQMW6eC59gLCIzUOLvmqbZChh9Hgc_SmWZL5HdB1qGH1a38qDQlCH39vAobXJ1hDQWNs7AzDsnDdk6OwdZUn6IutBWPsM4gj0Flyae9A1yPT2GMLbVs1AInOtIruifab1ngdfJlECN4yKd9p8YoG_7nLJkH53nF0nDL2XbYYuJ1dVYW6pD54W3AETh0otBdwDcd5cr9-QRrbrIlTl2jCZ3d4H-OBQCX-or3TgiJBJvX_wBHjGG2PfaajLsNNY3bOGs2jLER98fXUX6ERl6_1sb9aVumliWbHfh4OksmC9MlPbZHN0KgJbn564uLvI_snLQDZcVxIzrz1E_DTWyQUVFFLksGkEnX7_erwAb6Z-BWvI-gcuq0Xdirawe9CdU0Vde6Qf-QN1Ax_an_Wqg4Vfm56W_En7JeKl28hsnDXT_jklCLENIzgcv5RlNkNUbkLSIbP4ReXqZhtj-M8ywv_q-tourY6wSH9Y7pYhTODsWQ9AHDKlhlSMAJGfSECL8dU5SP9XIg7zLAuZsH5j8j3fgXgX3HOdyOrcQAE9753_SaFg4ltiwUhhwygqc1Pt1UtSzz7Is25OV1_-ysJkb7q4Xb38OmoGKRDKEEF_Jb4L8VvjP1FV8epLf5ursukkA6iGfKHN2E5nsoP-QP4S52xZzemTVJ2v5l_o8iFAFdKSsWxLAHZOdDWa8Csj9M1EY4AKum2XHDUgPRJVz5GdvhjYc8O5CdpFzANlY8mfBvPIyp9_funIc1QgUJeS2Z-lt1aE-f1OXp9Vt-NsF0pLoNDZt9qTPsiBs61C_H0cjp6TzpU9ATVlpx6vdy7TIxyMGTNMF532tLE8OFewR5jWyt1yIeHx7MoKIy6SWm8rqvPxiaqKxMzpVUgfMojwMS6hcNRPNAx_gn4kNDBOUjkoeVX4XZPALMemgRIt1IMRRhlD2y7zCEbiikwzoL_BJHx4FX86ZtR2DacJAKuy4KWEAnX_9SVTm0Kd3au09TPZlLx4N04h1Pr0ACCnt8fhkx6EqAge2a1rmEuQlA2nUliM65QvYIfCShY_dJWOuh_PeHbO1AEnKbNMgNL5eWESWMoq3bsAaBfwfw9FYdQWDeGxN0wxfxJDoqt7p5pVUOx0eS3OhOR3MvmVRlE7wWQtZKwwUF--D-MAPTVglZKRLAmKtYG0pOukcYYM3ZK371ksJ2-_kka0tQ_XqmHrK99gmA4aAvhAPfze6MmK_7yjwYvjXF_wfom2Ln6t-76k-pTTLyUPPBE0vlY_STIc8JuZGGYK41p0Vnhh5G5heWUBCV5HaHhSmjdGNn4Jm15q0FJz2SU-8vh5OHCJJuVFyY5l7LXXMxNUggH0JK3wmp18Jpuo3iQccgS9l4Z3Aw6errW5NLMMDuODn_xymZ2JRo2s0KH13MDdrsSFEKZrMYbRlZYvHPRe7PZbn-FtGsWtni_p3P_MtqcTqfnoNnDBwxa5T4qbXyx4H0SUG4CC4DOiFvCdRqDJopBzp1Va7ubnNGfbXxk-xnk4zdD1Y6UeqwdEhaIHDP9YxnDY92nHBDbxqlrEHmzkMAuLIMfGP6DEK7bA3mX2irQixZ9fPwjiWtByxb6VDrKNpUNB60Mx5Sz1SZBTgCHO70_LOhrIfrTsZ8kxdhtcWN9f0Y7bz0fnGIhLWSZDiMeUgQEmmsDD-lRPalu2dRg15aYYCjXJVk4P4CWH2JTQm88MGjYML7kczG-LMpleyjJ70dclcJbMPAMCDMPAgmbiRIHukclQENs491P45BHz6ib6KpSRReB0Q8UWj0oZ9Ph629MT8c_W9ovG_yg77ud_x6XWuEA8ozxfAG_XTC_JeUmMc0MpW02x3Adu_Hu_pbKEy8nuYZ_FZDxT73kTbOnAk8tiehwqOo4VPRZOXJM0p8-JTT0du7Q6zdwm__bqM928CaUIuxeXA38X6NKjWHAnOx7sRLdkFRz0hg4YMSH89zdsGyvwIhXCidO6YR2OFB1dKV0leuyHhkTCHFvaHiVAwniEt6y8XuxKN5k9W-o7AkDDYsJTLBQmFKgsIaAhhfgrzla8a5yEprpOFjNvW0vZEmZCOvoPLqjn6a0302_bc_dZfZ6DZbvF03VQd_FA49Zh8I-qAX4V6ri--XXwBu8j8qTJrORQM7fqYxjFyec-RCcm3xM_QqrmeqWQpDGl6AhH-rbsCfdxZiXX-FWFTQ8-Aadks5KAmriKr8WGu7ZoK6k-_XmlFZu7kVQYzygew5NXvG4YbT8GomLZit_JP5saMrrnqVlwcYHwYPUp6towCUqaDwiYqkWFeAzYYZhfn2zFo25qfx2mm1cZYz6Q8Y50MYI_V0Ew1I0XTd5tRNvcLDmMKdZABpDrA1-OPLDjXSfUVTtA&cid=CAQSTABygQiDxwvHbdhQ2eCftmXCdpQ-8zgHnXETrd4qwA5LNWsyDoMsqLvM7BeehNaNyxRmqlZ18gFz6s-HFpOVmhCxDFHdCQjKKS3QAmAYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=9812311831627504000&adk=2228999115&idt=569&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:58:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33649
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 21:58:12 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame AE6C 30 KB
11 KB 250ms
249ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:24:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28500
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:24:01 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AE6C 41 KB
15 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116383
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5F08
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1

43 B
632 B

391ms
350ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBC5tFQY8M775wEwAQ&v=APEucNUMkmLDObV_nknvVuL908eB-MYCOMy9bk55roPRO_xNgNfptVaIon9UjSeKA-0p4SsbBKL_-JJwZsiHyFLBvlIqOI4VNA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5F08
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJVHZtEEYAerqoM5KffiLAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1

43 B
766 B

361ms
360ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBC5tFQY8M775wEwAQ&v=APEucNUMkmLDObV_nknvVuL908eB-MYCOMy9bk55roPRO_xNgNfptVaIon9UjSeKA-0p4SsbBKL_-JJwZsiHyFLBvlIqOI4VNA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:03 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPmJKP8U0tWWJ9y86VyIsEk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5F08
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEG5uTqJHmqMc57xHRmJouxg&google_cver=1

43 B
1 KB

441ms
273ms

Image
image/gif

104.254.148.252
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEG5uTqJHmqMc57xHRmJouxg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBC5tFQY8M775wEwAQ&v=APEucNUMkmLDObV_nknvVuL908eB-MYCOMy9bk55roPRO_xNgNfptVaIon9UjSeKA-0p4SsbBKL_-JJwZsiHyFLBvlIqOI4VNA

Protocol

HTTP/1.1

Server

104.254.148.252 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:01 GMT
AN-X-Request-Uuid: 93ec9db9-da69-47dc-8ae1-adc8fed6d394
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEG5uTqJHmqMc57xHRmJouxg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5F08
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIxNjAwNDQ1Nzc0MDU4NDE1OQ%3D%3D

170 B
232 B

247ms
247ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIxNjAwNDQ1Nzc0MDU4NDE1OQ%3D%3D

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 07:19:01 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 103.75.11.92; 103.75.11.92; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8f1a2ae2-cc1a-4504-95c0-f2697a802d5f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIxNjAwNDQ1Nzc0MDU4NDE1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame AE6C 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 845f7c6d3de00a893dc898229a437a930cd7f471384556830fce104fd607f0f3

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9868 41 KB
15 KB 268ms
267ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DAgC9useZdW7YXlhuhlRIG2TS71tUrT42fXS9TKDBQ2kZnhHgMLr48y597IUeHH2uu6sbWWIQQBlU6bob8vqAfs5SlmTS_3lKH0r9WNmgFI-wIEtdn_-L6kLGvYNEznIrCmIBgPwF8ORxNa4ZwQ-6e-W9fcKnWzzb9VWvYk_H4xoYwz_M&cry=1&dbm_d=AKAmf-Apg2PFF90hUgzxKJ_kgO-5LaIgLo6SMFh8HeoNQ2Pc5ADqbqV_UZnslopeg9UfYdDNC-G6ySADPOL2hD-ZGzr7ucHRemcSI_sT5r44xwpk_sE6zghXEY5HWvit3wPrdwzvYyE4OBrbJhRoBaqcJD_VOgurG7S1cCiT4qcS7NEoVLQNFZZt2iEDDAI51YG7a2TH_vLjgPIzvFB_4de8gqBtkfGZN3sJsgP9yiJ8RTwB1UCOj3ud3_ietzd6cjlRzeNvRT5KHeW3PTumKUUD9WBD0qxDRlyg8auetUiZ1I-93OZvF_SjlEs6zUgKy-N8ftXo6-h7Bvy5B37l5s_a-eSwZI5txjfVyw1X1PVsNgUO9yBYZwNk78Us-LgKBhUleA2h7mRFHKVyrGXZ_6hA7XVIR2B9st8J4ugllmWh04qAxXVpCrfDLwnQzoJ-AvptAyazSsLlZ73R4mVh72EHmyV-eACh76YmSYTVyi9KYlMs5l_AxiLxPpNjjfP0Fjqm6cD8oChTy51pKqb5wx9Mzm3dYQSaGWKFzFrWHOt290QI2HCch6Rr5OcYnY0GRnH5gNBj_8ye8FoJOPeIvQFxsAJIfXJsELF9bZjxpEePA57j9ieCRh_zefJlKquzAsTNdZngRxBZcWdZwCaJGiQOTdPJpPlQiOuTwwGOIxC9GBXlea0lb1DpnLxvA6Qn9PNIcICCDd5jyINeMhpIqWA0leV9BCPYr-uLYiVHeP5shwVR0-dvuNGY-AUkGKDsbB7HFPZ0XlLIqzNXjRRxjNKgzkb2YgX6rPfH9mEhnx7RzgHGVNfWJJSbkPjqpSSfwZOb7LxMzbwxlnplgNV8t8i3Tbcu_Uccua8xc8fhS0T_feQBO_TcjEmrWfYLwtJtRTk2-rqmT20bgo0CDTG-AeWmwH2lHKy_bj5qHQzd8mf9sQSQS4QzYxF63d0rRIXuG56Qkk-WnCnMIiTMIN5jckXBE-zOTRlxNM1ouUnlHTlvJeGW7Hi2muVDvkV6J4VPSInfoL450YAsCd40BzRSesHOmFCYpkgmDuDTm4BWq7oeQsaAtYleYqCQpnbGXwC6n8VGzR57xPDRKYAb3iXpJiv9pIf1VmmzjrpLQSMhvBQqY6j5jus-TOJv5ziRj0YozEzFPuMIlHxtIVByzyWocdQxHkyl9FSyUARH5ihGPWNMEMuL80tLExGlxjllZFg0WbPysPvjth-CngyAGC847d9rt1xWHRyyntUc3zODrEcwpZbvepPOOJ3dVrm_alrY3-9HmG8KmC_h7eKZZwosRLPoLGAbmfRU64i8cq55mUsHemJHnd_qI58YbHlTBPIb7q3R9FVDxLj8Z8pR5Z9GERTchP4TZ3D83uy5fiEDW1M_GGDCM3r7t-l62-NjS9RxFx0RgNTpjp1Ba1jJFbWfU1FSS3BQcnga3L9Ocj64nBloP5fXcj3pITtaKT8XDQISAUcmT41hL5sdxur40nMxxf53Va4i6sOS7czElBd8pxBDr_VVVWER_WD2a0mbWwANuzKiJVhBvIpZY9w-XPFdsZGW-CmGZFzbiy2rthzcLrIlYwMueN6ATnB1yYRpnQ_q3n3qZdjL7BItOEFRb8yrn8g8z4XhqEbWqVkDtmZCUaMSr4OD_Kk8-zuNTVYsa6KO47LyS53B2icSg-Nbt6Lb5_tzvsdlb9fOUzxEfQLwm7_oklgTEqv5lvGOHZLCmLH64PNvzMnAkmLgP0kdDRd7Mpr5t3Moosh52EZRqalxlNx5GddQtZnvZM7iCdmJIS_cuGWhaYoxm0FwLjVGpxlNss4qolc8tMcfph26KuvG-8xa73RsVRiFoI8Bk52O_wQZba7Oh2icXN5m5JssDk3HwUejbnslaGiatV9LtTch50lpsxNM2ZnMOPkBboGWZsrqFF1OZz0TIZ9WXdhSt9VQbWQ0CKhHsqiY--njeT0L4zqxqVUZVzY-N5oZ3QN9qcFy83mXXMad8RD7mw4PoPZKSMbIhwvXNMR-QvbukhF42nU7pK7GQ6MdPqVSWA-1V_ZOVr4EoS2NDJuJslPgmXTjcNsbvMLZ6D5tOOPEOVhvGh99Avc2Iv-wTZ2aWeyhMavPp0o8_LZdAeoIUDpoOoK-xX7V3qQJlkDhQAgZzOAsYKPA-1F_eaaZbvO2l5nXHRPgCDxlaEZ85kjJnBdULLYj7xYedpI-kyFnbpmXTycxBak_BQyYg3JyvKW7AX5xspMDu8WuDau8yQun34GeLcJKUWy-pvnjV1vXTI6SPv1BPNHnBa5NpT-aa1bEGdfCjpgIj2NKkuGeh1mokcZVoMzJ9ZHsN1HMmXfQ-52XE7oDDNABCQpitRce4YDPPaxQORp1ulhT6MaYYoN9ra4Nf6e01cd-hEdhD733xuGTo65pXeHwAuTvBygNUXHq9hA8PbrZDVR3D1lLBqWY1x6rnsRTTNM7hFCwODctC-uai52CGWpiUzIwoo3g4-VTtEjoNOYiGDZy989HmGRSLgHq3lUux_bc54GW6pJD3TOtDSzob_SjnXCHNluB9O48gq2EeBfRu4xddv2PFlb9p23lbaykbd1bqoZTUUuAIM5nUjS6t6s92xueo0cL2rkPoScPmguFD6yIzjsX33Ez26791V9jJa2e7Hp8z_jPzs9C6-wapyxIHifgc-i43Gimah7qq64CrrU63sKknyypYua0y1cLvkGzlyMHkBgJv-1A9G7tvs4oS-GupVkb32x51OTfIGNqYLOvz56kpnkd-qTnc0ZcBYepKwmmHWbyXIjUuqGlTjIp4f1Xm9xMzeBGo-TRa1sJgFOvlyZv6IQkSAcYdW2OXA0bMwBmJJLmn1GLf9w78Z2f7AmoIabEhdCjOCEYkApABgxuOe8tqbwLIWJUAgZYJhV_OL1BlqrYoAkkyhiBonUuQP-8UYp4ShTGQN-mZlKlRW0xpy9uYCgh9a0JDxHbDrSXYYDE_9SOMvpIoltRglCzQRAT4nlesm5Bpuc6mSghu8Nd6ERysbFMHSVYa_YmzasMA_8gFRt8vg&cid=CAQSSwBygQiDqM-XVVQwEhRIIhJZdgGFbvKDpwpMI5MIfP_rNVXMI66V4G_zkyBHG-1UYcUDW2Ojn6arvdQfJplGJ9eybO3SW_h_St_IyxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=15046402328671312000&adk=3047537735&idt=329&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116383
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
H/1.1 200
OK dvbs_src_internal117.js Show response
cdn.doubleverify.com/ Frame 9868 57 KB
19 KB 254ms
254ms Script
application/javascript 2600:1413:1::173b:a821
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=27546878&cmp=29632589&plc=362584010&sid=8448220&dvregion=0&unit=300x250
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1413:1::173b:a821 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: c74d4c8be63fda641c0e0255ad3c7416862f17e31442a1a0ddd7645bc2d69d3c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 07:19:01 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Jan 2023 11:02:11 GMT
Server: UploadServer
ETag: "d07704704b2ea7cfd4b9f2d78f0c7dbb"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18861
Expires: Thu, 30 May 2024 12:16:13 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 8B5B 30 KB
11 KB 256ms
255ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AfV6go08j6J2qhbxDMY0VQQ4etoc7KPGOeg4rcTkyBrYsUz4xhgoOEuPIPRJR-MkrUrHhY6IIdLTS--e6QOXcl0-LFuw&cry=1&dbm_d=AKAmf-A8hcbqnk7QJDVH8qMAlQ6W9J4BSIvebkuafWNbinnNk_3WR0R2bJvSfqYC3yuSHgSMAZfAzLYDOOI1y5hdFRb29gVszB_hw02gmwcPE-outRV8wSHZ-yD1I0xQxjcdxomAAEpfs-lFbJZlPcG8IRAWywJ7UcgJERLTZFR6be4-Ul4EEIluboHhHEP-rSZVw_xQV_HyrEdkmlo98xJB4qrhBVN5CkuIo-aztZei5p9R-4SkRQI4Fziw_8OSoR4KmVPc3krRUKIln3UchuhLY8KE-XLA_rBinfuRwZCXnmyv0X3B6TQy4wwEaPocrl6jRZZALGV_Xg_9OZMz2u4Qd-K8ONgalOXrB2ocCbZ88kDEWVYZ9d2bCcf_J--loI2PSNkrq9vGTVxXwxx2J1cv_x_lHyeGSX6TROD0HzTEv3g4fl51Dsrx8blFpAQptKcppB_r3uVb3KWAGauXthiYnOCfc3HgXxCIa03oOp3L8xONI_hjL6-z1ADY1IuKKNgWMfDfxLr6seNMduplpWcD0xNE8OGqd0Ah4RqtzCjSVdh4ztb-VPusOSJOkHhVI_hYPNc_YcMEee6LnN72h_BB13BMgHqS0ZYJK4ZTURGi56hEERUn2xg8hGLxmmaf-DQLWdXFdiD6_wczKF9rG0cFqXBkDPSU4pHWnTjMF4k3wDCCDLWucDGfNYevCAHgtJ8wvp0sJq_2x_y9faWEttYIfAEN9yljnHiGdmZLUYxeMlqtnK6qx3gztbUuLv0QqU0dzJ5c230_fQTc3BOK7depyJOfv3pGXR1wHFdUToTYqqipmHbLeWNW3h7tCRIa0iy8n7Y1lho9v_7cNLrgY7S-R2TfhblTQo6T1Fk3s7tdX3zwkd_bIZI3LCVAhlGUE7JQD1BwFHGRTVb_fhgQb-08R3j9K__fdlXvP8_btNrXYtnhrKGatKnWSBDWRLZ06aRWwIXmyd-R8B3nfCkklOLZ-Rwc3F7eDzzjq2hRnB-Z8bSmUFg55Y2NARczoyMNM4hkz6weWo2xfbUt_LZ18GGdgGkxgRw0bhplWJ7Zw_1NxFR2cNb5DpQ8Edfe92O2BeUqNxe8snXt86hcWSXuVyTVl1lDLjGDd1ZtvNWJh4BeqzmWtMJQwvVO2MPzvyIr-tpR1WaboqwgEVIeVamFwFmu38SYi8GAD0CulW31wp32AUgGF7F0HzlRXsjoXBdKW5akBlkX66DcpAZwH_zQFT-DN6zTYzjeY94X7U_JHhrp7WQ9mUuEF8aefunEhNTcT9CvbfinSQ-jB6w7UMFQuubivcS6vMu03dq40od-6DcAJ0mhlFs6mbM1ifVoeTY24EcsVhOHh-0OZDIzYRklvkiduypcXl_SEV3QYNo_YCGzYuR29CLocOEBGSQtGqIno4QjOv3ZMaTYJT_JCAWLPbYDrqVVQLXXwJDby42gDo-2k33GlaGA4D2X6bsPPp6HGqbEzzW4DnScamUY3uKngy_O1yeBDAv1Ac7og6n0h1S5kLrkDj1lvedxhpiIRIlJkGV9sqreUvmptWfPbGPGGWgIKdeIfBA62kcOFvMIR5tdYbtBHHAakdKqYQS0GKmDFHSDet5hB8rQrtopH6H2lHc-UFhOCJJ6mBpTrQL56CAo8OYtEOrgdhYelc6R7C753hzjYqjelMcuRQNAxJ_Nnjz7LcpW6dtN6ZdnhPaoV-U3aeFjKv1tn7gtsDA2D6I2HObYNubjd3IJO4er1ToV9_kwLtWk-aduLH2lODF2gJef8srnBM3BXG0pnLIbvCxf_Ww2yJk7snI3toirhWh0GYX3NJ6fDDoU_3lZ7wujP5AiIKXmIf4Uk2F4j7hNGfJIaneqwAf4pzQ6X-JtuaI39q8GY14VyhKveV8mhZXxOFCjlANkF5Jiyq9h0kXAT9e9VQoNncAH2NSngTkliDG4qBb880a-WAxNuOf1UhF1Ctzny6Sj0OCBGIwPXupylwrwN2bzvKrvpI9FNHG3tKb3Coxm3SARNnowCZOBErscsRHSlYkwzQc3NrbueFvXxk5d7T4c_OOEdKnCGKM5gdFeUghE8FjPdDIgjo18TmipBaACpajc7zzK5Je8Ov5rkVEwIKeraDFuiyxr2N6UWVVCAzbSgq4PL1FSW6xGixoRbteRSssnbVIhzYmZNu8rHzGaFIRZoQoBAwmYU3tWq-eumhsfnVc3Hi3KIm99dD2LgbO_FAyaHRPo2aTeuYgdH13Hayj3cYoCJ9ARXpG57z3xqiu8De1ojdYRTJ4MdesJqt_w_5D-vK6w8qQfXXP70ZcmuoVGdtejk6IP1-OIdHaBrWiofGp2px_Ux3GnUGRaDnd2tss_NWsNnF9wMQFrh_J6M8as7eURD9NJablLGktifl_ADXSIFAuuSNhUTD_QSh_trz8JaPcLyywtIBnEN8ua7EfS9WBeT5bZaGg1g1wsFrPPJvXAL_MDCXUbSgIvqHbBBg_oeldss0bMGq5I_3SGR1Ijo_shQTW-BbYP07kOL_K8jMOqYXcqaNCGkjifjHHdKHq00BKCehFIbBeXITuA42YifykX3wVAHS7wl0DZ0BcAiDtD5KclbMQpvrPDvDJs9qckRpE_Yvlig7cjSKqxQw17F9DB40ksSWTWgwKGkzor3NzuyC0cXQ4-6J1XhgsR3BD2lFWKjCn1Y338BZqfzjsuP0ZNaqzdxeosQwLDIaOKS-4H-OtT0gg9V_vAkZ3_DCVTI2ghsWCsbASIglFFWa4Sv4qGL1t0a37fHFQQvg2JmtYjyjHbYi7T5H1MOvylh_PUWA4QS7feyWB1ct4csjKmGToBj_Buk8nS_-RMQrSwNRnAnHMXqoGJNbQlouyQfz3xdy4K0qzmq-EtpSl8HBciDf9MSJrOiUAOq4ETdC4AgOw-8fgA2y_hQHdFVjpBpxxUfAUam2lFSbjvZrI90UYRSajiooowNR247_4pYV-_E9l-k7pc-jAkmKJ_hM5DOKqFlM5DCYrflTB8fBXYY0ORSGN4ftdmg9nWOkY4npHSuihWOsp-cny5B2htderR95dzE2r6z0YBoFGywpcmX260UioJyIrmcSjdWSn0OjOvOPuNiwEnGDE2KG52TkyN0SemF2VbkELs4jm3AqsH6LRnCmTCAHQHlDpRU97yXlP6iPDx6WqpgwWbJXR8v6-_b0G0eJfe6Twv2IhF0Tv4ul-aJPYb6X2WXy5w6n42pYCeoT_TxxVoL0RkTZA9X6t-U5xkVxGlPdFeGZhVrBg6N62eIJf9hIRjiaU1FQ_Td7flok4FGJWRvnoMNTR7vMypvDzXl_LZtWTlNJKyDk2GZb2695ux8ic8t0hAZothFcZtfIMn6lhqTcGvDjmIdOzlj8EEX18oD8r20ysAmuK-1E99F7dhUH2t7k0jMOOOhoEMk1XED1Hk-fE54MH8hQ3EoVPPjM6j609y01Y7oZBIyXFxXhdgY4kbVo9OZE6Nr7Gh1zSjcZkoyqY2_48tm5FsWT1H-0Z7BnbpVkvgfwWL_t1tMyj0cNVF&cid=CAQSSwBygQiDur6N33NOvjL3ibWl3gozBFUtUZF81mdA8bkVPFvC8AIT4DYGOsHnG55clYXXC7q8HZlNNxHGvBYukVVEnVSuPU0AxSLsNhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=16503900528818540000&adk=2857193498&idt=303&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:24:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28500
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:24:01 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 8B5B 11 KB
4 KB 236ms
236ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:58:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33649
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 21:58:12 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8B5B 0
0 444ms
256ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLd21OCh7ysr77SWp6VitaLNC3UAlaVulabz8fi0ILYAyHGJeFGpAigvON1GeUAMJBYEGIrbcbto_G5iZVS2WKKk3MIu3OjBoGXt_IV_suryA8oc7Xyu2DIjJYndnuVAucqNUbRhyFCIKoV5C0L0XxSZdpPNHTsQQRSTmnDUmEygwh60JBDhkuStwKSGWDkfWO3OAE6IvfGcv7gL-eOC7y5bHjjbdpLk7Pyv3uf9gwvBtJmhHWiLkgr5LGQHBagu7nMzeikXMRfKkAofFlywLWM3Jz_D3FQlm2Iq7Que4laQzfy-w3KRJCXz63am2L5Gv_TLd9TS73eOoColDrz4rz0WDg-Ru8DB0bB_N3y-0TrVAcGh469nopLXmI6LSy7gOPWmIi8ZDz00nBbOpkjLaGj-KWIYJS3_LQtNVuXFRnXNTmYWmA5cRMBmuRVkTeC9gl04nQTW3dpyCwuzsRJyaH2Jwedzn17IlwfZ7bE_VpOF95wEHh7I9SBDRCV4DtFL4CFtMgR2oizn6q623HTk_ewpMRWaYafKDBwiLzrwJ_LjFtPYZkE_TDKFflxC4cU1SJFdst7u3klgGLD-fr652KcgNW9j2JClfIewP_xFTJNe1Zi3LOrKw3QNm7kllj4lfy4AigTPCOzKJhx1JbLR2ExqVDAkYWQEg5jrB0utFK_awS7vlSFrNILy1tZNtWWW_uX96DpscUuE-E81sUDZxdwZsUtqOe44qZzjvUy2YKZyYqDnAbP04SN_eBWIivHyB54P20mGI6fyTlmex1wgL-BMV4cGE1ln_hE7mmcxJHWzcTKy3RSEpNAnm_nFMxPOYm3wYKqYU893i9vABxo1b3lcbAfhB52x6Jv0klHCkLccMiTDQ58Kxx3lRnZgNmxViw8HGJZgl7WkfnK1eeGlqTTVdtRtg-8MhVzPc5tpbcDeDOzuQ_4e3yzbPq3wjUUemkWJEl6mFNo0JQDZQyrZk8aWXd77NeCgcs0k3lVvGLKxhrJbSujMUq1ZmFSf3oMmwUf2MZwLE5N8PGCIvlyipfnjBdfdFDAB6eE1UgwyHq8oaMLhiKwYxFUxJ0o_yP2Y6tWQO4-pQIDTzyw_BfT8MhMabd9F8Ma_mO_KNEdjGokHBZHAzcMWELygXSOriG0RcHeMqRbpBBUHrNyYLN8r8ZfBexYsh3gBiXA0EBPIrsMAdJkXQmlRSqZU3FGHTx2sTO2RUlbGYDkfyidjy5xeHTHFNlktA_oISyQ_r8l3yauVXoU-K1shxG4tZnhYxdJnfNPX_CaM3MmE-01ApLZSa1K7h3ds_1P85a6Flo_ENs&sai=AMfl-YQwRomHWtd6_7Nb-1u9aHbY7qJGiYBPWFvLt4FIvsvHEjQ1CGWVAlVGWzmgZNFCz3x9-Ykjbmn_flZBtY-40kViTuszSASVN0Ke-wKC-7bkTvzwbboSR0Hth0rdyxsM-p28jMVrIWinI7jyuJcEcVc82RhutnWpPqcnE473z1315f8kRm7P-W8-C05YxS8Ug6He-THSGILieslKOK21uR4gPP53aO_uy6nSasFkCFYDcOxNXWZ8mCkvSU_cxWteOVsKNqg0M-yXPq6e3l8smauZyyV_jtEq&sig=Cg0ArKJSzAO9hIzAsWsaEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230620.69462&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:01 GMT

GET
H2 200 amt.js Show response
attentionxyz.com/55-15e40ad0/ Frame 8B5B 132 KB
132 KB 484ms
301ms Script
binary/octet-stream 18.155.68.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=6232695&attrCampaign=29777392&attrSite=1589324&attrPlacement=365461496&attrCreative=191219526&attrAd=556481724&attr1=%edclid!&attr2=j
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AfV6go08j6J2qhbxDMY0VQQ4etoc7KPGOeg4rcTkyBrYsUz4xhgoOEuPIPRJR-MkrUrHhY6IIdLTS--e6QOXcl0-LFuw&cry=1&dbm_d=AKAmf-A8hcbqnk7QJDVH8qMAlQ6W9J4BSIvebkuafWNbinnNk_3WR0R2bJvSfqYC3yuSHgSMAZfAzLYDOOI1y5hdFRb29gVszB_hw02gmwcPE-outRV8wSHZ-yD1I0xQxjcdxomAAEpfs-lFbJZlPcG8IRAWywJ7UcgJERLTZFR6be4-Ul4EEIluboHhHEP-rSZVw_xQV_HyrEdkmlo98xJB4qrhBVN5CkuIo-aztZei5p9R-4SkRQI4Fziw_8OSoR4KmVPc3krRUKIln3UchuhLY8KE-XLA_rBinfuRwZCXnmyv0X3B6TQy4wwEaPocrl6jRZZALGV_Xg_9OZMz2u4Qd-K8ONgalOXrB2ocCbZ88kDEWVYZ9d2bCcf_J--loI2PSNkrq9vGTVxXwxx2J1cv_x_lHyeGSX6TROD0HzTEv3g4fl51Dsrx8blFpAQptKcppB_r3uVb3KWAGauXthiYnOCfc3HgXxCIa03oOp3L8xONI_hjL6-z1ADY1IuKKNgWMfDfxLr6seNMduplpWcD0xNE8OGqd0Ah4RqtzCjSVdh4ztb-VPusOSJOkHhVI_hYPNc_YcMEee6LnN72h_BB13BMgHqS0ZYJK4ZTURGi56hEERUn2xg8hGLxmmaf-DQLWdXFdiD6_wczKF9rG0cFqXBkDPSU4pHWnTjMF4k3wDCCDLWucDGfNYevCAHgtJ8wvp0sJq_2x_y9faWEttYIfAEN9yljnHiGdmZLUYxeMlqtnK6qx3gztbUuLv0QqU0dzJ5c230_fQTc3BOK7depyJOfv3pGXR1wHFdUToTYqqipmHbLeWNW3h7tCRIa0iy8n7Y1lho9v_7cNLrgY7S-R2TfhblTQo6T1Fk3s7tdX3zwkd_bIZI3LCVAhlGUE7JQD1BwFHGRTVb_fhgQb-08R3j9K__fdlXvP8_btNrXYtnhrKGatKnWSBDWRLZ06aRWwIXmyd-R8B3nfCkklOLZ-Rwc3F7eDzzjq2hRnB-Z8bSmUFg55Y2NARczoyMNM4hkz6weWo2xfbUt_LZ18GGdgGkxgRw0bhplWJ7Zw_1NxFR2cNb5DpQ8Edfe92O2BeUqNxe8snXt86hcWSXuVyTVl1lDLjGDd1ZtvNWJh4BeqzmWtMJQwvVO2MPzvyIr-tpR1WaboqwgEVIeVamFwFmu38SYi8GAD0CulW31wp32AUgGF7F0HzlRXsjoXBdKW5akBlkX66DcpAZwH_zQFT-DN6zTYzjeY94X7U_JHhrp7WQ9mUuEF8aefunEhNTcT9CvbfinSQ-jB6w7UMFQuubivcS6vMu03dq40od-6DcAJ0mhlFs6mbM1ifVoeTY24EcsVhOHh-0OZDIzYRklvkiduypcXl_SEV3QYNo_YCGzYuR29CLocOEBGSQtGqIno4QjOv3ZMaTYJT_JCAWLPbYDrqVVQLXXwJDby42gDo-2k33GlaGA4D2X6bsPPp6HGqbEzzW4DnScamUY3uKngy_O1yeBDAv1Ac7og6n0h1S5kLrkDj1lvedxhpiIRIlJkGV9sqreUvmptWfPbGPGGWgIKdeIfBA62kcOFvMIR5tdYbtBHHAakdKqYQS0GKmDFHSDet5hB8rQrtopH6H2lHc-UFhOCJJ6mBpTrQL56CAo8OYtEOrgdhYelc6R7C753hzjYqjelMcuRQNAxJ_Nnjz7LcpW6dtN6ZdnhPaoV-U3aeFjKv1tn7gtsDA2D6I2HObYNubjd3IJO4er1ToV9_kwLtWk-aduLH2lODF2gJef8srnBM3BXG0pnLIbvCxf_Ww2yJk7snI3toirhWh0GYX3NJ6fDDoU_3lZ7wujP5AiIKXmIf4Uk2F4j7hNGfJIaneqwAf4pzQ6X-JtuaI39q8GY14VyhKveV8mhZXxOFCjlANkF5Jiyq9h0kXAT9e9VQoNncAH2NSngTkliDG4qBb880a-WAxNuOf1UhF1Ctzny6Sj0OCBGIwPXupylwrwN2bzvKrvpI9FNHG3tKb3Coxm3SARNnowCZOBErscsRHSlYkwzQc3NrbueFvXxk5d7T4c_OOEdKnCGKM5gdFeUghE8FjPdDIgjo18TmipBaACpajc7zzK5Je8Ov5rkVEwIKeraDFuiyxr2N6UWVVCAzbSgq4PL1FSW6xGixoRbteRSssnbVIhzYmZNu8rHzGaFIRZoQoBAwmYU3tWq-eumhsfnVc3Hi3KIm99dD2LgbO_FAyaHRPo2aTeuYgdH13Hayj3cYoCJ9ARXpG57z3xqiu8De1ojdYRTJ4MdesJqt_w_5D-vK6w8qQfXXP70ZcmuoVGdtejk6IP1-OIdHaBrWiofGp2px_Ux3GnUGRaDnd2tss_NWsNnF9wMQFrh_J6M8as7eURD9NJablLGktifl_ADXSIFAuuSNhUTD_QSh_trz8JaPcLyywtIBnEN8ua7EfS9WBeT5bZaGg1g1wsFrPPJvXAL_MDCXUbSgIvqHbBBg_oeldss0bMGq5I_3SGR1Ijo_shQTW-BbYP07kOL_K8jMOqYXcqaNCGkjifjHHdKHq00BKCehFIbBeXITuA42YifykX3wVAHS7wl0DZ0BcAiDtD5KclbMQpvrPDvDJs9qckRpE_Yvlig7cjSKqxQw17F9DB40ksSWTWgwKGkzor3NzuyC0cXQ4-6J1XhgsR3BD2lFWKjCn1Y338BZqfzjsuP0ZNaqzdxeosQwLDIaOKS-4H-OtT0gg9V_vAkZ3_DCVTI2ghsWCsbASIglFFWa4Sv4qGL1t0a37fHFQQvg2JmtYjyjHbYi7T5H1MOvylh_PUWA4QS7feyWB1ct4csjKmGToBj_Buk8nS_-RMQrSwNRnAnHMXqoGJNbQlouyQfz3xdy4K0qzmq-EtpSl8HBciDf9MSJrOiUAOq4ETdC4AgOw-8fgA2y_hQHdFVjpBpxxUfAUam2lFSbjvZrI90UYRSajiooowNR247_4pYV-_E9l-k7pc-jAkmKJ_hM5DOKqFlM5DCYrflTB8fBXYY0ORSGN4ftdmg9nWOkY4npHSuihWOsp-cny5B2htderR95dzE2r6z0YBoFGywpcmX260UioJyIrmcSjdWSn0OjOvOPuNiwEnGDE2KG52TkyN0SemF2VbkELs4jm3AqsH6LRnCmTCAHQHlDpRU97yXlP6iPDx6WqpgwWbJXR8v6-_b0G0eJfe6Twv2IhF0Tv4ul-aJPYb6X2WXy5w6n42pYCeoT_TxxVoL0RkTZA9X6t-U5xkVxGlPdFeGZhVrBg6N62eIJf9hIRjiaU1FQ_Td7flok4FGJWRvnoMNTR7vMypvDzXl_LZtWTlNJKyDk2GZb2695ux8ic8t0hAZothFcZtfIMn6lhqTcGvDjmIdOzlj8EEX18oD8r20ysAmuK-1E99F7dhUH2t7k0jMOOOhoEMk1XED1Hk-fE54MH8hQ3EoVPPjM6j609y01Y7oZBIyXFxXhdgY4kbVo9OZE6Nr7Gh1zSjcZkoyqY2_48tm5FsWT1H-0Z7BnbpVkvgfwWL_t1tMyj0cNVF&cid=CAQSSwBygQiDur6N33NOvjL3ibWl3gozBFUtUZF81mdA8bkVPFvC8AIT4DYGOsHnG55clYXXC7q8HZlNNxHGvBYukVVEnVSuPU0AxSLsNhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=16503900528818540000&adk=2857193498&idt=303&cac=0&dtd=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.155.68.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-155-68-13.sin52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 46b7bbdbbd9f6de3ba0e7478f8817b1cbe92b513b6ae02f149af0d84e7256707

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:03:32 GMT
via: 1.1 4376bdbc2156cdc5e55ce044165e0424.cloudfront.net (CloudFront)
last-modified: Fri, 23 Jun 2023 07:00:38 GMT
server: AmazonS3
x-amz-cf-pop: SIN52-P1
age: 930
etag: "5c3b72c0dd30a599329697f6e19ee06c"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: binary/octet-stream
accept-ranges: bytes
content-length: 135045
x-amz-cf-id: nyYHHWMR8MZSA7yD2n0AVY7_lZQnB8zLGzMx5tvM86xU03xA3UJnAA==

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8B5B 41 KB
15 KB 271ms
270ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116383
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
H2 200 15742158473794713437
s0.2mdn.net/simgad/ Frame 8B5B 67 KB
68 KB 468ms
305ms Image
image/jpeg 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/15742158473794713437

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8081c5bb85f501f6871026b65429abf69272f0839f431c769c045899b2dad093

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68780
x-xss-protection: 0
last-modified: Wed, 26 Apr 2023 00:56:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 07:19:01 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F50C 22 KB
8 KB 237ms
236ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118308
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 5A39 42 B
64 B 254ms
253ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstAPH08mzsj7UgtOUDhPbyeBD-cCILzcWadWXRkwtBToFdBZD7sU8nst7An2OW4rsfLgGriPSC5ZRgIhP4b3mi-JRECZJpQ0P7rzkVaQJPckoJB3R_QGnk_6IgKRCwYtUGUMYGZnVfIChtspoGHKxnL0g5PYp6IlUvnljBHwPNoSCaY51mhYNxcvkKHesnyXM3QX1WTPM4VleIE3G2LRFejtjs_QBUYRbpjsA63lrdJlJOPqL1TBzjQLQsxPXK8OqRoM8We3aBYsWSKuUj83d_Zx20v5HNfmc1aE5DFB0-YRUQGu946i5owfZHchvS-tlwAAbAzT-83euYa02TyugNg5JBLorffZM9Vj-Cwm0S6NnNqBmSAl0iOnx74Vc01K_X0A3Y2-izYuqnq8D0EjsHyFyVp2NIiYnvJ729PIWd8WE9fLM2iTdOaj3lo9VxBV4Bc379BRaRK5xgTnHn9CBY1gY_RZSpMF8NJOp2OVr2bl5lXkx9Xh1FAz1eL9oWyTTCdPGyMxV5PVv-jCZn2x9UI_cT7xJouzIkKuaIvhaO73V9XIOMNdvKn5YybrseNxxdtUhxvAFqVv4NgSxCF3Iny12UIFUy9sViBxS-utq8rRjusizSvWqimOsSSVQwmJFx-ylLe0gXk7osqpFP6181u7WZJGiWEDbqBo2nGsqmyC8rvDhwPDyQIJ-QGdUW4P1wCod4ivTGFps7pyF61SpcbvCWNAjlLN_OkzMCnHAO4eaxtCN1PNyIVg0UDvhsROjRcnM2CZnDhWNaJUJphhgqvvAvqwfPnyUd_OcJb3Nx4215wEgLn1grcIVZYpHHp75ly7pwAIcQIPFQ9-k7BY5YKKyzMs5MleEW9YNY0OTPcZ9NLl0LqJQf4p_7KZmgwfnUKialzL3GGiLFor46E3tQFMG1NOfdh7PnWMbXymYHrKagTZuVrpZuenTfnUOcxKWHp4em7SjMtc9jdyv9UyvwXr_F8A9qhLozyHX__l6wNq0b6ohFXkrZUtxfbKmH8k9h1P_3u0BINVzkFDM0zR-tw16FGDW8cxANLohwiJeJVwfqjaqF1aQXGx0aCddNabThCtg&sai=AMfl-YT7ns4bBLrBaV-2lfxWHGrnwRsuhHtR-Y9be2g2FXy6fxaLakgtwvPmcix-2bEwk8i74wX3d7n6QpRpTMOCnqKg5hZ9b0PJmamaNqkNkH8aKmBNHXBaNsDm_A0&sig=Cg0ArKJSzPNkNB-TR3ipEAE&cid=CAQSLgBygQiD88hiYUErWfNrfBT7zMIz1a_-bzEwo2YOuaJ_G91eL1oMvI1TvSN_WMoYAQ&id=ampim&o=315,1100&d=970,100&ss=1600,1200&bs=1600,1200&mcvt=1004&mtos=0,0,1004,1004,1004&tos=0,0,1004,0,0&tfs=1357&tls=2361&g=100&h=100&tt=2361&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0D2E 22 KB
8 KB 240ms
236ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118308
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 9868 1 KB
928 B 2390ms
266ms Script
text/javascript 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_447910109977&jsTagObjCallback=__tagObject_callback_447910109977&num=6&ctx=27546878&cmp=29632589&plc=362584010&sid=8448220&advid=&adsrv=&unit=300x250&isdvvid=&uid=447910109977&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.20&dvpx_strhd=0.20&brid=3&brver=114&bridua=3&dup=null&srcurlD=0&ssl=1&refD=1&htmlmsging=1&tstype=128&m1=13&noc=4&fcifrms=9&brh=3&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=165&eparams=DC4FC%3Dl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D92%3E%3A%3DE%40%3F%5D4%40%5D%3FKTauU2%3F4r92%3A%3Fl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D92%3E%3A%3DE%40%3F%5D4%40%5D%3FKTar9EEADTbpTauTau5a54ehcb6_a45hg43f4h_d%60_dccfa22b%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&dvp_exetime=9.00&callbackName=__verify_callback_447910109977
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 09d7eefe0485254c0354ed038ee49b7cfbb337ee3b81d67bb9e0b535bab0066d

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:03 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 06/22/2023 07:19:03

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5C46 22 KB
8 KB 235ms
235ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118308
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame F50C 37 KB
14 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201586
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7BA4 22 KB
8 KB 235ms
235ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118308
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012305252018000/ Frame F9EB 222 KB
60 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4135cd61dfa379bb61b0718f3a20dc8b25d0b8f4e3f2e52ef4d0e5be736136c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 15:30:50 GMT
age: 143291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61795
x-xss-protection: 0
server: sffe
etag: "7347aa4c83612bf7"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 15:30:50 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame F9EB 15 KB
5 KB 522ms
521ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e2ac756b7d18a0715d66cff4a48f4ba89882b3bcec6cd4fda5455387eaff84d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 22 Jun 2023 12:08:21 GMT
age: 69040
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5238
x-xss-protection: 0
server: sffe
etag: "6efdfbd3c81d03c9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 21 Jun 2024 12:08:21 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame F9EB 94 KB
28 KB 539ms
539ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a9344144d755ac52f3d8405003feb8eab3b79aebc78e330537ea10861d6f32e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 22 Jun 2023 12:08:21 GMT
age: 69040
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28864
x-xss-protection: 0
server: sffe
etag: "51fe97ef57b83921"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 21 Jun 2024 12:08:21 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame F9EB 5 KB
2 KB 603ms
602ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a28b55f41413d16c71a76b7af3ff9f707323bb3906096b85f7a581415aaeff55

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 19:31:49 GMT
age: 128832
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1896
x-xss-protection: 0
server: sffe
etag: "fbb7a7837efaff21"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 19:31:49 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012305252018000/v0/ Frame F9EB 40 KB
13 KB 608ms
606ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012305252018000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45352935afb3119009abbfa8ed5bf7b67fc4edf64e8b718a134975410823ace9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 22 Jun 2023 04:11:01 GMT
age: 97680
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12956
x-xss-protection: 0
server: sffe
etag: "bd37dd4c3b7b688b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 21 Jun 2024 04:11:01 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame F9EB 6 KB
706 B 238ms
237ms Stylesheet
text/css 2404:6800:4003:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::5f , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 23 Jun 2023 07:19:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 07:06:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Jun 2023 07:19:01 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame F9EB 3 KB
3 KB 235ms
234ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:04:45 GMT
x-content-type-options: nosniff
server: cafe
age: 29656
etag: 15880770647744369592
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2982
x-xss-protection: 0
expires: Fri, 23 Jun 2023 23:04:45 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame F9EB 344 B
368 B 241ms
240ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 15:29:07 GMT
x-content-type-options: nosniff
server: cafe
age: 56994
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Fri, 23 Jun 2023 15:29:07 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F9EB 0
0 246ms
246ms Image
text/html 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CddTYZEeVZLarJO2fmsMP2c6HgAvy2ZSdccCzj-yhEOOx_rfAMRABIJHDoJwBYKvssYXgGKABxZDQ_gPIAQngAgCoAwHIAwqqBPwBT9CAS2oHiyPVXskVId9Ub8tgjdq6d8xkdZk-rZKy_weL9TccPIXe-1HKVxrqW55UtbuRQopeLD0YGpE2Jo1ugBphf0jQe99SNgSkfRQqOepRgP9Rbh7x6C7T7J12alCTi6TTDzuotPZ1KNZm533CFPFRbqVWTfOZ0A9FrF-_xNgIr1iZ83LtwVeDxLbxKP_VUqbOcZJX5KdK0WYJsJfZNGlcxkmpE4XaGODxSDljeXd3GLzY4xo2UYzywAFYZw-Dft4zH7mn8uONSihQwDMogfPqzRd41JKYEG_rdASJ1qqDlrgj5bE5LzihTmkIK5TN7k8BKDcOJ-k0tI5bwAT70bqqGuAEAZIFBAgEGAGSBQQIBRgEoAYugAej768BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQjr5N0ggUCIBhEAEYHTICigI6AoBASL39wTqACgPICwG4E-QD2BMLiBQC0BUBmBYBgBcBshcfCh0IABIUcHViLTIxMDEwMDM3MzQxMTI3NzIYsviOAQ&sigh=amqjLZMVMhA&uach_m=[UACH]&cid=CAQSSwBygQiD7DyiePvA-nD3NsvBGr3k8AmL0HfcJgAdUVtobhWAqT4MP3dczmwSV-PdNrBWDnu6Js-n8hqI7TyzjEdlHH_IqzWukzCNSRgB&template_id=484
Requested by: Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/9605930198670746728/ Frame F9EB 38 KB
38 KB 238ms
238ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9605930198670746728/14763004658117789537?w=200&h=200

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f0f9ea36798636a93780b0309cec0da6713686da5ab56eddb96feae74320227

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 05:28:01 GMT
x-content-type-options: nosniff
age: 6660
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39168
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 06:52:30 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 22 Jun 2024 05:28:01 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/6023499871391181881/ Frame F9EB 15 KB
15 KB 271ms
271ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6023499871391181881/14763004658117789537

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42c001b7f0d3448c72729c5ec378a39b8f26b791925348d4bf018972cb4a6a7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:15:46 GMT
x-content-type-options: nosniff
age: 195
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15842
x-xss-protection: 0
last-modified: Tue, 28 Jun 2022 16:51:52 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 22 Jun 2024 07:15:46 GMT

GET
DATA 200
OK truncated
/ Frame F9EB 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame F9EB 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73510e05b1697b847605a463cc9a0dd51a59b3d149dbfc1085153ac8ef801ea1

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame 0D2E 37 KB
14 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201586
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

GET
H3 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame 5C46 37 KB
14 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201586
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame F9EB 15 KB
16 KB 239ms
238ms Font
font/woff2 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c05::5e , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://castles4kidshamilton.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 04:30:27 GMT
x-content-type-options: nosniff
age: 528515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 04:30:27 GMT

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame F9EB 15 KB
15 KB 251ms
251ms Font
font/woff2 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c05::5e , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://castles4kidshamilton.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 06:40:55 GMT
x-content-type-options: nosniff
age: 2287
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Jun 2024 06:40:55 GMT

GET
H3 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame 7BA4 37 KB
14 KB 235ms
234ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201587
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F50C 0
20 B 238ms
238ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BS9t6ZEeVZPLbJIqgoQOJzZi4DQAAAAA4AeAEAg&bg=!kZKlksbNAAYQ3eRoMN07ADkAdvg8WuIuFuBKL2z_o3UBXjYPRWVxnDAH3AoL0DlgS6FRSwVYztUGyqgSbSjs_06gzMx4MudoycQCAAAAa1IAAAACaAEHmQL5kMYS7xpmAFdcvj-BtqaBhY2fZ7FgjFdt0eCSCIoBLuoeGVVJA2mPyjsl5PWgCBHDrAXaaskJxsgw6O6K8-QLAOHV_pT_RMjNI8BhdYMAvqjn_e4NKOMB8s40JksHKtgAiEbMB8CztSQFZ9ageuZArCLNBCDjIPz_u_lBlXDiDmDc3u5x0dIuCbv_-4UqtTaVhssyxtb0c3MayoVG3b3HmLyOxrAK07Xd6WL_JFg_Gi_06hXdIaX1ZFAfSt6xcDgpEr-YzVrcM5qc5BjyxX8tekSR1yCMRgGj1bbPWVnHOeLPqKx1b7ARUALJw6DbpdWIDP6I4RbyrJpqqRCrsh9ijQ7G6sYv6jsOOgKk7OheTQMdU7MdFEsuL6EDaT8-VlZuepXZ5ANxwHgdmWCLqjzv3LvdY6bjK6ak0pdbvIadl-XTMeD9o4jJ7H-JkmI3H7eNMoz1im15TwGzViG0ez592UcbuA9OSAdnD2cx0tntqsLlB9d_jTNuMxQWcXPiVBWx6cUf416W7sF7cv47ctSjd3pKoMn5BhtJzK9JwqMJ0iBnskANmj_VD25tLKKLnacvSciCYZpVIH06P3X1CgLV6RMiCWLSzzjJX2ZKaiNxeJUVwH68ZZnanz8xoqMjCrvsKlkvnZN3xl3VvYtfzNGcxa21AB3j8Jhri7G2UQr1KSzpvY0d_gy4Ui2d0OLYC9gdtLFaDJ0bdGvEPxReRd8M0m8dUA7xkHKh_8oY3VBIeklYViseEazARrvchrQq6oOhp1HoqEXbYD0AlO8YJ4mHhL-7fQQ5qbx5tDDXG1DKigNkhAW89gcAwrmy-NhJALZn8zn58Anu7NorMkEqqj4U5N8xD2wSPv07pSRTEXrNXNO9HfFqS7D_Cju-hnQSRtfIowI0FBLf4wuwBGo4uoJgN7imrONVQeSW6iJfE0-U5GfO_nZafe4qapSXYq7H0irdxAhkI56vyXDI76J2zX-KkYsXrB-uVhN609jMTwbNrSTDT7N3DsAMQdc

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3DCC 6 KB
3 KB 236ms
235ms Document
text/html 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://castles4kidshamilton.co.nz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:18:59 GMT
expires: Sat, 22 Jun 2024 07:18:59 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AE6C 42 B
64 B 712ms
239ms Fetch
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssX7jf77zJ53bBAZDytePLwAife2K1kzovY_SE6kS7d_a2a9AyE7qtegK49CAqVSOb6N8EQ_-5_wbMM1gUOKL7ossaBZcEHvYeRUze7oTVZh5yuaY0n7pdawL4fTSU1LmxIzi7JlOSxIA&sai=AMfl-YSwcdpSumO_EVc9JT9hWjMbi6PFunLL_5SIYIuufz1SxlBMrFYpbsQ7NZj-sOLndbOINJY-ItJr7JjLdSZejs68sXekRONjlhXV-1LKrcdXZs8u_KkXUHKvj4T3ZVQ2gTXMn0xBnxsrDlQ8vw&sig=Cg0ArKJSzGK5uNa-M_P8EAE&cid=CAQSTABygQiDxwvHbdhQ2eCftmXCdpQ-8zgHnXETrd4qwA5LNWsyDoMsqLvM7BeehNaNyxRmqlZ18gFz6s-HFpOVmhCxDFHdCQjKKS3QAmAYAQ&id=lidar2&mcvt=1013&p=80,1280,180,1580&mtos=1013,1013,1013,1013,1013&tos=1013,0,0,0,0&v=20230621&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3385399817&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687504739724&rpt=1473&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8B5B 0
0 249ms
248ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLd21OCh7ysr77SWp6VitaLNC3UAlaVulabz8fi0ILYAyHGJeFGpAigvON1GeUAMJBYEGIrbcbto_G5iZVS2WKKk3MIu3OjBoGXt_IV_suryA8oc7Xyu2DIjJYndnuVAucqNUbRhyFCIKoV5C0L0XxSZdpPNHTsQQRSTmnDUmEygwh60JBDhkuStwKSGWDkfWO3OAE6IvfGcv7gL-eOC7y5bHjjbdpLk7Pyv3uf9gwvBtJmhHWiLkgr5LGQHBagu7nMzeikXMRfKkAofFlywLWM3Jz_D3FQlm2Iq7Que4laQzfy-w3KRJCXz63am2L5Gv_TLd9TS73eOoColDrz4rz0WDg-Ru8DB0bB_N3y-0TrVAcGh469nopLXmI6LSy7gOPWmIi8ZDz00nBbOpkjLaGj-KWIYJS3_LQtNVuXFRnXNTmYWmA5cRMBmuRVkTeC9gl04nQTW3dpyCwuzsRJyaH2Jwedzn17IlwfZ7bE_VpOF95wEHh7I9SBDRCV4DtFL4CFtMgR2oizn6q623HTk_ewpMRWaYafKDBwiLzrwJ_LjFtPYZkE_TDKFflxC4cU1SJFdst7u3klgGLD-fr652KcgNW9j2JClfIewP_xFTJNe1Zi3LOrKw3QNm7kllj4lfy4AigTPCOzKJhx1JbLR2ExqVDAkYWQEg5jrB0utFK_awS7vlSFrNILy1tZNtWWW_uX96DpscUuE-E81sUDZxdwZsUtqOe44qZzjvUy2YKZyYqDnAbP04SN_eBWIivHyB54P20mGI6fyTlmex1wgL-BMV4cGE1ln_hE7mmcxJHWzcTKy3RSEpNAnm_nFMxPOYm3wYKqYU893i9vABxo1b3lcbAfhB52x6Jv0klHCkLccMiTDQ58Kxx3lRnZgNmxViw8HGJZgl7WkfnK1eeGlqTTVdtRtg-8MhVzPc5tpbcDeDOzuQ_4e3yzbPq3wjUUemkWJEl6mFNo0JQDZQyrZk8aWXd77NeCgcs0k3lVvGLKxhrJbSujMUq1ZmFSf3oMmwUf2MZwLE5N8PGCIvlyipfnjBdfdFDAB6eE1UgwyHq8oaMLhiKwYxFUxJ0o_yP2Y6tWQO4-pQIDTzyw_BfT8MhMabd9F8Ma_mO_KNEdjGokHBZHAzcMWELygXSOriG0RcHeMqRbpBBUHrNyYLN8r8ZfBexYsh3gBiXA0EBPIrsMAdJkXQmlRSqZU3FGHTx2sTO2RUlbGYDkfyidjy5xeHTHFNlktA_oISyQ_r8l3yauVXoU-K1shxG4tZnhYxdJnfNPX_CaM3MmE-01ApLZSa1K7h3ds_1P85a6Flo_ENs&sai=AMfl-YQwRomHWtd6_7Nb-1u9aHbY7qJGiYBPWFvLt4FIvsvHEjQ1CGWVAlVGWzmgZNFCz3x9-Ykjbmn_flZBtY-40kViTuszSASVN0Ke-wKC-7bkTvzwbboSR0Hth0rdyxsM-p28jMVrIWinI7jyuJcEcVc82RhutnWpPqcnE473z1315f8kRm7P-W8-C05YxS8Ug6He-THSGILieslKOK21uR4gPP53aO_uy6nSasFkCFYDcOxNXWZ8mCkvSU_cxWteOVsKNqg0M-yXPq6e3l8smauZyyV_jtEq&sig=Cg0ArKJSzAO9hIzAsWsaEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=942&vt=11&dtpt=940&dett=2&cstd=0&cisv=r20230620.69462&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Jun 2023 07:19:02 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0D2E 0
20 B 239ms
239ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BEYxPZEeVZJL2KcLiogPPir6ICAAAAAA4AeAEAg&bg=!cHOlcyfNAAYQ3eRoMN07ADkAdvg8WnDz03SkksPUzaASAoYEeNmEF9gk2o7qtmJMSx-lcjkC9PB6BJiKuxIoqYyuSOoFaUaqwnwCAAAAhlIAAAADaAEHCgAsA3VLg38uvbdeyL2qViUhJ5tkECyjA4krJIK3t3TIv_5zPEq6akBbUkOAifaZAu3X28fMpgsVCPVCt3wAO4TANvbAzOA6TuNOZ5wrEvL5JtiW27nnEgKBVeE31Mjy5EpClBdtWMKkfCt7OyQIBxfEj3mEaSB2dpHovtnJOGTuk3Ui87WCyx8DJEu5Fxw6emnktN-pLrLF-ga9xYCI37dFBlNHDU3qIaN8FHSrJQjEgAkmbiauoB2WeWQ2T9ioSbgegWJpbAzN_Wg27LyvboSmMQ15Tvx5qHxUo0U2Yx22I5hBp3UU0BRy-SoBFR43b3OTDkKr6WwDJvY-hUlruA4moxRG54hV3g1qEOR1dAQQQ7_Pz9MZZOwOqFXi8LozMyLWSPuFSKP-iuPUCnyipQdSqtgn2XAbgZzCOqjxaVN6FbBydPkvXNnpu-GPFqDjlbj0VSzaF91Fd4ANPUSlv0vKuGhhTEyAB8kZZj9KlwcuLk97MexX8_HhzQiXUJQ2Dr77K6jZ2LHUuk1tf9kT9Ly2-_vlob5JL2CuBeQKfeSSuzjDdzQW4z7Gw2oxcceE1PEeW3ss7riYmDv5d2HNbGvSQiphVpQDdxP3bKloEc0s4E2aqkMk7P_u0Y0tWrgKk2Y4Id3XKp5rAzDWzVjOZQ9-1oj7GO-ZtAvZzFFrMGLxif421lCITZ3GKANSWep2cUzEZbBcFe--_pwd4HToV2E9OaybSQEVoLnQvlfMlRbk_ou1akWiKVoQTrLCsAL5CZEnnTDP6RR0ZrKPzAkyESzmQjFMY4l_5vEYeyX6kiuY88UL2002F6T01_rrm4NWy34xGc6cjD0Xd-APx5-BFiCE1fSHckh5FnOuf0Zwc-5zLwulDRTlrBuDbspIiR0-40N7jGQq8Fjxv8jQsIfZqS7oZs9_VPHKTLnlWfv4FXYR9fz5vVba1P3TjoNTY_KOzK3MLLMDihNBLEOcdla0c0XKSlNP_SJOHq6pdqx11sPV3gMn668Shc1OLPOKGmonkZVdFCU0eRhUCkM0cWRyRlBDCg7rADwG5sdkSROrIg

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 55-15e40ad0
api.attentionxyz.com/api/tag/config/ Frame 0
0 647ms
339ms Preflight 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/tag/config/55-15e40ad0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: amt-event
Access-Control-Request-Method: GET
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: amt-event
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 23 Jun 2023 07:19:02 GMT
vary: Origin, Access-Control-Request-Headers
via: 1.1 google

GET
H2 200 55-15e40ad0 Show response
api.attentionxyz.com/api/tag/config/ Frame E293 115 B
170 B 306ms
306ms Fetch
application/json 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/tag/config/55-15e40ad0
Requested by: Host: attentionxyz.com
URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=5417733&attrCampaign=26800795&attrSite=1589324&attrPlacement=323863712&attrCreative=162000675&attrAd=516312665&attr1=%edclid!&attr2=j
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash: c4e1a087d18639c1fbcfe9f8af011e58d16d5d6e94938d5444c630761230b58e

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Amt-Event: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJhbXQtcHJvZCJ9.8dotrQPk6rXdTZUfYiTmmCx3BKBZ0ngS9huOY_9Rk9s
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:03 GMT
via: 1.1 google
age: 0
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
cache-control: max-age=14400, s-maxage=43200
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 115

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7EBC 640 B
265 B 243ms
241ms Document
text/html 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNn1rgIQhbjaAhi0_J7uATAB&v=APEucNVNKbBitajxb19gs-kdF3qZiyq8H_w0mq88qd57zqKW4FubRUKUvi9CSKJcCYtgW8_5l6sVtzW0358w-rQfuaXQhKHiyQ

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:19:02 GMT
expires: Fri, 23 Jun 2023 07:19:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3DCC 78 KB
27 KB 241ms
241ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:02 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DCC 42 B
63 B 238ms
236ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DfgE4FbIoOfLhMk4eUx0qZzQKjb221aJzvAbGMRcVhjNlqSD6hogRK-hH3pgAWfurCU5CaI4ndV6CICz76y7w002ihMmde3u0Jj3rQlaBZfPhT5-s

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DCC 0
20 B 238ms
237ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2224832178554945321&x=1&ct=119

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 3DCC 3 KB
1 KB 236ms
234ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 22:51:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30423
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 22:51:59 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 3DCC 19 KB
8 KB 237ms
235ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29657
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:04:45 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3DCC 179 KB
56 KB 705ms
704ms Script
text/javascript 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57242
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687383875062185"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:02 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6FBC 42 B
64 B 287ms
286ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuo1o9O2il7N2UpifAs6eftVCIiyVnPsLw675dqRkTaLi-g7_-R5oDgtLiH7aSktOnv_TXU_FOevi5viQ_U193UTeSyfstMAmzg-WAkv5P2TeyGk6Pst546Te86EFPA05sAdIMMdeGyUKuVBcxt5T9r4A_Pgn02FMwNTNQh&sai=AMfl-YRnNvXV1PQVFDReMOzSoOzmCR7F1zONU-R33Hy893CvJPXdt3HN5ulUmmanZ44ZiLRlw-hqxgInxeaCaSttZcMfdJ6O7F3CFGzMMCPTufZe79Z36gHwV34ygLpKgPZIErM6_pPN9Jv2WtSsCA&sig=Cg0ArKJSzATl5p-BAlrMEAE&cid=CAQSTABygQiDq9N2Fb3hdbaosq8lR0mpmltwei4XbHjN84AA5oOwoG_FeAEIrc5dWM0btRUzL2YJtRjntrRKZcuZQcQklYi5ke-zZ7hfWfwYAQ&id=ampim&o=436,3&d=728,480&ss=1600,1200&bs=1600,1200&mcvt=1040&mtos=0,0,0,1040,1040&tos=0,0,0,1040,0&tfs=490&tls=1530&g=100&h=100&tt=1530&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 38 KB
6 KB 903ms
902ms Document
text/html 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f25a54ac741c3e4e39941ec9ee924c341b82b0388423fb44bda8b5ce9c9da1fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:19:02 GMT
expires: Sat, 22 Jun 2024 07:19:02 GMT
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AE6C 0
0 257ms
256ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBS-H8QFDP1459HZIt0wvpErwVJ0CSOkfUr3dSMV2HPlCJPqvpwK8KJT1L3CC8QNdLGH16V1qZJQiVWXeikrAOdEFoakbKmRJk5Axm7TEd8g-SFfuyyOOxoJ9USjbIq0QK76-t_7xcDIzrYe_2j-hv2Qls8FfEUktlqcegCZhBj-qaKFGoWZjzai60MaQartZ5cEmtGoWWbBubaytDOKkcuUzi04StRfmFTgCVLxa2y8X1c_72Ed2On6qQegtLhGgSYddWiX9T7dUpTG8PDXnBmPklAuNJXDpw07nHHnoxKQvuhR3u8UEFrrZhF7qqng9J3Cvu2sq6H0V5ELcc4rD0IHu4NyiIvJ_QeXc9JBKVq1vj4ab-CEg_9jhCfI9lsTT5ldyCEKWlL39zHa3SJvsfO9JZNIB-JYggDNJm-TDuy_pCdhHvESuzepnj8-GC2-mNJrYgAb40JSQJvGuhXJ-fPUzOA-vniCPbxb7LcedFeERiL2wcMvPvmXn85RsG5s7pl3MgCHg5Q798CPGChAt7vM4ME1TPQic-qZnLuSnNLTJ_qcojPBcYGLGlv4K0ZOWHSKwVNWtbflsNmLsW4zUceyiVzgP0zsjZd02PBGfyiErPnXqCkxuuJ16usJxGio_YHLHLhGNQxmHZ8uEL3RDvvqa6bAxq3-3vaNuJixMh66aAMxC3_h8RYTFHxndExaOOYeJ_rRqOeOf5iaj2D9BSgHZGfIerJIHlURbEhrDBNYxoOR-mhU-frFW59mic5f6WkbOYn8VTGQKHb4bVycgfJ93Wd4cvri0RI2Z6Ngzj0DQAKj7YYta6StDU-E_iQs4noNvZDDoKTQGVg4xLMR3cpSK1kvdDlg7R9RSSg5_jNBcdCM3rFFATTgVIAtEWxe4V8D3u3DFTWgbQHyzXVQ5CmwWixJy_SynXmj9WyW0_w11125zvZWLc-Kwp6zvUM7fiuOXLdkr4jv6Y-k-Dyhrjz3D1LB64iCuPrvpw5NkKXX-iqAGhckFeej4rx16OPXqfmm4EwQq_1mZh_K4zEAx4bBfH_WMNdNQxnXmnpRDziVqHUu-akneMN_AvqFNU4-sYwwlE5ApgPo_E3DgZ3O6E4nzq_ezdIhx3n_m9jNOlRLjbkSeaLp1iClyM2-52ipuyBBfP_cjNKqV-BENs1PH07Ds4nd1rObNDDrQtHPE380EZzoMRFb_xIp4n0wcgngKEHzCF3uUKuIKNKG08aOFIVGwTFnRok3IUXORH-ANO7Un--K4QaOLNEDHNWjwo3Vd1wLo8ySb3HuuVt1hyZMi6aGehfKXguIeEpoI-MA79GEd1imeV9YF1megqWOIO64Wvf_deif-w9I_plo1d9FoU8Eg1XiMz5I8&sai=AMfl-YQPz_BTxdi64ERV9_oUx38rUgwYlC-R7tQfu-c7qZs81nLzqovbIiobaK4X8vbTP8h_AYA7RuERjcYMAXDpy8kMVYQZuVa8nkN-2hiU1dUCYHGRInUIuWEOOkTR40PmLKtxpTjric9M1pN2nM486MNie_kCB4dtf9bUQD0HTIF47V1YnJsZieDWTm7d75ugL4WeWgc7J_NOZ3_0X9V-MF8ZL0YhfKLnkpdZns3PJkINj77Z52PNnp84nUiStHE57RLMtlgwt5LytwKt25sr-h0HH8yuFMhS0xAshsO1gm9Mgwye3BRornd3-8c&sig=Cg0ArKJSzPwTSN123L8yEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1212&cbvp=1&cstd=1201&cisv=r20230620.60522&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:02 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5C46 0
20 B 239ms
238ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=By3fTZEeVZPe2NM2EvwTG8ZSQBAAAAAA4AeAEAg&bg=!LS6lLnrNAAYQ3eRoMN07ADkAdvg8WrJZiXo2u4nFPaHHmxC9PVrsV-N3a2cEm5mrfGGISDhZngLiIYLXcchh45IIdrsf2rUEYbECAAABJ1IAAAACaAEHmQMLzz6_oNZMjDY2Mddef6jD1DIy9hbvjCvzHkT8cX20mHbOmQmMVA0ssukXAyhw8WCMNtM2GrPIx6AUFT8hnBK-yC0dUQYcmbOt_7zxd3SdB0rIFVdrAKTnPJGw3sPMVVprZEsFVKA515xhARYbFbMMqZDt2n9T2DCMjSw41BD29lUQQR1WI0QNJxO-jNio7qjg4AHCMSKHwsICL7ShDc9gVBx9-Hz_qkraprchF5krfTu9NilDqiypfbIqj0kSLLQjJA4rCsFKic14BKRCtE1ncan-URIne01DRLBEJJbdjl1bDojqES7HlpBvdIjIXBjs2Wak7WOqoPk3_SV4tpBIJotMg11EfI3Zt9k5RSz98Fl_LQG5vw1njyIxqKN56bZo9Hr14d7RwhABLmaYfxGjDg9DqxSe3Yc2588VEo9s9d4_O1xxgqXh9m50A_SytgRYbc7Rqt2AkEA2QqkXgDYYUd5pCc9R1at5edMDS9ylKdnxqi-ESuppjEVDTIznzNpnYyZlBSPBTI9LgJRbYUKrKJQKofSO7hPZkXWwsRo1T-4iSmzGlac3A4igGOPgd7IH2ep3W0INYBO50utbSXYCvlTOjKmpS1oYPB2MMAC2xZ7okGIdWYSVUrg0MvXKrKnF4UpDFE6L-F2A-8dEahOEAXkba3VCsdEjvQbzySSEQhRvHjNv4ZXjVnwCjdx9aSTNgZQ-j-91dKHLMAU537lF20z8zdqxQLKWvxQ0w_bJjBs1CrJUkYob3ahUAewV6ryrtdA8BA2d8u-ethpACAUYVvaT4wmeEgYgANGG0HBF8nDqzfoqPqzM2VasKR4VxBHUseJlCi1h7PVtVw_wuy5ARRhz8-v3tCaSQfpmazNZJJ2C5UiJJpWZpdCvHwp_Yqd9b2FpYAqrSTEzy4M3dUruk-cjX8IDUGRs4zzac4sRiinZI-EEfRSlVUjuJ6yWiq9XMZbIcUKBGHBkYib2fJFetS451DLgwNrcEf4_lU01u6eXZAlfE05RAE1qw84ELIPRoup4wKgr7hC-c1U

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 55-15e40ad0
api.attentionxyz.com/api/tag/config/ Frame 0
0 472ms
321ms Preflight 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/tag/config/55-15e40ad0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: amt-event
Access-Control-Request-Method: GET
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: amt-event
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 23 Jun 2023 07:19:02 GMT
vary: Origin, Access-Control-Request-Headers
via: 1.1 google

GET
H2 200 55-15e40ad0 Show response
api.attentionxyz.com/api/tag/config/ Frame 8B5B 115 B
221 B 323ms
323ms Fetch
application/json 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/tag/config/55-15e40ad0
Requested by: Host: attentionxyz.com
URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=6232695&attrCampaign=29777392&attrSite=1589324&attrPlacement=365461496&attrCreative=191219526&attrAd=556481724&attr1=%edclid!&attr2=j
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash: c4e1a087d18639c1fbcfe9f8af011e58d16d5d6e94938d5444c630761230b58e

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Amt-Event: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJhbXQtcHJvZCJ9.8dotrQPk6rXdTZUfYiTmmCx3BKBZ0ngS9huOY_9Rk9s
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:03 GMT
via: 1.1 google
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
cache-control: max-age=14400, s-maxage=43200
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 115

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7BA4 0
20 B 240ms
239ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BDJrmZUeVZKjqAseCoQPVw6KICQAAAAA4AeAEAg&bg=!_v2l_anNAAYQ3eRoMN07ADkAdvg8WrspdzcXTCEvcdH7dG_-l-m3brQ1o0AxNLCfqhEBLe7NNueb7FudYjEf6HdebkUfvX6G2vICAAAA8FIAAAACaAEHCgBomz7dIDVN3r7L4ZHFPsHCb5IhAbI6Bk8IOXmJ1jGTEgXQhn90OasxTZKkp8D2iNzVGvUbW22EqfgBkcgNTZDDpta9dljnZMT7SvIDVH5ELpPmtN_2K6l5HcXgp8AHqbB81OHjrpPU1WKZAwBMfSxqw8wnr7YaYKUnVBHnutSfMm_kauAbZnkCAns2edGsomE_rfaloodROxQJJx8sfWPBrS8s463uVoTMunN7GJdPWsGkb7X5C4kE8EkORPPpW4Qr7c4F8_nRwFlNaiqbLxUAaLI8dzW7xuYxDtaYHnEVnM2LZbLQ_CX5SF72Nl7YVEYKxady-5LwZ_xGqtfodDyPDmrDNJlSeoBk0ie0JdxWHa27p309AWmXM7nk9czSDXGL26VMFR5I_ogInsP5nEY6gko4yAv-R2cLuPqBtkRzKXStlNMSVpcmwZvDZO5qCsUNdwq5RAPpHcAZxjkaMH5NAb3Ss_IfXFnpI2gW66hbrxpnmv39DFmJqKy3S_AL5x1hty8YqQfxM-g7nstYGL6gDOuYqzfSSQpFdzbIJkhIgCopGn8Yv_5_Oe_YyyC1bRcGOjC2wi-zHNK5q-BOCmYwF6s_4dBD_uKg1JG8CdzPXwhi6oo9lkoZ4ZtpZQEdKR-Jbx86qimEGUWkk9djktXOJ1MzEieEBS4i4ZGzv0JEs4i5gQSqeuFp-E1hCT0cIOCfklWkwVqmf3jUOxNNEvREETtiSYolnP3nL-rGNlfR_p6j7V4lpO1JjchxKWU8zFDSjGO9xiFu7gDli4yYAcMJWE9VI7ojbgZKATMJq2ff4JE0G_ea75qLbOWZzds9J7ceXhaK68Ap_Yb0bqNTEvOiluuzTxF-MEcOc6-A1l3C2ZCXZT-GtUbaaCVsuzDgZn3P5Yv_DudL7qGsLf9Ulw9h0yJ4i_YmdON3seN0J3FDonK3-Mga3fX6x7ap3tJ81PTPi6SzkNmrbEa-565V5wdzDOSAsdFoIszzmBXSTgr5qArAuFkTEf0OL2YozWv2N_gWLqggBVR72O430folyDju6Pr0yoTqwQENV3xSSDNEPFiBTz7SQ5IQpYEOPdLTEfnG7wgGS-c0SV7914CKA6h-0fUkvZRJbXhAGjQ2qbnLfdpotvTvHcocdz_XepNcwEjmk8w36Z1aA9Z5Ci0

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/022305252018000/ Frame 9010 222 KB
60 KB 234ms
234ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bd1387deb212ba27c6a71bda54698de8377ef85b3fe2c4f3fa104e3e4381c3f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 19:32:11 GMT
age: 128811
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61811
x-xss-protection: 0
server: sffe
etag: "98b5f6358377a24d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 19:32:11 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 9010 15 KB
5 KB 333ms
332ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022305252018000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e2ac756b7d18a0715d66cff4a48f4ba89882b3bcec6cd4fda5455387eaff84d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 07:28:09 GMT
age: 172253
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5238
x-xss-protection: 0
server: sffe
etag: "6efdfbd3c81d03c9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 07:28:09 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 9010 94 KB
28 KB 308ms
308ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022305252018000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a9344144d755ac52f3d8405003feb8eab3b79aebc78e330537ea10861d6f32e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 13:29:35 GMT
age: 150567
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28864
x-xss-protection: 0
server: sffe
etag: "51fe97ef57b83921"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 13:29:35 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 9010 5 KB
2 KB 340ms
339ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022305252018000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a28b55f41413d16c71a76b7af3ff9f707323bb3906096b85f7a581415aaeff55

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 09:30:18 GMT
age: 164924
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1896
x-xss-protection: 0
server: sffe
etag: "fbb7a7837efaff21"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 09:30:18 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 9010 40 KB
13 KB 343ms
343ms Script
text/javascript 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022305252018000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45352935afb3119009abbfa8ed5bf7b67fc4edf64e8b718a134975410823ace9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Jun 2023 19:32:11 GMT
age: 128811
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12956
x-xss-protection: 0
server: sffe
etag: "bd37dd4c3b7b688b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 20 Jun 2024 19:32:11 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9010 14 KB
1 KB 238ms
237ms Stylesheet
text/css 2404:6800:4003:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::5f , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 23 Jun 2023 07:19:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 07:06:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Jun 2023 07:19:02 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 9010 3 KB
3 KB 235ms
235ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85a64faec356c3a72f249a98a037317adc730ec6d38e47653cd53be5485d80a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:04:45 GMT
x-content-type-options: nosniff
server: cafe
age: 29657
etag: 15880770647744369592
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2982
x-xss-protection: 0
expires: Fri, 23 Jun 2023 23:04:45 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 9010 344 B
368 B 238ms
238ms Image
image/png 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 15:29:07 GMT
x-content-type-options: nosniff
server: cafe
age: 56995
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Fri, 23 Jun 2023 15:29:07 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/1802597022402484828/ Frame 9010 54 KB
54 KB 266ms
265ms Image
image/jpeg 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1802597022402484828/14763004658117789537?w=1200&h=628

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36e9faf8dbcd25a2102a74c6e4847312d956c44456779498b63e79aff0888c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55174
x-xss-protection: 0
last-modified: Wed, 24 May 2023 19:49:45 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 22 Jun 2024 07:19:02 GMT

GET
DATA 200
OK truncated
/ Frame 9010 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9010 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9010 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 271b5b8b3f1025795e69ad390840eeaec689c94ac7bef98849238d76993573df

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7EBC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKq-I6DNNKPKaUbycPSdyaA&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKq-I6DNNKPKaUbycPSdyaA&google_cver=1

43 B
171 B

246ms
246ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKq-I6DNNKPKaUbycPSdyaA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNn1rgIQhbjaAhi0_J7uATAB&v=APEucNVNKbBitajxb19gs-kdF3qZiyq8H_w0mq88qd57zqKW4FubRUKUvi9CSKJcCYtgW8_5l6sVtzW0358w-rQfuaXQhKHiyQ
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:03 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKq-I6DNNKPKaUbycPSdyaA&google_cver=1
date: Fri, 23 Jun 2023 07:19:03 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7EBC
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MjJlZjkwMDctMWVjMy0yMjZiLWZhZjAtNmZjODMyZGE2MTcz

170 B
188 B

249ms
249ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MjJlZjkwMDctMWVjMy0yMjZiLWZhZjAtNmZjODMyZGE2MTcz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNn1rgIQhbjaAhi0_J7uATAB&v=APEucNVNKbBitajxb19gs-kdF3qZiyq8H_w0mq88qd57zqKW4FubRUKUvi9CSKJcCYtgW8_5l6sVtzW0358w-rQfuaXQhKHiyQ

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 23 Jun 2023 07:19:03 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MjJlZjkwMDctMWVjMy0yMjZiLWZhZjAtNmZjODMyZGE2MTcz
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 7EBC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEAqVbujdgfMwLs55vnO5F-U&google_cver=1

23 B
279 B

1053ms
346ms

Image
image/gif

23.199.77.124
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAqVbujdgfMwLs55vnO5F-U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNn1rgIQhbjaAhi0_J7uATAB&v=APEucNVNKbBitajxb19gs-kdF3qZiyq8H_w0mq88qd57zqKW4FubRUKUvi9CSKJcCYtgW8_5l6sVtzW0358w-rQfuaXQhKHiyQ
Protocol: H2
Server: 23.199.77.124 Tseung Kwan O, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-199-77-124.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires: Fri, 23 Jun 2023 07:19:03 GMT
pragma: no-cache
date: Fri, 23 Jun 2023 07:19:03 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEAqVbujdgfMwLs55vnO5F-U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7EBC
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YjFmMDZhNTktNTFkZi00MjA4LThlM2ItNGY3Mzk3MWQ3MmY0

170 B
188 B

247ms
246ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YjFmMDZhNTktNTFkZi00MjA4LThlM2ItNGY3Mzk3MWQ3MmY0

Requested by

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:03 GMT
server: akka-http/10.2.10
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YjFmMDZhNTktNTFkZi00MjA4LThlM2ItNGY3Mzk3MWQ3MmY0
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Fri, 23 Jun 2023 07:19:03 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DCC 0
20 B 236ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9400224742128&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DCC 0
20 B 236ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9400224742128&version=m202301230201&ct=119&x=1&cor=2224832178554945300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3DCC 86 KB
36 KB 267ms
267ms Script
text/javascript 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DmDqxbPI2r4r3HNhZ3BnVbFutd3p45HVIGjUIns61uTGVJOko9Tzr5HvUSDsPtTKFk6d4ywPQDZtFsOtW4MHALRP8fxIOsv7SSSbyiqdxHZ0p6Q5mWF3RgTV7gV0fBe_nOUcZaZRSwaYTifE8CppAGyNewufEvRiEPhWICblToZ4VrrR4&cry=1&dbm_d=AKAmf-ATkSAc07fQYgkzhMf5nJbAGyGFSbNcgsPkWMzu5d9Kn6DKEAu6hnnNWFtx4J1VeoUtbOwz1JhjCcNbHBm7_b1S3aygNK8mo6qGxNSDECSwlq3KEG7nlwq6CL5rV6Hq1VJQtQp98o0rmjvotY7bS9DhdC-XFviwsH2NAIUKx0JIB5L_Z3JF0NoGxpGIoyr2cts30suliXyUnb0Dr77RHlqrATfr-nBunvq-C1Satt3Vy3MWYU-5AK9ZgZ-aDgUI10_0OTbq2_CJfLrjIld-kZtdvmKwM5RTxtC7nwVmbq3ywr2jJ1_n_uvQOB5qAIFTJlf8aPoyGYBDbINh5sHpS0PzIBz3dBCJrAmEZfjxrP-WNoc7QDV9qJHXKJ9fgD37yNxcM_rAwq5ud0nq-HdDBFdalGYDfVIi2R-ZWy7gfYq6mqO-moCq-1yCtw81Hf-2nGsBasCFycgNcLMw5m3kR6675Yf5-g-oPipIlpSQMB2irG9aNCFXd7JFyzW5P926CZMbrmz6Oclmd7-KC2PcgXeFjOHLafR9aBR0jplRKyJ8QjwnsWtXfnLbXtoan7cvSeqH15ZgFtGBA9k1gj_A-Ivoj9821RQ6M5R1GAc4iCZ4pCLjdotAM0mp-50tNFZYxNx5kRnvJ6jM6fQoSAMD9QzS9Qc_wB0UcmfAp18kx76Nk13ARwZiGkTFPn0EZQC6msbSk9GokA_Q6uSZ5nw21-CogoGxhn3cTNob5njjk3HIS6bxdeip9uW-Kfk8bGGiBMUHFUMTOQHm0CSFVq9TR-Rxt2TATWqwLcvf3tcAlZE_RPLnD19ZiD3jWddyi9to6pVfcRwmYnB4CDqkkInJT1vwS1w0venl7btcSZhG0-hhA-ZhpCF0qZ4XF1dzLudRPhyJB27WhxFHS6y9q5_9MnTvOL7-5Uk8N5ZAe9YqjfotOEHMQUDSMi66DBurCx_SXdQfiPeLs0ucIkNlGQ1SrTdfI6YIyp7sGrsuhngWOH66qrZDRZb6q9CWPM-FJWfyKcU6_fQ9xAwLFQ2JJy3X_llnz5Yz9YtHUA6NXbPPBbngbLJabKXsi1qZNonyWt-Zlu1L955WY6Kj3yTa-DgqL762iWwgTMsNzVK3quwpHN0qSSnUAdDOZV1t3EbrnSHMTS__Fo350D1mjBnd7CbTpL9VumSbseYjKB1GyMTCvaMhwPfwt2Jd6e2HFyKH67hvSvKrGXbI7Er25-37halnTVc4UhmVuJAU1_Y1w0S5BkEyzyB6SdBiW5zJBCMSUcjoghNb0CZvpNavJy0zPAs66RQOGeeTOo0rpGJmN0YJBk6bh9oB41o39yL9pzYwzK3jHDoTWsPEKE12kx6G5vA0n2awZpmNP8L5z7BzotnMQwhw7aCBkSCOqmpl6YlBbYDU0RrQo4sKyNfXz8V57kSTfvW3BmGuSRjIYiIl7GG0xvX7UJVVogw5sH5OMk0w7GdutXUOYiV0gm-Qc-ixqIPI_EDBueDIW7o8CMf7dSexFvl3RY_V8uKXUjuD3TssZ2kgENPWkoiP--kxswRt6RFqorchbkkmykzM6t_R3FOwqbCrf91XAYtFMJD1CVPk50JKkmOR9IsM_TNBm8-_0tRXkgNmwSpyR-pWTb-cX6td8VCEIiUhi8aeic5bGklL-gQsVJxx18UryeN9WxZADtiN3Erwl4xYrqidPxrjHnTmNZlUPvDUaZU0r-xd0Xs2EgAojxE5huVF_2xXhHo0qhF0kt3erjbXZxjAxNm-IKdh2FFahf4nXGp7kIJZpBzuYntoOuxioeoPKxtjfCo1ts5hWVBbq04yIUMuDImTwRmOWpUQYzpvSKGf-HcZtCAqYwen0JcpxsHL_sodFhpuAfpgYGsuPKGgjF1MO12HKVe8l1KeiBCVGFm5j_zkYk9k9kxntZH_kQ6_mIpQat2Xh53qGRcBMEi5U49J6_vH3I7wY4JD-5baOgujoSiLd2zyzJQjOREyIE8jERS94vV4CsSEQdmX_yMlTL3__Yd-kQ5e6YjSuuJpYTs3R4ayv6k4gQN7Mve6UHDAF7JxGlFgW9s3HxBvKyLgMImoqTC2ByKysPLNWu7bT4zsls-xUkENOOQyxlzqSBcU_xzdxzn8t1nSMa6CJHBRGljozmEvjxRJgfQ6h35Xy7YA_E_fT4Vsst14EayNRUbYKU_h68KstK8Wk0v7lizhvWfT43umQ-xUA8TlKBUNvzJnnemGMaQwMPBkuNAc0SwBqIZOY2sT0fAu4iZsAKaJzCWgUiqGCzcLaY7jSkrI5SK3DomUz5UUyutYV8yge6hB8K0JhBoA3zw4DmyysXv-szpRSBjhu-Q7Lum6PYzThqofcvW5c2kynBWsyM6_y3TxwfgdgANbx9Uw--GUpyW4OXekSUstDFbyBgHj_CyEmjHXGharxpi2bghRuMUR_7Ao9S6L1DSm0Y5U1bdwteDlwisEfYYVowGe1gBGXbJFG2S8v9lOhdyifloEWVG9iXrnxDxjyPbObwzOy0_N5LfBJNUje9zbSeHGEQeDgO6x7AC9fewLS45kwD1sQ22yaK7pSWPcaodp373aXtnyB46msKGqa2ZArjNH7AyO-tuEuSlQSEX1Vfwc1VtWur0czCOS9XOjDpy76tKTtgYCs4wRdqK9nZnrRwRwL9da_mUhMxFHmz4Lpm78B6i029qlnRIxrR2tniRRkPt8dB3Ye7_GQeHhJ9oJbst4JzFkx0SiAb5Kdm2OCKoctx7a9IPJLHKmBYHrDWlKJwB_Yw90okxRUJu93exeJhrAULnXsSzfQ_xTRmaRo9o5w0w8wntW1pO3VX8q2c8fTDOGxUtIc-32Z1UgIOtf5kevCC7qmfWwRRn0ZdOB4aiOuNEiHvi4CYTpYUYw31m4hK815zIHwcV5Mgtb1nFfmYVrp2D2fSEQqpmjWTl8Ez-y0T8qkMhdlGDItg95cgqbh_TGACQVt6mNxXeeBGraAuoCPV0LbnGpP8n_hipLDXI7bs6DUQ0h0XsMlHmc4A3vANhOmVeD3xQGGa4Z6EKC2pKSVO1q2CaNgLUUQE6M_xc4Y6btjREea3VMfjKSYue1AzPO9NdZhL8w_AZBdVAgy03aRF_uTwrnobXpyO-6rXkx5vWnCjL-gW0mihbHsmDjVvUl1tC2b57rGSZ0zzTj5x5lZKvEGv7LUYLc9jsBilrV8Bc58pWkWbI3ullVsoXfTmVE0xQzhQWtPqtrIDEjBFlQPv7H69UWqZ8wM_hmT9tbZ8qtwClkdziZ39vGfb_vFyYbqs67Q7c78cX1rP-Sn3hJP0FZxa-U9YNJYaU08cmCgS8iAboe-9KrmupFFn9c5i00YRWTiU6MgPLhHPlS13o4pOsSb6XW6-w8qZ9elBv-JZgrbpS-9ntfES48a3A3q1yFUvy5_RRZPUc_D7mvumYS3P8dWXDucP5gieOSlN7wHmvZmABe2qbS7vMTMVLb-GeFYV0UvFu2OvE-v3T2nszotghLqDbM1-jyJSufuI6feTKaCZxbWa2t_Uab8OwDnzGri53XwTenvuNjaRJwE_Ynn2IVgUGDhD_uhkQC7RKUhb7IErXBvvI7HvIWbZ4JL3CPyu081H6sGyJ2iZ9pm5F24-R83TleoJbs6dZz8hxtMkhEACYU8oPk7MnZdFqaw8rthrUCb41sj12Pv7WcVYlaexb7nWY8Vzg&cid=CAQSTABygQiDV_2Ni3sfHsOtWJ9p8bRPGyIslWPcChYg0DdCZiyZcXRIAfdg9zQRdKoyafSxHqaiNzpmANxnqi-hNgrUsHGswQ9zXG_HFLUYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=2224832178554945300&adk=3944675600&idt=293&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2adbb3a7c7757fb6d3547d552950b0476cd3d46c28a75653e366bc0711d6317f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36524
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 9010 33 KB
33 KB 235ms
234ms Font
font/woff2 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c05::5e , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://castles4kidshamilton.co.nz
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 14:31:53 GMT
x-content-type-options: nosniff
age: 492429
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Jun 2024 14:31:53 GMT

GET
H3 200 container.html Show response
d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0DDE 6 KB
3 KB 241ms
235ms Document
text/html 2404:6800:4003:c1a::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306220101/pubads_impl.js?cb=31075569

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c1a::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://castles4kidshamilton.co.nz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:18:59 GMT
expires: Sat, 22 Jun 2024 07:18:59 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9010 0
0 245ms
244ms Image
text/html 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CHNX_ZkeVZJnSArDTmsMPzcGx-Am9uuCUcY7fsNSsEWQQASCRw6CcAWCr7LGF4BigAdTJ3IkDyAEJ4AIAqAMByAMKqgSIAk_Q5aAMw8x8cYdTfKGGDOkIbHIZ6Vir_wiccyO8r7wsaC-0QCxtTLgdrHkbeji063wCaTFK0HCRUIsKEl94NAVegz7qedTQW1oyfrFsjg4fOq2PUKuNCdl5vhmnr-OTt_a7zCqdWD96_PzNToH8rG3EwFzK0aFVqEi5VykvtHXyFXR209LQpyGus9Z7e5eLXAPHmD_KHCKzm47SSblMYlNkBh0EHhCdWfrnR613MvhjNV1y9x55aIZfo62RTzYV5MKF0XRK0FsNkijkgYfLlNc0N3PNqvlVDfWoWWL0wE5C1CLe_-tI_rXvkSYiDkJhstAGTrGcPgBwyw0gB6dv1twOY3vJdPs7CMAEm-_zubEE4AQBkgUECAQYAZIFBAgFGASgBi6AB5S2o3aoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDAyEfSCBQIgGEQARgdMgKKAjoCgEBIvf3BOoAKA8gLAdgTDtAVAYAXAbIXHwodCAASFHB1Yi0yMTAxMDAzNzM0MTEyNzcyGLL4jgE&sigh=h5Ai0KtapJs&uach_m=[]&cid=CAQSTABygQiDSWyuwjnSQ8TNYK1Z8kl0zJ9oO4zUuiALaH9o-BXbDcakw7S6D40aIBY2wVlVCjUh7gMn34Pv3PfnzT4Tmpbo3jQa_ufH-4cYAQ&template_id=5000&cbvp=2
Requested by: Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 3DCC 111 KB
39 KB 236ms
236ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 10:18:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75607
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 10:18:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 3DCC 11 KB
4 KB 235ms
234ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DmDqxbPI2r4r3HNhZ3BnVbFutd3p45HVIGjUIns61uTGVJOko9Tzr5HvUSDsPtTKFk6d4ywPQDZtFsOtW4MHALRP8fxIOsv7SSSbyiqdxHZ0p6Q5mWF3RgTV7gV0fBe_nOUcZaZRSwaYTifE8CppAGyNewufEvRiEPhWICblToZ4VrrR4&cry=1&dbm_d=AKAmf-ATkSAc07fQYgkzhMf5nJbAGyGFSbNcgsPkWMzu5d9Kn6DKEAu6hnnNWFtx4J1VeoUtbOwz1JhjCcNbHBm7_b1S3aygNK8mo6qGxNSDECSwlq3KEG7nlwq6CL5rV6Hq1VJQtQp98o0rmjvotY7bS9DhdC-XFviwsH2NAIUKx0JIB5L_Z3JF0NoGxpGIoyr2cts30suliXyUnb0Dr77RHlqrATfr-nBunvq-C1Satt3Vy3MWYU-5AK9ZgZ-aDgUI10_0OTbq2_CJfLrjIld-kZtdvmKwM5RTxtC7nwVmbq3ywr2jJ1_n_uvQOB5qAIFTJlf8aPoyGYBDbINh5sHpS0PzIBz3dBCJrAmEZfjxrP-WNoc7QDV9qJHXKJ9fgD37yNxcM_rAwq5ud0nq-HdDBFdalGYDfVIi2R-ZWy7gfYq6mqO-moCq-1yCtw81Hf-2nGsBasCFycgNcLMw5m3kR6675Yf5-g-oPipIlpSQMB2irG9aNCFXd7JFyzW5P926CZMbrmz6Oclmd7-KC2PcgXeFjOHLafR9aBR0jplRKyJ8QjwnsWtXfnLbXtoan7cvSeqH15ZgFtGBA9k1gj_A-Ivoj9821RQ6M5R1GAc4iCZ4pCLjdotAM0mp-50tNFZYxNx5kRnvJ6jM6fQoSAMD9QzS9Qc_wB0UcmfAp18kx76Nk13ARwZiGkTFPn0EZQC6msbSk9GokA_Q6uSZ5nw21-CogoGxhn3cTNob5njjk3HIS6bxdeip9uW-Kfk8bGGiBMUHFUMTOQHm0CSFVq9TR-Rxt2TATWqwLcvf3tcAlZE_RPLnD19ZiD3jWddyi9to6pVfcRwmYnB4CDqkkInJT1vwS1w0venl7btcSZhG0-hhA-ZhpCF0qZ4XF1dzLudRPhyJB27WhxFHS6y9q5_9MnTvOL7-5Uk8N5ZAe9YqjfotOEHMQUDSMi66DBurCx_SXdQfiPeLs0ucIkNlGQ1SrTdfI6YIyp7sGrsuhngWOH66qrZDRZb6q9CWPM-FJWfyKcU6_fQ9xAwLFQ2JJy3X_llnz5Yz9YtHUA6NXbPPBbngbLJabKXsi1qZNonyWt-Zlu1L955WY6Kj3yTa-DgqL762iWwgTMsNzVK3quwpHN0qSSnUAdDOZV1t3EbrnSHMTS__Fo350D1mjBnd7CbTpL9VumSbseYjKB1GyMTCvaMhwPfwt2Jd6e2HFyKH67hvSvKrGXbI7Er25-37halnTVc4UhmVuJAU1_Y1w0S5BkEyzyB6SdBiW5zJBCMSUcjoghNb0CZvpNavJy0zPAs66RQOGeeTOo0rpGJmN0YJBk6bh9oB41o39yL9pzYwzK3jHDoTWsPEKE12kx6G5vA0n2awZpmNP8L5z7BzotnMQwhw7aCBkSCOqmpl6YlBbYDU0RrQo4sKyNfXz8V57kSTfvW3BmGuSRjIYiIl7GG0xvX7UJVVogw5sH5OMk0w7GdutXUOYiV0gm-Qc-ixqIPI_EDBueDIW7o8CMf7dSexFvl3RY_V8uKXUjuD3TssZ2kgENPWkoiP--kxswRt6RFqorchbkkmykzM6t_R3FOwqbCrf91XAYtFMJD1CVPk50JKkmOR9IsM_TNBm8-_0tRXkgNmwSpyR-pWTb-cX6td8VCEIiUhi8aeic5bGklL-gQsVJxx18UryeN9WxZADtiN3Erwl4xYrqidPxrjHnTmNZlUPvDUaZU0r-xd0Xs2EgAojxE5huVF_2xXhHo0qhF0kt3erjbXZxjAxNm-IKdh2FFahf4nXGp7kIJZpBzuYntoOuxioeoPKxtjfCo1ts5hWVBbq04yIUMuDImTwRmOWpUQYzpvSKGf-HcZtCAqYwen0JcpxsHL_sodFhpuAfpgYGsuPKGgjF1MO12HKVe8l1KeiBCVGFm5j_zkYk9k9kxntZH_kQ6_mIpQat2Xh53qGRcBMEi5U49J6_vH3I7wY4JD-5baOgujoSiLd2zyzJQjOREyIE8jERS94vV4CsSEQdmX_yMlTL3__Yd-kQ5e6YjSuuJpYTs3R4ayv6k4gQN7Mve6UHDAF7JxGlFgW9s3HxBvKyLgMImoqTC2ByKysPLNWu7bT4zsls-xUkENOOQyxlzqSBcU_xzdxzn8t1nSMa6CJHBRGljozmEvjxRJgfQ6h35Xy7YA_E_fT4Vsst14EayNRUbYKU_h68KstK8Wk0v7lizhvWfT43umQ-xUA8TlKBUNvzJnnemGMaQwMPBkuNAc0SwBqIZOY2sT0fAu4iZsAKaJzCWgUiqGCzcLaY7jSkrI5SK3DomUz5UUyutYV8yge6hB8K0JhBoA3zw4DmyysXv-szpRSBjhu-Q7Lum6PYzThqofcvW5c2kynBWsyM6_y3TxwfgdgANbx9Uw--GUpyW4OXekSUstDFbyBgHj_CyEmjHXGharxpi2bghRuMUR_7Ao9S6L1DSm0Y5U1bdwteDlwisEfYYVowGe1gBGXbJFG2S8v9lOhdyifloEWVG9iXrnxDxjyPbObwzOy0_N5LfBJNUje9zbSeHGEQeDgO6x7AC9fewLS45kwD1sQ22yaK7pSWPcaodp373aXtnyB46msKGqa2ZArjNH7AyO-tuEuSlQSEX1Vfwc1VtWur0czCOS9XOjDpy76tKTtgYCs4wRdqK9nZnrRwRwL9da_mUhMxFHmz4Lpm78B6i029qlnRIxrR2tniRRkPt8dB3Ye7_GQeHhJ9oJbst4JzFkx0SiAb5Kdm2OCKoctx7a9IPJLHKmBYHrDWlKJwB_Yw90okxRUJu93exeJhrAULnXsSzfQ_xTRmaRo9o5w0w8wntW1pO3VX8q2c8fTDOGxUtIc-32Z1UgIOtf5kevCC7qmfWwRRn0ZdOB4aiOuNEiHvi4CYTpYUYw31m4hK815zIHwcV5Mgtb1nFfmYVrp2D2fSEQqpmjWTl8Ez-y0T8qkMhdlGDItg95cgqbh_TGACQVt6mNxXeeBGraAuoCPV0LbnGpP8n_hipLDXI7bs6DUQ0h0XsMlHmc4A3vANhOmVeD3xQGGa4Z6EKC2pKSVO1q2CaNgLUUQE6M_xc4Y6btjREea3VMfjKSYue1AzPO9NdZhL8w_AZBdVAgy03aRF_uTwrnobXpyO-6rXkx5vWnCjL-gW0mihbHsmDjVvUl1tC2b57rGSZ0zzTj5x5lZKvEGv7LUYLc9jsBilrV8Bc58pWkWbI3ullVsoXfTmVE0xQzhQWtPqtrIDEjBFlQPv7H69UWqZ8wM_hmT9tbZ8qtwClkdziZ39vGfb_vFyYbqs67Q7c78cX1rP-Sn3hJP0FZxa-U9YNJYaU08cmCgS8iAboe-9KrmupFFn9c5i00YRWTiU6MgPLhHPlS13o4pOsSb6XW6-w8qZ9elBv-JZgrbpS-9ntfES48a3A3q1yFUvy5_RRZPUc_D7mvumYS3P8dWXDucP5gieOSlN7wHmvZmABe2qbS7vMTMVLb-GeFYV0UvFu2OvE-v3T2nszotghLqDbM1-jyJSufuI6feTKaCZxbWa2t_Uab8OwDnzGri53XwTenvuNjaRJwE_Ynn2IVgUGDhD_uhkQC7RKUhb7IErXBvvI7HvIWbZ4JL3CPyu081H6sGyJ2iZ9pm5F24-R83TleoJbs6dZz8hxtMkhEACYU8oPk7MnZdFqaw8rthrUCb41sj12Pv7WcVYlaexb7nWY8Vzg&cid=CAQSTABygQiDV_2Ni3sfHsOtWJ9p8bRPGyIslWPcChYg0DdCZiyZcXRIAfdg9zQRdKoyafSxHqaiNzpmANxnqi-hNgrUsHGswQ9zXG_HFLUYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=2224832178554945300&adk=3944675600&idt=293&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:58:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33651
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 21:58:12 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 3DCC 30 KB
11 KB 235ms
234ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:24:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28502
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:24:01 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3DCC 41 KB
15 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116385
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E293 0
0 248ms
248ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZXMHlcWEIZfvFTb8zmvgOyTi3YXKrTz_bnVVaGYQfL-B_KyvLaNG6FIHC78wkj9U1UeUKvtGSRmMrag8KpN9tQf8y465uvqCh4UvMYJSjyOlzeBG67FtD9ZPF3jDftBNDMZaVE8bF-TVh8Z1HNluyCV3xemyzCQJ6YoVQO5nznFylWvuJrGKBvWYil_VNMgihNqOPuL--lCnTV8N6SNrY55X4epHWCEw0AnDEqRJ_dAXycgPfepnRIFri_STrsPHqdcn9cHU_XuastaVxn0ufNK1VDYeg7-TmhqhAC6vBSHJ7_IcQyCuj1DmaPgCDpU4FmeVUMX5K3Q-UrmUOwpL51N93Q0cN8uR7Qw6B6TnCwxUUxPCehGbq4Dtubps-o6rJigvS_InwuLxty5gu8Sl98enIgZCO2NaMyVvjxfQPAMhgHBIVa8Nfy_sj_Jy6aRa3WDSsQZdaVvynFcR5LV12w3_BsA7qK8fTjKe48912YSy03AmUzWs2hN5TpoUaUaBU7qXlONSctUPWpigGvT8reeHKxngI1uGwdF1EVh8l7fowzdQwArMk1a_WJxGYTn5vEWBuvLLPUSsjAf7KbDFv_xOd_S6-nt5gXm4Iskg2YfO-nVDc3-luXNf-U_pJsVwgRxar9JWjbz0BLDdQ-WrHwqDwlhtO0VeaC4XkV65oqPN8k-efuk-LrI2rjKsnioVANSZSHDIolCHfciXT3SyojUPlaZYhedTa1wgsKysl0LccUCLVNjv3Wiv-sidL0MJiTCviqZ_DYTdpKPub9nqqPALevVLFcvQXwyACaqAkOizy0S_8YCL6KOJhx4LAI5Zv4b6oKVU1KrA-a6ErSFMFPb73-7rtDDMlIKZaYHU29CkPGERQ1JhRGy1oXaEogUundsXUD2_h5RsORubkiYuFIatZMX61VN4NTiglHoYpah4JHQTZc37ODp0M9QDMTejr2PRjsZtEUb6H4G9iqiVSA-Q2JUvdtdaMD46Ul4FA1a4bL2JFwvybHrdvx0MQLfG30pg936KlFjXzY7kwhGQuGkwtSgjoYjTC90me2giNirbU6ycFG2TQ65CTHgLfSNnbOespEcIcoF_hOBiXJywXRZZW1xxUKG-VgnInvTn3yR0_Tbiyzs_Rnt_QRkXNQBdALfPhhBmqW-_IkIcatBYI-88LiVX7hYnF4PWsWVaXxAUVTTaUFndtmSqKZ0UEQXitG-wa_yaKvU6p7V7S2yQGE3mSDYNn3sa2SPk7P3_0N-guC3XCAqg&sai=AMfl-YSiYLbHMUpagmw2ZsZsYjgkODch7MnsGPfpFJWI8ziQcS6rEAwo_cktd24ylDp1lzUlhtwr1ecuWmKH8ngzHE4tMX0-cNKwbkBKIS-z-2p8_UotxM3XwH27u6TKLwq30pgYCJ2RdNC9hMef75ksBa3hGSXBB7U7ZAYCzmA757L-PeWxYhhwmUpku6duuH7DQxIVB9emtYFLvj3SODy8HkN_87ZBZuoLjCnRRi8XVIe0ptCRqIaLVGw4Z65d1r5uBEd_ZOcQFdp03fJmW-B92GPjx1_Sfv19EmdL&sig=Cg0ArKJSzPWwN51hmXQFEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2301&vt=11&dtpt=2299&dett=2&cstd=0&cisv=r20230620.37579&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Jun 2023 07:19:03 GMT

GET
H3 200 gwdpage_style.css
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 55 B
103 B 238ms
238ms Stylesheet
text/css 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 731 B
263 B 242ms
240ms Stylesheet
text/css 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 234
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 24 B
72 B 243ms
241ms Stylesheet
text/css 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdimage_style.css
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 281 B
187 B 244ms
242ms Stylesheet
text/css 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 158
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdattached_style.css
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 26 B
74 B 245ms
243ms Stylesheet
text/css 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdtaparea_style.css
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 157 B
144 B 242ms
240ms Stylesheet
text/css 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 115
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 400 B
304 B 245ms
243ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 275
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 20 KB
6 KB 247ms
244ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c27626364eeaffb44ad2decb980dace7bedb3c8ea1575f81927fc9409cb5b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6276
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 3 KB
1 KB 423ms
421ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3260225ba132e9bf8956514e81f6136265ee05250271a027bb2029cbbf4651d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1308
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 8 KB
3 KB 373ms
371ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4eefdd923f73deeaec9e4ecb4cc3fae74379145f0fd3f5892165326bce8ed0ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3191
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 08D7 118 KB
40 KB 466ms
464ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 04:17:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10871
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Jun 2023 04:17:52 GMT

GET
H3 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 13 KB
4 KB 392ms
390ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b671e2140966063715d21667867d60de45adc723cd1b31e0d2f7466105a90247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4481
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdimage_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 5 KB
2 KB 417ms
415ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2014
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdattached_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 1 KB
619 B 431ms
429ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 590
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdtexthelper_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 7 KB
3 KB 453ms
452ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dea5d8ba9e54379b26e109f61ceba20a0781d4f80eed75fce6ad0993d4784195

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2823
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdtaparea_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 3 KB
1 KB 434ms
433ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f2aac94d011ec45570ef1245e5fc8df73ebd09b1c6859c5a8393df5336e01b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1356
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdgpadataprovider_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 3 KB
1 KB 613ms
611ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdgpadataprovider_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a170f5913eecb1afeda4cccca5d5b9589c8f068a04ae2c517b602e1484982b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1293
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwddatabinder_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 5 KB
2 KB 605ms
603ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwddatabinder_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3460d76a3013a4bb9c689877b41f3eadbf5e780ed9230fb8f8bbd16fcc59842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2351
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwdfontloader_min.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 5 KB
2 KB 441ms
439ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwdfontloader_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e631166725db81a1885cbc3332777d5a2a7d9af0414000c270412c2817a755a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2124
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 gwd-dynamic-binders.js Show response
s0.2mdn.net/sadbundle/7321652676849631590/ Frame 08D7 23 KB
9 KB 560ms
558ms Script
application/x-javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7321652676849631590/gwd-dynamic-binders.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df544db2e8b010512a5ec168d3a9b91355c7197d04a1b29325510e29405e6e0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 03:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12787
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9229
x-xss-protection: 0
last-modified: Mon, 22 Nov 2021 09:59:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 03:45:56 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/14874605759583484493/ Frame ECFD 108 KB
22 KB 237ms
236ms Document
text/html 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/14874605759583484493/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0bd3932a25a5bbaea1018a6edd76a7f3567987795d1686edf6a6f110da6c3f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 29311
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22110
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 22 Jun 2023 23:10:32 GMT
expires: Fri, 21 Jun 2024 23:10:32 GMT
last-modified: Wed, 14 Jun 2023 21:48:58 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3DCC 0
0 258ms
257ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstSQmjsGwdUzUG6Bt3RVuwQDA66amzSh20OvW9gVpP3ER4HYCsWDd0tGia5WMXK3cBRL_25Ontuu_j-u5DJYg87ZLJYT5UtAop1yrfAZ6UQCWG6aicnsCFmeV63-OAqu2eNGlaYRVZfPXl90H5C6xHajKQ1gDvskCP5MYT9dO4eOZ2kUwfIueY7hdZReePNmKtQVuQh3M9q8oD5QqcvGZzpIiIjnH7wzRFlE5I4G2TSAT-VkDHv6qRCA8ZoLFazmgx9KOz5mfZil-OAUW4uYlz_zGFbeejakuFrt9D4DH783KA7kDgN3NMu8dMXrFpqWuUTKaVu2Fxa2D8XA12uXSIGBpmu5sXTFem1-0HxY7h1Or77zq65SFryYx0ipsKuq655glav5p9AR91UGCygy6EiIDGRcqu5a8uGnW2bQ68TMVV1BI4usg1sQHXtRMtrAeWiglr-iAsKKyznA9ApzrCUs4SzgStUZzuZ8a9s3qXrpM8HD5bSaT2-k2pSOqWzDRrJTtxkl44MkjpBZzLtg4WY9TuBs2pGYGCYkyXoWhUcfv9V-sOcHmLt2q2HzsuRWhE9f_9dAE3JIV-lILj4zSzZwDZWvfQFPqayeeSc5tXhT_Z1D_PhNtrN2xRH7rMyJO40ljCFuGSKLkNDCA-5Xx3ZiIESFgABB1MmueqO_7cdVcemm7GKRqbdSp7EmMpqhk1qJd6JzYyLivwkiW07cAiS3-_gEymvWg3FlZgPOicOor0uTKU1vf1Q8tu0UzktSnmlEw7Dhl4q7lx5xCrQoXpx5qJzQ8NpYGV_t1eooMJfVHR4_NY6VaR8ajfSuR2NghnKB8P0wgq4Zsp-MCR7Gt9n9ZL3TZwDOvR4tVhSPZWImnC8ESVKZStexJSqRjVXvc6jfqIHySXvKeMmq11d4ndrX7jIvQf0bfeskuk2aHHhMHFeXs3-OIo_Sp5jMF8W7D1ZCnB4FVhaYAgtpgZc6HKuDQObdmzE2mG6k6yMmB5THsIYOabC4JAzH2WQ3V23ah9WCoTlAWWwXvb3-QX1l6nAJFA7JZFDOyDrLSmbZZLVBkqF0TGGeVLgxxwx2VUigBAftKLNK7-EvyZKF5SK7zGnjIwVMQ_Ca9C1TbWtYmHhMdx9ka4CX-TjVzMwx9S-bpEBml8MsMoFVFe36uBJ3Qj7MSvtfpgqJKX1IQeXsPWg8e5P4b3VYpbv6hH2_lSJExtp5NFJlETQDOwrW1A4HyRSs9uAblqOGgusGGUfekzgkgbwqghwqoA3RhSIkFaL1EC63uMACw91yyfZxUzmajx7XaReGXyG_7kjRtvEz8BPToAukjg&sai=AMfl-YQWx3ZwiS2l8f0qiT-i5HVQLC9-97uQlzOWvsFs8kAjNklsQF65U8p0qH_NUg7HsWyFk1loUVvBRr03yZbvG-L_fE3Q0GuaVT2apYBlM0CHKwx-pdlzk1BjNHsn7wCxrsaHN_8QIR-KgfLfvusuhY01Kx8l4MuzcIymT9mVp_WLrUKOdOaUngUnK9qWjBfCwDNJOxzOseM6zJ26JvvZGpmXtGM3Um93PbjfrOglQ-qI119USD7YmotzRSLifIsiDg6QYsKJzWPX9FnjzA17pmm4yvqj5zqP-obt&sig=Cg0ArKJSzEjpDWCHUISAEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=520&cbvp=1&cstd=517&cisv=r20230620.24926&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 23 Jun 2023 07:19:03 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:03 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5D96 22 KB
8 KB 235ms
235ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118310
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 66D3 482 B
216 B 243ms
242ms Document
text/html 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBDo5OKhAxijweHtATAB&v=APEucNVrqxiTP1t32g0KTHolFI7nwYMj2aRlWYMivTgMII0ZkvBs1YDNr2nJOZqmTcEXDELAZ00itY6BXIXM6-W2FabcZpeuVw

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7599e0a5ce1ba2a12f036e998e19e60b6e982178e4363d4630ab3a91ca73bf62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 193
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:19:03 GMT
expires: Fri, 23 Jun 2023 07:19:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0DDE 78 KB
27 KB 242ms
242ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:03 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0DDE 42 B
63 B 238ms
237ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ccg5muzqM82FegGlKNf12BnjgrSLqZnTgLqUH7NIgHKdLWU9WB_0rQjHkZW4VckwV8lOGhu-M4wPyX1ZYwEc3vNn3RbV9HCoDMpyxGAsq0cJke0Zg

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0DDE 0
20 B 237ms
236ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=13744954652831679281&x=1&ct=132

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0DDE 3 KB
1 KB 236ms
234ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 22:51:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30424
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 22:51:59 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0DDE 19 KB
8 KB 238ms
237ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29658
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:04:45 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0DDE 179 KB
56 KB 725ms
724ms Script
text/javascript 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57242
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687383875062185"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:04 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame ECFD 3 KB
665 B 237ms
236ms Stylesheet
text/css 2404:6800:4003:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14874605759583484493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::5f , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d265615b79f98fdfff370ea32da7b4b02317fc6017b898cfb9c657a65618ac07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 23 Jun 2023 07:19:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 07:12:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Jun 2023 07:19:03 GMT

GET
H3 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame 5D96 37 KB
14 KB 270ms
269ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201588
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame ECFD 32 KB
11 KB 363ms
363ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14874605759583484493/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14874605759583484493/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 12:32:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67604
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 12:32:20 GMT

POST
H/1.1 204
No Content bsevent.gif
rtbc-ae1.doubleverify.com/ Frame 9868 0
234 B 553ms
244ms Ping
text/plain 34.149.43.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-ae1.doubleverify.com/bsevent.gif?flvr=0&impid=cd77f03bac9349a68d92ceca3bd6e492&vfdur=2391&cbust=1687504743884371
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.43.113 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 113.43.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Fri, 23 Jun 2023 07:19:04 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: 06/22/2023 07:19:04

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 9868 16 KB
7 KB 238ms
237ms Script
text/javascript 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1006
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6830
x-xss-protection: 0
last-modified: Wed, 24 May 2023 18:59:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 23 Jun 2023 08:02:18 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 9010 42 B
64 B 240ms
239ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsutFZsCU-bJ_WvCxoUpmyegdLXHf9zH1WbOJ39jnpLzjK2T9jCutxUdPlPUd1uSVo9I7r2RFZeVm_RXKKYbnDVF6HTGnUVTe8-8akqM4kVRfpArff2oSsz6Wltk2vPblzAyxoaX4r7oUA&sai=AMfl-YSalTmnSLfs4Z7p-TAcT9VZc_xLLKkybXxsE5GhAobUmOYZabfNVcklYvLNzamRSTQckT8a-JgTD1DBB0FZQ_g-FDOabAsVjAMnRNTko0OPWHKfAZSl6RQb3J2puHAmzp2U86YueG8mAvFTGA&sig=Cg0ArKJSzLp2LS_2UKIhEAE&cid=CAQSTABygQiDSWyuwjnSQ8TNYK1Z8kl0zJ9oO4zUuiALaH9o-BXbDcakw7S6D40aIBY2wVlVCjUh7gMn34Pv3PfnzT4Tmpbo3jQa_ufH-4cYAQ&id=ampim&o=425,696&d=750,480&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=427&tls=1427&g=71.66666388511658&h=71.66666388511658&tt=1427&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://castles4kidshamilton.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame 66D3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEIxTi-DvgEWOUA2NfBYDK18&google_cver=1

43 B
175 B

991ms
328ms

Image
image/gif

2600:1f18:612b:4280:5e9:e456:25c5:c94d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEIxTi-DvgEWOUA2NfBYDK18&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBDo5OKhAxijweHtATAB&v=APEucNVrqxiTP1t32g0KTHolFI7nwYMj2aRlWYMivTgMII0ZkvBs1YDNr2nJOZqmTcEXDELAZ00itY6BXIXM6-W2FabcZpeuVw
Protocol: H2
Server: 2600:1f18:612b:4280:5e9:e456:25c5:c94d Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 23 Jun 2023 07:19:05 GMT
server: nginx
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://partners.tremorhub.com/sync?UIGL=CAESEIxTi-DvgEWOUA2NfBYDK18&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 66D3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEOFTkrgBYg4PliuOXIJjknI&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEOFTkrgBYg4PliuOXIJjknI&google_cver=1&__user_check__=1&sync_id=3c6d38db-1196-11ee-9684-132115060407

43 B
548 B

242ms
241ms

Image
image/gif

103.71.26.126
SPOTX-AS-AP SpotX...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEOFTkrgBYg4PliuOXIJjknI&google_cver=1&__user_check__=1&sync_id=3c6d38db-1196-11ee-9684-132115060407
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBDo5OKhAxijweHtATAB&v=APEucNVrqxiTP1t32g0KTHolFI7nwYMj2aRlWYMivTgMII0ZkvBs1YDNr2nJOZqmTcEXDELAZ00itY6BXIXM6-W2FabcZpeuVw
Protocol: HTTP/1.1
Server: 103.71.26.126 , Singapore, ASN132134 (SPOTX-AS-AP SpotXchange, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 07:19:05 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 87
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 23 Jun 2023 07:19:05 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEOFTkrgBYg4PliuOXIJjknI&google_cver=1&__user_check__=1&sync_id=3c6d38db-1196-11ee-9684-132115060407
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 72
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 66D3
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=M2M2ZDM4OWMtMTE5Ni0xMWVlLTk2ODQtMTMyMTE1MDYwNDA3

170 B
188 B

250ms
248ms

Image
image/png

142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=M2M2ZDM4OWMtMTE5Ni0xMWVlLTk2ODQtMTMyMTE1MDYwNDA3

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLuEFBDo5OKhAxijweHtATAB&v=APEucNVrqxiTP1t32g0KTHolFI7nwYMj2aRlWYMivTgMII0ZkvBs1YDNr2nJOZqmTcEXDELAZ00itY6BXIXM6-W2FabcZpeuVw

Protocol

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 23 Jun 2023 07:19:05 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=M2M2ZDM4OWMtMTE5Ni0xMWVlLTk2ODQtMTMyMTE1MDYwNDA3
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 73
Connection: keep-alive
Content-Length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0DDE 0
20 B 237ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=542680981607&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0DDE 0
20 B 237ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=542680981607&version=m202301230201&ct=132&x=1&cor=13744954652831678000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0DDE 87 KB
36 KB 274ms
271ms Script
text/javascript 2404:6800:4003:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ALbOzvetGngGQ0D_N3V-OW8lE_k6Ae3nLxPGd65riU7OfxfbMI4hC3w6S-nVz02MmrcIMrv0ZpeRNOfjLwxwWcAgZgGirUQPdFYCaSZWkeEcn-fxBBRzEEf_vUHhJvSxsvv9TjF1DTU4KwFTfwUzPip0khqyKCW7zgZ6SZktYzECFQAc1iLQlLY13UYX8JYLKnqMYS&cry=1&dbm_d=AKAmf-AHR9S98xbQyoSvL_6GyN_NDDwg0bRXfgYuPLmZVuGoA1KOc2uIYoC38waD8j3Z-8fSYRoTi0r2QowYPzyBhum1pe481pcWbtlJ3WaY9tjk5hsLfBL7CQ3NGh8JY7IYKAKU-tCLNJG2ZyEKYxRBIEIX99YrI_l5-D1lh1KfZeyRB8k9yofT4Xa8R8dNVys2-VdNdjOBaSoZv42bSlu8R7uDGP6ScWRnVirnMwjgymEznLfk6wD3C-yxaWcF61xWJ4p1Bhwtt_wYfyzvjPaXoW9uUPD8BE-7Ksq3a1t7UdnSHnAy5fn2cW2mYAbTHUGuhaq9UPKVoMSq4kE8FbNCwrQY4_N2H_qPEhcSDZyCEldkN4jbxMz9eZ80uRcdgDYzRgfUvz6Keyvk8GBmxOBa76XDwlkFWjpur1Z3TwdmmZm8qU2iuzNp-FkkIPJm6VFObSiIdnht-NkmiP-QNNmuRyiHXXZZnGCoAZ0G61EpbyI-lG9ZjOJCnjuTUC3KyaF4QGd_Caaa_fLRmumnERwbSlTpAryvtwvkirUAFZEuln84KsNpd5qZTabxwtPDLcvi3Ubm7_6sWS4YTb48u4vM_coEvVkTqBpeOraTDBvJoKGw2csMLlogvIQHAutuusZxI_hm8D_Ztx5Jm-InC7cU0R8zd3Lc4b6MHe00JY7YfXutox71sWdnp1sws_2ords_0DVo_aaQEFb0MFRLonldlWq2jFMgFq5xlnbHWa3Ms4d6wnAyEdOanhQ-rQZAZ1uumrlWe-pV1po-RkzgTXOch-1Yo-5lrHTjlQTWiWlay-EWzUxkTVsx3SyiGrNVk8LcvRCnvJ08bB4RUmiMjqEJebsb5OHTmhvfJLBxxmcgdAO-tm7JhA9-2y-sUwZXfE8rrJBIZc3BVedxytvV4IaCR3mxvO1MmuUo4fUQ8j2Wvuo-IbDaena88_3pVWdgEP4adrjNCXdBikiiKs5wlhMJORs__nZIaxjTBf1_M1I0kNlGr0TnGE4PkuTyCsi2ztmGX7pHoYzYa9lVNWekUHi0Px_wH5kj2cQ3Ax-5EeEYm12F_2rm6hXXQ40cjFqinwibuIqMVbTOIb47F2xzQnmaCzA01TxbfpDP-7EvMmsuL3Q-Zzu3fYA_XRHAjI3GOkKcCTwS3bFJYnXfnvW3gn3CrzWWn9KygYZqlJmHlahACjYO8AmL9YVVlbX54qQJ4h9T0vABtuJRsY0iZJlMETigCW0vjll0XFO0w20jfpq7fkLhb01rpNlRDZG0dqjTVHwKWFkd6Ha4fwDmu0h8ayA_F6EzNW82eYkA0sIq84zKfDblYexCjsVU9y0LQSSp-3E6unkUo8Epy6xB29knzBvdDHvWHYaLjr5RyZEQBBI0kLuh5a_lCKRUhTFUTzCFyULVNaGIeoQmksxIBeqLozKsCyQfl9pVTb6GwpqvFrqaXbRM70_iI93xAK7wCC8znu5WLpTHSGn9BLu2e5H1GjJkLKRGrwLPOtWd5bSpl9UOvPgGLVFGPUNSUYOmY9pteEIF8CDzwG3K9RbuzlIjqqGWHoSOO4cUuNsuirlvLtK42dMXIjvtaj2RorRToH8HS4IftJvxzYXxmrl3s9Mz2t6SsFMpjcj-fd1i-gyznuXKrrcexOGFHPBKIWVizX71Ap5mEdZDCW05IAkGgf-HbeF73X_mEg3Kk4WVD_GHro6qslLzAGnG0E8mXhlNcltd3DJzvgqZ1k0e8VuQO-dfzh3plW8Q0XP73Tpgx7Yo8VYR09SYkGP4yLuW-NzaOKErzm2UA8fmM9xxCn2D-sssn4fqd0Bp7t89Rpdr-Hh0y26qbBXoJmTFBV-AQ3uslFUU2lDY62tWpF6FzV9rudT6uD6tZxlHqsyZTGHFY79kzItw5IAVj8MG5-qYmjeBEEchgDitl1q9B9x0aK-4uAdHAdH86EO6UaxHw6PJ4M9jzBGn-_qNAb3GaxHm8jlY-cSquSWsNQilbVr4OlDSXv5X0lqCSvXL4Zob7xepnPw-LXMeFJHlw60qzBxFqtmWzoNUfe5h5p4wQvPsYW-uCisWNcnwojvx2VuE4sdjfQcKPfiIAfcwj5RLNxss2m5pJjHq1qDnNmi_DyOsSaeaoBcQepPzwzgQKrnLi92Ed1ykbA0EKVeXuHbrKShXE4l58h9NAVoEd2rQxD8bRhaRJjwhgS2aRQO_tjOulE9hW0n63wth_ZqW3zYMauyYEcmKV04QUNMgwoPji6qIJqh8U6u0sx4oG1ayYEKZxOivBoRPJlDnF-IbmVBLx0YX_D7Bq7bMNrxTM0tneD9co2qAAkq8U3o98FP2ycrI7ACoSAy7L1UTiI36ut1rBGLFUNdFtbIJd-7c0pHrWl_nYN4wy089WhWHtcGvAhpbpTfzzCjt4vy5X8zWEJYpxRNeMoe7ThCxtqTQybCsunzhrR9vA7aCBg5SHGo01w6gjJnqscpwpDdC-6k0VEAquzfUbH7vXC38xmY4d5p6OHY7CfnU-2zTgnXH3O_BF5mcFaQXMkL1Q-S4v1Dla0CqXiHvX41MlLteeS1XSAqcpusTip988CsvD1mL7ODhaso47mLbSPLlH05WPfSqc2kscSz-6Q06rjrofp3Wz7o0OkvZj_jTu-ds54uo20IH9x5SK-rlKpBSqUH4cxGn6_Q4ekinUcMy9sjwJdhjph5LScDjvf6jXqjrhkDofH66u5faHJjacF5uf_7vKJmxhVAq_nykNj_uSiTDwZ5gxji7fFLMBeDxsSQQNQerflAR5HGtiF9niAvqqJY6X61ao6owXuNmVi6hDuOXmqOx1wnR1hfmNEiODRJLxvbuSKMe2ACI9DaOMJA9Sl4AWUkgDhEQh6pqtGv9jxIDxAJIOJ1ne-90PdPW1wrn-I9RB8L0pIYiW7bfJp3h-Wny9lmH9r5N8lLu3CMtmljDLNlPAzVH_IRxuV4Q_Rr3FLSJFMC7H_t6SkiMc4jwxN1opjCxoTqgXTxzdAOrfyqfoJEpnAgJdu5Eo5ggyRjNPPYvG_AML9zb_RxuEqLxj2MjFKUkaf7PKHJTAskZSSPa8TLKWMrWHojjNTnQQWb6c0F0GmajS3v1jsxOayygQQHYRqA1cZxJ26_9JzA14X8kTJyUKaZqR_l3DnKfC-GOxA5FyfXJpJwBoLpFsXYBTs1-RJPdU5QnuJsObO_m4fKIGfBGln2WFJhXHT1yRHMrAv8QWXK_NEfSe_Q-5wRb-p309DVZSfF0jr3peTYMuyd6itwFe9ETqC1zvDltoixbrkhAbzl65-i_D_hSzClYMEiRv5yxyXCydIU07WrlyymNdw2lR6P0FZJ-EKYpyGu7G4ENbnhKx0aowYInvOhWXfL_UBs0WvLwanJWP3H3jTFslD2MYqJPLngzUMrRIVbsMSo8wHtav3ph4FZNVFz3fdU85mLUtWDql_FKeTQ72Hq5Jkwbmnz0tRH6dHURXMN8YbufOkXCS4eupWWyzbjqeotNXMMeA41yZCm5J5OpwsWaoF463pHezUG1MCXmm7hP69xbXjxuvMKP3XzsyijEbY124i0yqb5KMS5AniulGVDjalnsC5TlWRVoZnkK1RVBsmhQ1aeaNdXC6DfMK4oZeh-Q6nC4tqu4ruFvnBh-sbYFiI8Jsm6g6GJ5zfEoSJ6ettxybHhZkWHbFaTeLr13vRXS5SC-IptANQ-zlII0IrhiAeQL0t0z7HPlq2k7srxrgCC30hrXnypnaNqZIJm7G2rVVZmsEKT1M4zA6LsVNHNKFIvptIspeYjlwFoMSW2yIoF2xGF2RH3X7A&cid=CAQSSwBygQiDXtUuvb7pcKlxxckxbiHY1EfCIdHE2C6HOxx9lB6yBZ8ZWBxiVy1uekYm-7CYJ5vQQ9mb0KbiMGHdbBE-SZyyvXszbUWanRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=13744954652831678000&adk=3690638929&idt=289&cac=0&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5924a19d6af3b911fb8ac09a0457e21c4168d30afd93846e5e7947aa92ac8045

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36870
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 impl_v96.js Show response
www.googletagservices.com/dcm/ Frame 9868 49 KB
20 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v96.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:45:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117210
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20157
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:41:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Jun 2024 22:45:34 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5D96 0
20 B 239ms
239ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVfA4ZkeVZOHPL4Wa9QP9j7eYBAAAAAA4AeAEAg&bg=!SEulSx_NAAYQ3eRoMN07ADkAdvg8WjrjoP4Dw9Wm9K_gPiIW2U3sHi_cCcTgosM2M1Uul-xXJikUYaJWqIYml4r7px5jqZqPmGkCAAAASVIAAAACaAEHmQL1EjA2meLhMk6RWk1_2N9PVF7ox5eu7vdt8xvx6AstDu08zUMMla3xLAzxHMhGV_TNxW6HJrRmXkXab3V9ZObSyFmyq_QbEuvbRvib2ttsL4kS-rwnjVY6bzKOxy9MZ6Sng5n1NfttyAeDNthQFLAfGkTfnPax-ERUajO_-abekXEkurQqiCIP-o75Lj448-cKkSbeoFaLsx8GKC01OekyLqejcOWVbqqqnKkDS2XVzXec7jriFMkOcbMQ4gM9zEx0EmbsjXMdi8_3i-lf3r_kx20-TYU2ZeIEq7SAskH3_ufxKx_XRLwGYhGz8drTDDIGp5r_dG_YrBEBiACQZ3DNRtr_J2-PQYrQVFSVucVLH4RRIZmxai8tOe45PpoWMyl3_sGsBWM4r1XmJcD7M9x7eGAw4Mtjeu8VLKBOVusA3hRQbKwhY6nXfMMiso2IvOSVmIYAHgdkIdsRXnB-glb3RYW_4Xe9cjSlWhuFvXgAjtoR0Z1BBtux0rDuAdeXKsCob_4LTzEUGIm1REyhihCafdhjxPXnuQtXvz2N7o-kU0GtXyE1aN-W03bGXbWfXLy2SCy-BK7dhELUD0dJRGEc6vyZjmOUBgeli-nPDPsHFO7PusEAFKoQ9tsQWHXVuaDjKoehOvjSHKBtOH3X1QkhWDoSpBpDlt52UD2-nPU0FLhW4d9__HRcbfesfwBGO2HAo12LVVYwXgB9bXAV9AftlQKlomrSmBJi0bl81NrGB4QM5zEBkt3jPmYsOTthIOC9J8jDGYz9qouf2RpEykAldwOMlkn9G7rdv6sAAYH20ZhCahf7bUvIeWX43IP_juNYjxWf8m0q3fCAZao2-z3tANuJecHeYFyIBUpPdIJETsJbWSWM3yApqYhAQLWjWJcqDzw7va75_k9TWIBzNeorXOJBO289gWNKysuDPKwaBzJM9lQ4K_N4uh73-72uZjtYdDu1xDdHJNr2TdMzhOP1CprNCSwX9pqz7cyvAwlTftsODJTC2A

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B5B 0
20 B 238ms
237ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8072199970496&version=m202301230201&ct=76&x=1&cor=16503900528818540000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3DCC 0
0 249ms
248ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstSQmjsGwdUzUG6Bt3RVuwQDA66amzSh20OvW9gVpP3ER4HYCsWDd0tGia5WMXK3cBRL_25Ontuu_j-u5DJYg87ZLJYT5UtAop1yrfAZ6UQCWG6aicnsCFmeV63-OAqu2eNGlaYRVZfPXl90H5C6xHajKQ1gDvskCP5MYT9dO4eOZ2kUwfIueY7hdZReePNmKtQVuQh3M9q8oD5QqcvGZzpIiIjnH7wzRFlE5I4G2TSAT-VkDHv6qRCA8ZoLFazmgx9KOz5mfZil-OAUW4uYlz_zGFbeejakuFrt9D4DH783KA7kDgN3NMu8dMXrFpqWuUTKaVu2Fxa2D8XA12uXSIGBpmu5sXTFem1-0HxY7h1Or77zq65SFryYx0ipsKuq655glav5p9AR91UGCygy6EiIDGRcqu5a8uGnW2bQ68TMVV1BI4usg1sQHXtRMtrAeWiglr-iAsKKyznA9ApzrCUs4SzgStUZzuZ8a9s3qXrpM8HD5bSaT2-k2pSOqWzDRrJTtxkl44MkjpBZzLtg4WY9TuBs2pGYGCYkyXoWhUcfv9V-sOcHmLt2q2HzsuRWhE9f_9dAE3JIV-lILj4zSzZwDZWvfQFPqayeeSc5tXhT_Z1D_PhNtrN2xRH7rMyJO40ljCFuGSKLkNDCA-5Xx3ZiIESFgABB1MmueqO_7cdVcemm7GKRqbdSp7EmMpqhk1qJd6JzYyLivwkiW07cAiS3-_gEymvWg3FlZgPOicOor0uTKU1vf1Q8tu0UzktSnmlEw7Dhl4q7lx5xCrQoXpx5qJzQ8NpYGV_t1eooMJfVHR4_NY6VaR8ajfSuR2NghnKB8P0wgq4Zsp-MCR7Gt9n9ZL3TZwDOvR4tVhSPZWImnC8ESVKZStexJSqRjVXvc6jfqIHySXvKeMmq11d4ndrX7jIvQf0bfeskuk2aHHhMHFeXs3-OIo_Sp5jMF8W7D1ZCnB4FVhaYAgtpgZc6HKuDQObdmzE2mG6k6yMmB5THsIYOabC4JAzH2WQ3V23ah9WCoTlAWWwXvb3-QX1l6nAJFA7JZFDOyDrLSmbZZLVBkqF0TGGeVLgxxwx2VUigBAftKLNK7-EvyZKF5SK7zGnjIwVMQ_Ca9C1TbWtYmHhMdx9ka4CX-TjVzMwx9S-bpEBml8MsMoFVFe36uBJ3Qj7MSvtfpgqJKX1IQeXsPWg8e5P4b3VYpbv6hH2_lSJExtp5NFJlETQDOwrW1A4HyRSs9uAblqOGgusGGUfekzgkgbwqghwqoA3RhSIkFaL1EC63uMACw91yyfZxUzmajx7XaReGXyG_7kjRtvEz8BPToAukjg&sai=AMfl-YQWx3ZwiS2l8f0qiT-i5HVQLC9-97uQlzOWvsFs8kAjNklsQF65U8p0qH_NUg7HsWyFk1loUVvBRr03yZbvG-L_fE3Q0GuaVT2apYBlM0CHKwx-pdlzk1BjNHsn7wCxrsaHN_8QIR-KgfLfvusuhY01Kx8l4MuzcIymT9mVp_WLrUKOdOaUngUnK9qWjBfCwDNJOxzOseM6zJ26JvvZGpmXtGM3Um93PbjfrOglQ-qI119USD7YmotzRSLifIsiDg6QYsKJzWPX9FnjzA17pmm4yvqj5zqP-obt&sig=Cg0ArKJSzEjpDWCHUISAEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1241&vt=11&dtpt=721&dett=3&cstd=517&cisv=r20230620.24926&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Jun 2023 07:19:04 GMT

OPTIONS
H3 204 6232695
api.attentionxyz.com/api/event/ Frame 0
0 324ms
323ms Preflight 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/event/6232695
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: accepts,amt-event,content-type
Access-Control-Request-Method: POST
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: accepts,amt-event,content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 23 Jun 2023 07:19:04 GMT
vary: Origin, Access-Control-Request-Headers
via: 1.1 google

POST
H3 200 6232695 Show response
api.attentionxyz.com/api/event/ Frame 8B5B 2 B
17 B 373ms
372ms Fetch
text/html 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/event/6232695
Requested by: Host: attentionxyz.com
URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=6232695&attrCampaign=29777392&attrSite=1589324&attrPlacement=365461496&attrCreative=191219526&attrAd=556481724&attr1=%edclid!&attr2=j
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accepts: application/json
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Amt-Event: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJhbXQtcHJvZCJ9.8dotrQPk6rXdTZUfYiTmmCx3BKBZ0ngS9huOY_9Rk9s
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
via: 1.1 google
vary: Origin
content-type: text/html
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

POST
H3 200 5417733 Show response
api.attentionxyz.com/api/event/ Frame E293 2 B
17 B 372ms
371ms Fetch
text/html 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/event/5417733
Requested by: Host: attentionxyz.com
URL: https://attentionxyz.com/55-15e40ad0/amt.js?tagLabel=MBM_NZ_cm360&attrAdvertiser=5417733&attrCampaign=26800795&attrSite=1589324&attrPlacement=323863712&attrCreative=162000675&attrAd=516312665&attr1=%edclid!&attr2=j
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accepts: application/json
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Amt-Event: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJhbXQtcHJvZCJ9.8dotrQPk6rXdTZUfYiTmmCx3BKBZ0ngS9huOY_9Rk9s
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
via: 1.1 google
vary: Origin
content-type: text/html
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

OPTIONS
H3 204 5417733
api.attentionxyz.com/api/event/ Frame 0
0 323ms
323ms Preflight 34.117.222.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.attentionxyz.com/api/event/5417733
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.222.118 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 118.222.117.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: accepts,amt-event,content-type
Access-Control-Request-Method: POST
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: accepts,amt-event,content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 23 Jun 2023 07:19:04 GMT
vary: Origin, Access-Control-Request-Headers
via: 1.1 google

GET
H3 200 FreigSanLFProMed.woff
s0.2mdn.net/creatives/assets/4003215/ Frame 08D7 63 KB
63 KB 236ms
236ms Font
font/woff 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4003215/FreigSanLFProMed.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6354c4ec800f1d1d7affba1c099e916ab2c55ecadd4fcbd1493d3a28ab776e41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:05:31 GMT
x-content-type-options: nosniff
age: 813
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64700
x-xss-protection: 0
last-modified: Mon, 21 Dec 2020 16:10:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 07:20:31 GMT

GET
H3 200 FreigSanLFProSemBL.woff2
s0.2mdn.net/creatives/assets/3981799/ Frame 08D7 25 KB
25 KB 264ms
264ms Font
font/woff2 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3981799/FreigSanLFProSemBL.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6fdadaacd40057633d19ce14868b83ab76f781214f860e5b93d5e8f37ba1f606

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:05:31 GMT
x-content-type-options: nosniff
age: 813
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25824
x-xss-protection: 0
last-modified: Tue, 01 Dec 2020 00:02:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 07:20:31 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E293 0
20 B 237ms
237ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6042601331087&version=m202301230201&ct=76&x=1&cor=12163029002883744000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 08D7 7 KB
6 KB 241ms
240ms XHR
application/json 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f78ea70ea12d8e0d3b3647ece0ebcd1344a3cdc7e2b70f6da1e95f8082361601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5656
x-xss-protection: 0

GET
H3 200 B9689862.280410797;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=4167744936;ord=sq4ntk;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fcastles4kidshamilton.co.... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame 9868 61 KB
28 KB 278ms
277ms Script
text/javascript 74.125.200.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=4167744936;ord=sq4ntk;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fcastles4kidshamilton.co.nz%2F$0;xdt=1;crlt=vHdmjWszY8;stc=1;chaa=1;sttr=255;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sa-in-f148.1e100.net

Software

cafe /

Resource Hash

c59c10e14933b4a737e63570900a30c4ae8f8758028aa7bc0523ae0287b5544f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28372
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 0DDE 172 KB
60 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Origin: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:19:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71984
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 11:19:20 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 0DDE 11 KB
4 KB 236ms
236ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ALbOzvetGngGQ0D_N3V-OW8lE_k6Ae3nLxPGd65riU7OfxfbMI4hC3w6S-nVz02MmrcIMrv0ZpeRNOfjLwxwWcAgZgGirUQPdFYCaSZWkeEcn-fxBBRzEEf_vUHhJvSxsvv9TjF1DTU4KwFTfwUzPip0khqyKCW7zgZ6SZktYzECFQAc1iLQlLY13UYX8JYLKnqMYS&cry=1&dbm_d=AKAmf-AHR9S98xbQyoSvL_6GyN_NDDwg0bRXfgYuPLmZVuGoA1KOc2uIYoC38waD8j3Z-8fSYRoTi0r2QowYPzyBhum1pe481pcWbtlJ3WaY9tjk5hsLfBL7CQ3NGh8JY7IYKAKU-tCLNJG2ZyEKYxRBIEIX99YrI_l5-D1lh1KfZeyRB8k9yofT4Xa8R8dNVys2-VdNdjOBaSoZv42bSlu8R7uDGP6ScWRnVirnMwjgymEznLfk6wD3C-yxaWcF61xWJ4p1Bhwtt_wYfyzvjPaXoW9uUPD8BE-7Ksq3a1t7UdnSHnAy5fn2cW2mYAbTHUGuhaq9UPKVoMSq4kE8FbNCwrQY4_N2H_qPEhcSDZyCEldkN4jbxMz9eZ80uRcdgDYzRgfUvz6Keyvk8GBmxOBa76XDwlkFWjpur1Z3TwdmmZm8qU2iuzNp-FkkIPJm6VFObSiIdnht-NkmiP-QNNmuRyiHXXZZnGCoAZ0G61EpbyI-lG9ZjOJCnjuTUC3KyaF4QGd_Caaa_fLRmumnERwbSlTpAryvtwvkirUAFZEuln84KsNpd5qZTabxwtPDLcvi3Ubm7_6sWS4YTb48u4vM_coEvVkTqBpeOraTDBvJoKGw2csMLlogvIQHAutuusZxI_hm8D_Ztx5Jm-InC7cU0R8zd3Lc4b6MHe00JY7YfXutox71sWdnp1sws_2ords_0DVo_aaQEFb0MFRLonldlWq2jFMgFq5xlnbHWa3Ms4d6wnAyEdOanhQ-rQZAZ1uumrlWe-pV1po-RkzgTXOch-1Yo-5lrHTjlQTWiWlay-EWzUxkTVsx3SyiGrNVk8LcvRCnvJ08bB4RUmiMjqEJebsb5OHTmhvfJLBxxmcgdAO-tm7JhA9-2y-sUwZXfE8rrJBIZc3BVedxytvV4IaCR3mxvO1MmuUo4fUQ8j2Wvuo-IbDaena88_3pVWdgEP4adrjNCXdBikiiKs5wlhMJORs__nZIaxjTBf1_M1I0kNlGr0TnGE4PkuTyCsi2ztmGX7pHoYzYa9lVNWekUHi0Px_wH5kj2cQ3Ax-5EeEYm12F_2rm6hXXQ40cjFqinwibuIqMVbTOIb47F2xzQnmaCzA01TxbfpDP-7EvMmsuL3Q-Zzu3fYA_XRHAjI3GOkKcCTwS3bFJYnXfnvW3gn3CrzWWn9KygYZqlJmHlahACjYO8AmL9YVVlbX54qQJ4h9T0vABtuJRsY0iZJlMETigCW0vjll0XFO0w20jfpq7fkLhb01rpNlRDZG0dqjTVHwKWFkd6Ha4fwDmu0h8ayA_F6EzNW82eYkA0sIq84zKfDblYexCjsVU9y0LQSSp-3E6unkUo8Epy6xB29knzBvdDHvWHYaLjr5RyZEQBBI0kLuh5a_lCKRUhTFUTzCFyULVNaGIeoQmksxIBeqLozKsCyQfl9pVTb6GwpqvFrqaXbRM70_iI93xAK7wCC8znu5WLpTHSGn9BLu2e5H1GjJkLKRGrwLPOtWd5bSpl9UOvPgGLVFGPUNSUYOmY9pteEIF8CDzwG3K9RbuzlIjqqGWHoSOO4cUuNsuirlvLtK42dMXIjvtaj2RorRToH8HS4IftJvxzYXxmrl3s9Mz2t6SsFMpjcj-fd1i-gyznuXKrrcexOGFHPBKIWVizX71Ap5mEdZDCW05IAkGgf-HbeF73X_mEg3Kk4WVD_GHro6qslLzAGnG0E8mXhlNcltd3DJzvgqZ1k0e8VuQO-dfzh3plW8Q0XP73Tpgx7Yo8VYR09SYkGP4yLuW-NzaOKErzm2UA8fmM9xxCn2D-sssn4fqd0Bp7t89Rpdr-Hh0y26qbBXoJmTFBV-AQ3uslFUU2lDY62tWpF6FzV9rudT6uD6tZxlHqsyZTGHFY79kzItw5IAVj8MG5-qYmjeBEEchgDitl1q9B9x0aK-4uAdHAdH86EO6UaxHw6PJ4M9jzBGn-_qNAb3GaxHm8jlY-cSquSWsNQilbVr4OlDSXv5X0lqCSvXL4Zob7xepnPw-LXMeFJHlw60qzBxFqtmWzoNUfe5h5p4wQvPsYW-uCisWNcnwojvx2VuE4sdjfQcKPfiIAfcwj5RLNxss2m5pJjHq1qDnNmi_DyOsSaeaoBcQepPzwzgQKrnLi92Ed1ykbA0EKVeXuHbrKShXE4l58h9NAVoEd2rQxD8bRhaRJjwhgS2aRQO_tjOulE9hW0n63wth_ZqW3zYMauyYEcmKV04QUNMgwoPji6qIJqh8U6u0sx4oG1ayYEKZxOivBoRPJlDnF-IbmVBLx0YX_D7Bq7bMNrxTM0tneD9co2qAAkq8U3o98FP2ycrI7ACoSAy7L1UTiI36ut1rBGLFUNdFtbIJd-7c0pHrWl_nYN4wy089WhWHtcGvAhpbpTfzzCjt4vy5X8zWEJYpxRNeMoe7ThCxtqTQybCsunzhrR9vA7aCBg5SHGo01w6gjJnqscpwpDdC-6k0VEAquzfUbH7vXC38xmY4d5p6OHY7CfnU-2zTgnXH3O_BF5mcFaQXMkL1Q-S4v1Dla0CqXiHvX41MlLteeS1XSAqcpusTip988CsvD1mL7ODhaso47mLbSPLlH05WPfSqc2kscSz-6Q06rjrofp3Wz7o0OkvZj_jTu-ds54uo20IH9x5SK-rlKpBSqUH4cxGn6_Q4ekinUcMy9sjwJdhjph5LScDjvf6jXqjrhkDofH66u5faHJjacF5uf_7vKJmxhVAq_nykNj_uSiTDwZ5gxji7fFLMBeDxsSQQNQerflAR5HGtiF9niAvqqJY6X61ao6owXuNmVi6hDuOXmqOx1wnR1hfmNEiODRJLxvbuSKMe2ACI9DaOMJA9Sl4AWUkgDhEQh6pqtGv9jxIDxAJIOJ1ne-90PdPW1wrn-I9RB8L0pIYiW7bfJp3h-Wny9lmH9r5N8lLu3CMtmljDLNlPAzVH_IRxuV4Q_Rr3FLSJFMC7H_t6SkiMc4jwxN1opjCxoTqgXTxzdAOrfyqfoJEpnAgJdu5Eo5ggyRjNPPYvG_AML9zb_RxuEqLxj2MjFKUkaf7PKHJTAskZSSPa8TLKWMrWHojjNTnQQWb6c0F0GmajS3v1jsxOayygQQHYRqA1cZxJ26_9JzA14X8kTJyUKaZqR_l3DnKfC-GOxA5FyfXJpJwBoLpFsXYBTs1-RJPdU5QnuJsObO_m4fKIGfBGln2WFJhXHT1yRHMrAv8QWXK_NEfSe_Q-5wRb-p309DVZSfF0jr3peTYMuyd6itwFe9ETqC1zvDltoixbrkhAbzl65-i_D_hSzClYMEiRv5yxyXCydIU07WrlyymNdw2lR6P0FZJ-EKYpyGu7G4ENbnhKx0aowYInvOhWXfL_UBs0WvLwanJWP3H3jTFslD2MYqJPLngzUMrRIVbsMSo8wHtav3ph4FZNVFz3fdU85mLUtWDql_FKeTQ72Hq5Jkwbmnz0tRH6dHURXMN8YbufOkXCS4eupWWyzbjqeotNXMMeA41yZCm5J5OpwsWaoF463pHezUG1MCXmm7hP69xbXjxuvMKP3XzsyijEbY124i0yqb5KMS5AniulGVDjalnsC5TlWRVoZnkK1RVBsmhQ1aeaNdXC6DfMK4oZeh-Q6nC4tqu4ruFvnBh-sbYFiI8Jsm6g6GJ5zfEoSJ6ettxybHhZkWHbFaTeLr13vRXS5SC-IptANQ-zlII0IrhiAeQL0t0z7HPlq2k7srxrgCC30hrXnypnaNqZIJm7G2rVVZmsEKT1M4zA6LsVNHNKFIvptIspeYjlwFoMSW2yIoF2xGF2RH3X7A&cid=CAQSSwBygQiDXtUuvb7pcKlxxckxbiHY1EfCIdHE2C6HOxx9lB6yBZ8ZWBxiVy1uekYm-7CYJ5vQQ9mb0KbiMGHdbBE-SZyyvXszbUWanRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kidshamilton.co.nz%2F&ds=l&xdt=1&iif=1&cor=13744954652831678000&adk=3690638929&idt=289&cac=0&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:58:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33652
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 21:58:12 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 0DDE 30 KB
11 KB 239ms
239ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:24:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28503
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 23:24:01 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0DDE 41 KB
15 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116386
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
DATA 200
OK truncated
/ Frame 0DDE 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fab0d4875a588a58ef58305fddbdd27707c23180aa4ff47be91019913292c730

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 08D7 17 KB
6 KB 2437ms
2436ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Jun 2023 07:19:06 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame AE6C 0
0 250ms
249ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBS-H8QFDP1459HZIt0wvpErwVJ0CSOkfUr3dSMV2HPlCJPqvpwK8KJT1L3CC8QNdLGH16V1qZJQiVWXeikrAOdEFoakbKmRJk5Axm7TEd8g-SFfuyyOOxoJ9USjbIq0QK76-t_7xcDIzrYe_2j-hv2Qls8FfEUktlqcegCZhBj-qaKFGoWZjzai60MaQartZ5cEmtGoWWbBubaytDOKkcuUzi04StRfmFTgCVLxa2y8X1c_72Ed2On6qQegtLhGgSYddWiX9T7dUpTG8PDXnBmPklAuNJXDpw07nHHnoxKQvuhR3u8UEFrrZhF7qqng9J3Cvu2sq6H0V5ELcc4rD0IHu4NyiIvJ_QeXc9JBKVq1vj4ab-CEg_9jhCfI9lsTT5ldyCEKWlL39zHa3SJvsfO9JZNIB-JYggDNJm-TDuy_pCdhHvESuzepnj8-GC2-mNJrYgAb40JSQJvGuhXJ-fPUzOA-vniCPbxb7LcedFeERiL2wcMvPvmXn85RsG5s7pl3MgCHg5Q798CPGChAt7vM4ME1TPQic-qZnLuSnNLTJ_qcojPBcYGLGlv4K0ZOWHSKwVNWtbflsNmLsW4zUceyiVzgP0zsjZd02PBGfyiErPnXqCkxuuJ16usJxGio_YHLHLhGNQxmHZ8uEL3RDvvqa6bAxq3-3vaNuJixMh66aAMxC3_h8RYTFHxndExaOOYeJ_rRqOeOf5iaj2D9BSgHZGfIerJIHlURbEhrDBNYxoOR-mhU-frFW59mic5f6WkbOYn8VTGQKHb4bVycgfJ93Wd4cvri0RI2Z6Ngzj0DQAKj7YYta6StDU-E_iQs4noNvZDDoKTQGVg4xLMR3cpSK1kvdDlg7R9RSSg5_jNBcdCM3rFFATTgVIAtEWxe4V8D3u3DFTWgbQHyzXVQ5CmwWixJy_SynXmj9WyW0_w11125zvZWLc-Kwp6zvUM7fiuOXLdkr4jv6Y-k-Dyhrjz3D1LB64iCuPrvpw5NkKXX-iqAGhckFeej4rx16OPXqfmm4EwQq_1mZh_K4zEAx4bBfH_WMNdNQxnXmnpRDziVqHUu-akneMN_AvqFNU4-sYwwlE5ApgPo_E3DgZ3O6E4nzq_ezdIhx3n_m9jNOlRLjbkSeaLp1iClyM2-52ipuyBBfP_cjNKqV-BENs1PH07Ds4nd1rObNDDrQtHPE380EZzoMRFb_xIp4n0wcgngKEHzCF3uUKuIKNKG08aOFIVGwTFnRok3IUXORH-ANO7Un--K4QaOLNEDHNWjwo3Vd1wLo8ySb3HuuVt1hyZMi6aGehfKXguIeEpoI-MA79GEd1imeV9YF1megqWOIO64Wvf_deif-w9I_plo1d9FoU8Eg1XiMz5I8&sai=AMfl-YQPz_BTxdi64ERV9_oUx38rUgwYlC-R7tQfu-c7qZs81nLzqovbIiobaK4X8vbTP8h_AYA7RuERjcYMAXDpy8kMVYQZuVa8nkN-2hiU1dUCYHGRInUIuWEOOkTR40PmLKtxpTjric9M1pN2nM486MNie_kCB4dtf9bUQD0HTIF47V1YnJsZieDWTm7d75ugL4WeWgc7J_NOZ3_0X9V-MF8ZL0YhfKLnkpdZns3PJkINj77Z52PNnp84nUiStHE57RLMtlgwt5LytwKt25sr-h0HH8yuFMhS0xAshsO1gm9Mgwye3BRornd3-8c&sig=Cg0ArKJSzPwTSN123L8yEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=3507&vt=11&dtpt=2295&dett=3&cstd=1201&cisv=r20230620.60522&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Jun 2023 07:19:04 GMT

GET
H3 200 47512218_20210823074053600_bookabach-logo.svg
s0.2mdn.net/ads/richmedia/studio/47512218/ Frame 08D7 9 KB
4 KB 237ms
235ms Image
image/svg+xml 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/47512218/47512218_20210823074053600_bookabach-logo.svg

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92ead7127a4733b272f1fda1965653adef6e3c188383f0c301d43e5eca3ab03e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 00:45:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4110
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 14:40:53 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Jun 2023 00:45:10 GMT

GET
H3 200 47512218_20210820075720084_Bookabach_Logo_an.svg
s0.2mdn.net/ads/richmedia/studio/47512218/ Frame 08D7 10 KB
4 KB 239ms
238ms Image
image/svg+xml 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/47512218/47512218_20210820075720084_Bookabach_Logo_an.svg

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

043cf318621d2c88fb4091f2066f4252fae8b1703da895b834c21172b1bd6f8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 23:11:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4184
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 14:57:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 23:11:44 GMT

GET
H3 200 47512218_20220518022848387_img_zoom_auckland-nature_300x50_1.jpg
s0.2mdn.net/ads/richmedia/studio/47512218/ Frame 08D7 10 KB
10 KB 566ms
565ms Image
image/jpeg 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/47512218/47512218_20220518022848387_img_zoom_auckland-nature_300x50_1.jpg

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8afb453ce1deec8b1cb005daa1fda0ac213e46b184a17bb8e705e0269baaf9b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7321652676849631590/index.html?e=69&leftOffset=0&topOffset=0&c=VWYScHPL4r&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10101
x-xss-protection: 0
last-modified: Wed, 18 May 2022 09:28:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Jun 2023 07:19:05 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3A95 22 KB
8 KB 236ms
235ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118311
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 9868 11 KB
4 KB 237ms
236ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=4167744936;ord=sq4ntk;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fcastles4kidshamilton.co.nz%2F$0;xdt=1;crlt=vHdmjWszY8;stc=1;chaa=1;sttr=255;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 21:58:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33652
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 06 Jul 2023 21:58:12 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9868 0
0 248ms
247ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvjBk_510mtdVb6HYxbAkqnJf-Wzf-fH36UafdvujmIqgTDMVqu2P9jBEXGzHICJ0XBMsJr7gv4n8yix687TRoKfLzcYH-fCRVjRRrse3zWex7vqhgXMct3dhe1fXjkTW7qlnZ4rF0cClCiLnuxWuqN9mJIE7jk9AuUbdVhFlVP25rOExXPdg&sai=AMfl-YTHjAnsgeWs6b2ooWvvZEsebWCt-Prgsoh6aQW_MbcLJEtpclIsmk8JPLYKttYRK_jJcpqksaxU9QGl1fP9IE03IFHMea-gSvNLtw&sig=Cg0ArKJSzNfUcswMM5MSEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230620.06938&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Jun 2023 07:19:04 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9868 41 KB
15 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116386
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 22:59:18 GMT

GET
H3 200 12224131752392196093
s0.2mdn.net/simgad/ Frame 9868 144 KB
144 KB 236ms
235ms Image
image/png 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12224131752392196093

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e80f3c6479f08a7ea0b97f0c3538f4d3420e0f00df102e15469e7fc6ed013cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 20:20:27 GMT
x-content-type-options: nosniff
age: 125917
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 147304
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 20:18:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 20:20:27 GMT

GET
H3 200 YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js Show response
pagead2.googlesyndication.com/bg/ Frame 3A95 37 KB
14 KB 237ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YTnPKPJ-Q--T2AJ4Qj25FxWmw7bAoVXE9zhtz1eN5hc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6139cf28f27e43ef93d80278423db91715a6c3b6c0a155c4f7386dcf578de617

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 23:19:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 201590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14704
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 23:19:15 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 81E3 22 KB
8 KB 235ms
235ms Document
text/html 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 118312
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 22:27:13 GMT
expires: Thu, 20 Jun 2024 22:27:13 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10479148228550548039/ Frame 6873 127 KB
34 KB 241ms
240ms Document
text/html 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10479148228550548039/index.html?e=69&leftOffset=0&topOffset=0&c=bTUlib3VLt&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e8b37088d20af2dcb606fffc12a321e1a6145576f87669b0eff84db777448d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 07:19:05 GMT
expires: Sat, 22 Jun 2024 07:19:05 GMT
last-modified: Thu, 13 Oct 2022 01:46:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0DDE 0
0 257ms
257ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsswDwlAqAjfkf60EhAtx3KAH6my4b_DWhbWKr97SjQMvECb09E9h0elLRWNoDG-uJ8lf1_4ew3iGhjx5CkAS58BCADKUIk8w9UgeizSqxqjMcJzjDPnzeSmwJZSyAkN2MIJQ_YWR2KT44rDsxYI6utVVG4xiqthpipMZh_LT9XRvfGJFFd4zdc4ntCZ9Wmmcz4_RDC1M-W7OQ59Gs_Vw4YYdxY1YdSzXI1cQyES2_VHR3gCaVjDIept0JsDtzJkuaPY7zLj6udegI42Ne2nwBjeh-IObYNeapubrlA6qBu3IpfdSlbSWl51_RdUGoBQTr6z9d9Jct8u77kLBftcdOlKDjlmYjmiU5f8zZqd_9p4xXtiWSuOFZqPRM7HQK7x1UWxBtI0QqS-evGCFbssyPNQrNxyqzCX4O--D3NXEmJqyNvt7eEzqqlvHDg5yVs6uPbRA1Y1BHK9VVOYUJxhRG7ALgH8_hHu5a0ZKabRaMXdBp7a1ATiz1ZNxhCHfCicF0HMJJiP1PGqDm5PBCQM74dKzNCt9uK4KrrlYf1ZwZS_z70vBFlG6iapbZqTymPhVTFmSV2r037XkGik7cDEENlbF-B0REi8yNGmFRLVc3mLIe6Tux42VVRVT_JX64OgsWvWqfjPbZoNTEuG0JNGtVhzNKFweOoPud5aC7SFr7CZGLS5B2aAL4EsFo6yhJVRYEqunAIytk8iDiXOrvfH971FIOI4mVd2C7T7ND3pYBVixzajXWd36kWdKw8MuE6klE4qOfrT1t3JYQJ5GtQsDUQKlZM7Y07XPa9xFiVP8vIK88Q-PIXT__Yagi1wt-7KkCiGctxf6YOHCZ9jH55AbbGOlQi2w3j_fGEBB5i0Y9Kgo3CsR3WCti9mtahT1ibInrrccq5kBe-LH1x-oc_4UhncY4t9R9quiY-xurrwJdvCX8crzJhfHwYFoBBEQJ3D5OTNHePGR9hlaNz3oYOjMkg8qqNFvZhYLff8Hk3NKz_0jIdolk_EycvSWFWx90pWG68Vt0AE4_dKL3mm0AV4f43hpdEbdwt68n0M92g9OP3g7U4g41GTXwgVZE3NZHxrusIqarbCu35cBArX3XpD4UqjOwTY6_theTJ91Dze-CUUyYvrHgYPbAa9SspDmo2Fe3FW_fmxb1uSJUU3B94RqH5vp29R6dojWP3o8pfAX7U49FoU15FvU0SO3mlXKwYloxyku9jG8muiJ8cLhtW0B63XxWLo9R_ncZeQ6311sE4_4Uo5od0R6HCtCyOgnHSQkLDMkgrLcahXS8R2y_vDdG75rh1EBZbrkNCBq8GS&sai=AMfl-YQTfAQtaaeIBXVzR10AzKMok5NQa6KXujajvSUAu3VlX2py2RmNdDuxThbrUq8ovk3pyoehwh8wrOESuJ5bySjxiSH9PLhKOT_I9DtESdMB3k9-qfLoD6IdXaDpPloFP-gFxR3osuqNksbqHNSDANvpdEw23pnPLLO3FTSGIU8LI5gxwZmqndFS9hXrcQ4avbOC56u9qrunDCt-XzlsigB5vEQ1rc7BUzf5W_C9HI8irSMtmHqLRgm2Hc7dBXDRphwMjucqa5x0f8bflZWRepn6-tXyd0QU&sig=Cg0ArKJSzOA1y-bF3cG-EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=531&cbvp=1&cstd=523&cisv=r20230620.77785&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 23 Jun 2023 07:19:05 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 6873 118 KB
40 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10479148228550548039/index.html?e=69&leftOffset=0&topOffset=0&c=bTUlib3VLt&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10479148228550548039/index.html?e=69&leftOffset=0&topOffset=0&c=bTUlib3VLt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 04:17:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10873
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Jun 2023 04:17:52 GMT

GET
H3 200 fAtTGskzFlJa5Ldh3SiPbiLEXcXjYWf8ZG_gkYEl2B0.js Show response
pagead2.googlesyndication.com/bg/ Frame 81E3 37 KB
14 KB 235ms
235ms Script
text/javascript 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fAtTGskzFlJa5Ldh3SiPbiLEXcXjYWf8ZG_gkYEl2B0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0b531ac93316525ae4b761dd288f6e22c45dc5e36167fc646fe0918125d81d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 17:42:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 135406
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14697
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Jun 2024 17:42:19 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3DCC 0
20 B 238ms
238ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9400224742128&version=m202301230201&ct=119&x=1&cor=2224832178554945300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9868 0
0 249ms
249ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvjBk_510mtdVb6HYxbAkqnJf-Wzf-fH36UafdvujmIqgTDMVqu2P9jBEXGzHICJ0XBMsJr7gv4n8yix687TRoKfLzcYH-fCRVjRRrse3zWex7vqhgXMct3dhe1fXjkTW7qlnZ4rF0cClCiLnuxWuqN9mJIE7jk9AuUbdVhFlVP25rOExXPdg&sai=AMfl-YTHjAnsgeWs6b2ooWvvZEsebWCt-Prgsoh6aQW_MbcLJEtpclIsmk8JPLYKttYRK_jJcpqksaxU9QGl1fP9IE03IFHMea-gSvNLtw&sig=Cg0ArKJSzNfUcswMM5MSEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=596&vt=11&dtpt=595&dett=2&cstd=0&cisv=r20230620.06938&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Jun 2023 07:19:05 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3A95 0
20 B 238ms
238ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BLvMdaEeVZOuqD5Pw9QOYqbi4AwAAAAA4AeAEAg&bg=!HR6lHkrNAAYQ3eRoMN07ADkAdvg8WsIUVq75H2LT-MTobuthQfn-ceY-Vl881QnUCxRriMgHn67I1imhRemgmpUl548VQ3bcYNECAAAAplIAAAAEaAEHmQL4Pq2FdGwdaFWKTuXDygncSL6sClqDK0HrGDr0LnFog7-KhxAB3FjZGrH0BElaVVyEL-raS8MnrFF6ZF5Z6QnV5AW7SUo40Nzg8_4xJzmXrwNChJR6k6hPK4b9uCWkxeSalDDwIOGXAoytRhZOdbsP--Ph82qbWurxIV11Y9t4TOPChX3XGvXqV3uZ_7SaPAN7uvvrYCactiMXpCkTLVO2J5O3rKVIn3of0IX4k0MDuJFAYlBLud2zYJ1gJm2nzkZzGKlvbQmIB9R066gNoG49h57CfUh9whE9QX0-xn76tQIvX8SD-7tgNmXfZ9FubPG2zsd6B16cUKqjUrJ-d2GFyrUHmuQRIQHXSy4ZRDCTBkg-8A1k2TAS4fg1LKPFe8Woiazz0onCHXg5e8SRMHUwlSu516IY7o1fcJZqWJJirHE6-z1Lg_ofORImz-pskZsUY7wO-FvVGW1sI9sXhFYtQX-rc8BAFgJ_lIw6FFroABqXaKOQjx6gOFNzNFXt-9mz5CMT7SA3lPTgLbP4vnttHvIxq2I9FQbertdKAHNbUB6D2DLtwc1Qm-U6mdX8FbVgjqsqm4DJ-fLwxAr3NcF-0Z_hw_E8pBT24EfkrR3G6iQb9Mne2NTVI0hNhVrysBJ7ABtBhPn3ndSEJgDcP_Li18BFkJZHtZl0rdLBfakRiFaRP2GIIEG4i_dCbRA-bLy9-bcDjBfLR07x0Ks6MYOVnAxtOEuybrQDpaC7EP1WFbluYOmRhWkD1sQR2DQD2G6sJoqlJabxMmpC1fbump7zKP9ybV57WcWigCGg5Nv_Vlo_n02ycb7Ui6l_bd8mj0vElUyBJdco3_qtW0hEdkquS3b5r7FM2mrT8FCQHPWx8U-7kLFgUdYpEw5dIg0ozMKAcXRI7w8H8y4x-FYkIvzmk9fZRswBppxJHos84TGaAb1hvOUCIerDU1RK8UiRZBMtPsIOXycToXCXPbKvk3paTB39dAjhgjjJUXPSs_wmoJEqkqUS6f_lqQ

Requested by

Host: d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com
URL: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 geograph_medium.woff
s0.2mdn.net/sadbundle/10479148228550548039/ Frame 6873 9 KB
9 KB 240ms
239ms Font
font/woff 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10479148228550548039/geograph_medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10479148228550548039/index.html?e=69&leftOffset=0&topOffset=0&c=bTUlib3VLt&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4c094ae375afe3f43f98ef4735b4950be3847c9df862acebd7dbf8faeb65f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/10479148228550548039/index.html?e=69&leftOffset=0&topOffset=0&c=bTUlib3VLt&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9080
x-xss-protection: 0
last-modified: Thu, 13 Oct 2022 01:46:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 07:19:05 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0DDE 42 B
64 B 240ms
239ms Fetch
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstCdMc-Zx-dhiDSB87lxkoDLYiiczOXb62TubWmno8oAUOEYGz1VjoXQQTdkxsxzmuxKATqhMH90Vn4PNyDhzE12yJzsjWzXvR3kQjaFKJWRePjSxbYoztjNOzrKelQGZhOipjQAJsek8E&sai=AMfl-YQTI3wAVUMTz-QIaJGZP3RNASJqZasLEZ4XShhuJzjTqpczAN8avyajEQJNnBM5Be26SjJHkVLfvD0VZE9tCscPctDF9gxO2CO3eNqhMqHmeVk0tAau0-YtQZcRMiMeuw98KxomjdEYV-GX&sig=Cg0ArKJSzBXC7sHEkoixEAE&cid=CAQSSwBygQiDXtUuvb7pcKlxxckxbiHY1EfCIdHE2C6HOxx9lB6yBZ8ZWBxiVy1uekYm-7CYJ5vQQ9mb0KbiMGHdbBE-SZyyvXszbUWanRgB&id=lidar2&mcvt=1000&p=558,650,808,950&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230621&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3361174464&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687504742986&rpt=1630&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6873 8 KB
6 KB 241ms
241ms XHR
application/json 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7646c846eb397ebaf0f59f0544986d4453f0d8abe58a480d4632db65fbad38e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5854
x-xss-protection: 0

GET
H3 200 prod_studio_01_247_configurablemodule.js Show response
s0.2mdn.net/879366/ Frame 6873 31 KB
10 KB 236ms
235ms Script
text/javascript 2404:6800:4003:c02::94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_247_configurablemodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c02::94 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8460aaf36b73e229c6b0fcaf7bac791e23c3145e87de6a04d0d91541e39289b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10479148228550548039/index.html?e=69&leftOffset=0&topOffset=0&c=bTUlib3VLt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 09:31:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78476
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10616
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Jun 2023 09:31:09 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AE6C 0
20 B 237ms
236ms Ping
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6897312162871&version=m202301230201&ct=76&x=1&cor=9812311831627504000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://d2dc6943e02cd98cb7c9051054472aa3.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 81E3 0
20 B 239ms
239ms Image
image/gif 2404:6800:4003:c0f::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BILA2aEeVZOq6H4WPjMwPwe2SMAAAAAA4AeAEAg&bg=!xsWlxZHNAAYQ3eRoMN07ADkAdvg8WlcR5GhntUaKn4jonvhfIwUCEP9q-Tawdcs1TPXyuSkmjkVu4cuUYMDH0lFNVBlIr5TXYS8CAAAAj1IAAAACaAEHmQL5aypcsCuu5jf_1JUswLmPxLNjat6ux4k_eN3-QB8EneGpLvYYWpIjhH1ACsE0pR1I-Bo3H0F_WNI-1k4K2p-n6WywDTEjoGd3-OBU9lrMM5obYZy0dNvI2jHFNLTVh841W78PJo-JsnWTqXzb2OFQ8djuxfrMp6LC-efa6i5KavH96P1MfrP1hHS7mS8_jI08RENcMlXOgzU-7d4t0UzyxAMoDtQRHBqGY7C9bBjMOkF8YJos0_AHtD3OuRtjXeIC8xeaXdu9G8z4kBvzq1-5o_Xnsvw3XznQN0F6ndgUJRdaQ5LJfJdh4T59Fc4e4Wv7DDMrOFjl-4VmIpOQN74RHDkLHg-cCO76Wzl_b8t_GLgEjOX7w7Nd37htK8Idid9rFns6C53hq1k21vYqjHELPT4mFuGAtNVSWn2AgFVxXqCTKx1g0hbdVby3av0rX1FmwJ_3PcapYLurvI1q1rHLAlMw-kZj4P_ArIo5nQ0uc3NAN6KTmGCweNmbWXHgZCSXahigVV_fHA8q4K_BpZtyavmv9poPOjLl0iQJTIs6oFZSlLWzIjWneeWl7LPZP0nH1M2jaFJw9ehYFKkZt9HrVxxXOvLSja_I2TzJfexPPODCh5p-8N_UHTFRMJgUUdEfTIqHaV9XttVgmZ1zwbkFpX-X_DdhXDca794GtD6QbywcSXGisuVUqggn4Hl_3Vr1ZMF1BdOdntiU96vUZWY_tXMSiYVpO79rh3UlEWjd4zP1Q-YfujnAeBmBgH9ucKw7YbEUsJkRwzdHmUk8b2wvB2vgUu0cTweWdab-Kgvz9m0yoVexunwaKPFKnlPrf57KpAJe3SLdtFku1P0aTrxDv4wY50ZGYkgqTNRn7m_uvpr_q3Ws-1cGblzjypyh0z6zaHwFM__2XmBelUxn2b5h0lGzFJzG5VNaFb50MspGdYF3WdEPlvZqiU4eEf79bBdKYNZwAtnMPV3IAe13aGTiFJjcG0LhFhbotkutAMQRGCPD7XnFLWz5wOA

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/castles/

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c0f::9a , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Jun 2023 07:19:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6873 17 KB
6 KB 1226ms
1226ms Script
text/javascript 2404:6800:4003:c00::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2404:6800:4003:c00::84 , Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 07:19:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Jun 2023 07:19:06 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0DDE 0
0 249ms
248ms Fetch
image/gif 172.253.118.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsswDwlAqAjfkf60EhAtx3KAH6my4b_DWhbWKr97SjQMvECb09E9h0elLRWNoDG-uJ8lf1_4ew3iGhjx5CkAS58BCADKUIk8w9UgeizSqxqjMcJzjDPnzeSmwJZSyAkN2MIJQ_YWR2KT44rDsxYI6utVVG4xiqthpipMZh_LT9XRvfGJFFd4zdc4ntCZ9Wmmcz4_RDC1M-W7OQ59Gs_Vw4YYdxY1YdSzXI1cQyES2_VHR3gCaVjDIept0JsDtzJkuaPY7zLj6udegI42Ne2nwBjeh-IObYNeapubrlA6qBu3IpfdSlbSWl51_RdUGoBQTr6z9d9Jct8u77kLBftcdOlKDjlmYjmiU5f8zZqd_9p4xXtiWSuOFZqPRM7HQK7x1UWxBtI0QqS-evGCFbssyPNQrNxyqzCX4O--D3NXEmJqyNvt7eEzqqlvHDg5yVs6uPbRA1Y1BHK9VVOYUJxhRG7ALgH8_hHu5a0ZKabRaMXdBp7a1ATiz1ZNxhCHfCicF0HMJJiP1PGqDm5PBCQM74dKzNCt9uK4KrrlYf1ZwZS_z70vBFlG6iapbZqTymPhVTFmSV2r037XkGik7cDEENlbF-B0REi8yNGmFRLVc3mLIe6Tux42VVRVT_JX64OgsWvWqfjPbZoNTEuG0JNGtVhzNKFweOoPud5aC7SFr7CZGLS5B2aAL4EsFo6yhJVRYEqunAIytk8iDiXOrvfH971FIOI4mVd2C7T7ND3pYBVixzajXWd36kWdKw8MuE6klE4qOfrT1t3JYQJ5GtQsDUQKlZM7Y07XPa9xFiVP8vIK88Q-PIXT__Yagi1wt-7KkCiGctxf6YOHCZ9jH55AbbGOlQi2w3j_fGEBB5i0Y9Kgo3CsR3WCti9mtahT1ibInrrccq5kBe-LH1x-oc_4UhncY4t9R9quiY-xurrwJdvCX8crzJhfHwYFoBBEQJ3D5OTNHePGR9hlaNz3oYOjMkg8qqNFvZhYLff8Hk3NKz_0jIdolk_EycvSWFWx90pWG68Vt0AE4_dKL3mm0AV4f43hpdEbdwt68n0M92g9OP3g7U4g41GTXwgVZE3NZHxrusIqarbCu35cBArX3XpD4UqjOwTY6_theTJ91Dze-CUUyYvrHgYPbAa9SspDmo2Fe3FW_fmxb1uSJUU3B94RqH5vp29R6dojWP3o8pfAX7U49FoU15FvU0SO3mlXKwYloxyku9jG8muiJ8cLhtW0B63XxWLo9R_ncZeQ6311sE4_4Uo5od0R6HCtCyOgnHSQkLDMkgrLcahXS8R2y_vDdG75rh1EBZbrkNCBq8GS&sai=AMfl-YQTfAQtaaeIBXVzR10AzKMok5NQa6KXujajvSUAu3VlX2py2RmNdDuxThbrUq8ovk3pyoehwh8wrOESuJ5bySjxiSH9PLhKOT_I9DtESdMB3k9-qfLoD6IdXaDpPloFP-gFxR3osuqNksbqHNSDANvpdEw23pnPLLO3FTSGIU8LI5gxwZmqndFS9hXrcQ4avbOC56u9qrunDCt-XzlsigB5vEQ1rc7BUzf5W_C9HI8irSMtmHqLRgm2Hc7dBXDRphwMjucqa5x0f8bflZWRepn6-tXyd0QU&sig=Cg0ArKJSzOA1y-bF3cG-EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1389&vt=11&dtpt=858&dett=3&cstd=523&cisv=r20230620.77785&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kidshamilton.co.nz
URL: https://castles4kidshamilton.co.nz/SkipLink.php/?get=7Toj1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.118.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS