money18.on.cc Open in urlscan Pro
104.16.169.108 Public Scan

edge-star-mini-shv-01-syd2.facebook.com

Software

cafe /

Resource Hash

17978601af8c6f6323b6cb9a8e6071d04698434cdd837053a5df3c0a6386d8e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29342
x-xss-protection: 0
server: cafe
etag: 492 / 19774 / m202402150101 / config-hash: 3286542640257422538
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:08 GMT

GET
H3 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
369 B 274ms
273ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=791&campaignid=387&zoneid=3&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=bbe21fbf1d
Requested by: Host: ad5.on.cc
URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:08 GMT
cf-cache-status: MISS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: no-cache
last-modified: Wed, 21 Feb 2024 14:39:08 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 858fbcacbf8ba7ff-SYD
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET fastlane.json
fastlane.rubiconproject.com/a/api/ 0
0

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 47ms
13ms XHR
application/json 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bfcd7152243deb856ba2b22c92bc947b6da77a5da49c429db544256670833597

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Feb 2024 14:39:08 GMT
x-content-type-options: nosniff
content-encoding: br
age: 38294
x-jsd-version: 1.0.1972
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 840
x-served-by: cache-fra-eddf8230103-FRA, cache-bne12521-BNE
x-jsd-version-type: version
etag: W/"640-SVmBgqiRfe8DzOiNwR43sfUWniM"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 page.php Show response
www.facebook.com/plugins/ Frame 2D3C 44 KB
16 KB 256ms
249ms Document
text/html 157.240.8.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.35 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

273b7f82dbe51491dbb8987545d52f5ad3a6f25eacd2685d2ff23811c77c86d0

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: unsafe-none;report-to="coop_report"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:08 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?0
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
permissions-policy-report-only: clipboard-read=(), clipboard-write=();report-to="permissions_policy"
pragma: no-cache
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: aAX34lmhd4WO+TtfZcM+fLv43fhLasYZ1ItWFH7fVrAIkhdj7VtWcQzBxGByVRXZOH3mXAVl86RdMomS+Tk5qg==
x-xss-protection: 0

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 52 B
389 B 294ms
293ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=14
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b00ae0b1e4859643ca886a0fe0866c651b1306c55ed4919a6242f413312052a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:08 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:08 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcaee99ca7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/ 429 KB
135 KB 2ms
2ms Script
text/javascript 142.250.66.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f530dc6724889ca2261d21dc7a8a8165e025a77aae89905249de90eee518287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:49:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24575
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138090
x-xss-protection: 0
server: cafe
etag: 14352082441515359041
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:49:33 GMT

GET
H2 200 21589405 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 589ms
180ms Script
application/javascript 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/21589405?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

138385b172e7d1eb9395a96f4f3b25b11e2b240b8827bdfb4dfb246aeaecfa3f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-N0Fg34NT9repBChzs90HfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-N0Fg34NT9repBChzs90HfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsKoxSXF4KwhxXDy1m2mi0B83ukO03UgvqjylOkmENcyPGNqBeIH4c-YXgCxgcZzJgsgZvzzgokTiN99ecnE8fUlkwQQqwHxO8lXTN-AeIePBwvfuumsKkCsuX46ayAQxzyfzpoCxItZZ7CuBmKn9BmsAUD8OXMG628g9qmfwRoFxELcHL3TbqxjE9hwZ2ccADQnRLE"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 _HwBCJENsRe.css
static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/ Frame 2D3C 20 KB
5 KB 325ms
12ms Stylesheet
text/css 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/_HwBCJENsRe.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ce892acc4a9ec24adc13617e250eb3e2f7fb510c4160e02541a0446c1ca5307b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: GtlUS2Ibgwwe9uFxeII9kw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5238
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: y8y7dT8TxYePTky1WK0Ajpa8vQyT0oR5WYRBb9XRLJBkPyHMzqxxp202Z91/KlbBzXCN3cLq4y9kdJzdNDl19w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Mon, 17 Feb 2025 17:54:16 GMT

GET
H2 200 _u9v75tarnE.css
static.xx.fbcdn.net/rsrc.php/v3/y0/l/0,cross/ Frame 2D3C 22 KB
6 KB 317ms
4ms Stylesheet
text/css 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y0/l/0,cross/_u9v75tarnE.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ec88ae1ecf5b870737f876cc1bb7252d45bccf4d5a7fb145e560739e781d2ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: nZ16N27vCVTVcsAGee5+qQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4990
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: zGRFAz3nXK6ObeibvL2rsV2lqIcZW+EcagrFbpzAR0X1ItrNc+0lfDcbUdpyktRNGHXcjp3xVaPeoJQj69xmog==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Tue, 18 Feb 2025 16:58:16 GMT

GET
H2 200 pl4wwh6JXhk.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yM/r/ Frame 2D3C 355 KB
92 KB 319ms
7ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yM/r/pl4wwh6JXhk.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9394712e80c474199fbf33ddb9d55ba623e6d1955a257704348abdf030d5fc86

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: sxsbo63Yp6gjX2GrJPPKLA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 94070
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: ZnWGrCJKruzmaEi5jsggM6hasQgbWJ9KzzvRFKx1ie8qWS2ekzTNXLveVJIsImyOO8V+cJHWGwdIn6d+40c+OA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Thu, 20 Feb 2025 01:30:41 GMT

GET
H2 200 8ZrPme2EwKH.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yc/r/ Frame 2D3C 9 KB
3 KB 317ms
5ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/8ZrPme2EwKH.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2910a75fe798cbb18961bf9510620ee4edbc664b99037f2a9b0b0af70a8d9631

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: JieWsOvZ3RFDEjZePuauxg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2809
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: YefLkysD/47Uuj2bY/Gu8CxTNCjZaeMTvNHUdCMvWzX/0UHCdIiCxy7Wn62+jOvs9gH52AZZ1b2UqSCHO+Pf4w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Fri, 14 Feb 2025 17:04:40 GMT

GET
H2 200 bwGGbcrt4yr.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yq/r/ Frame 2D3C 94 KB
27 KB 324ms
12ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/bwGGbcrt4yr.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7a6b35ec94caa1ef63f0a5da46f537fc4bb0f506d280a8c1c3938f1c22c3fa42

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: ra5w1QOYo2eK+6nuAqPocw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27387
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: iP1v/qiTXeT4iY9fN5CvKy7H+UI2ooGFqvIyhiSuCSQMsne65f5s20w6oXgwIfeTYNu0zSnO9XZAXHhJyHmE4g==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Wed, 19 Feb 2025 20:21:28 GMT

GET
H2 200 1e9HWcC5-kl.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yC/l/en_US/ Frame 2D3C 108 KB
31 KB 318ms
7ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yC/l/en_US/1e9HWcC5-kl.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

79a11d5031efbd4cb7003ca2c2c858b830714d124c8569c292a09563f81e7c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: ADTbibWeORjAvCsc0YapLw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 31443
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: ZDoeahR3RBqz9Q1WnFs4idPjTDEPcBH59VhETetaqGrgN4TNw18AVuyD/3uQteowHgLHscPa0NJDkukN4qD1Aw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Thu, 20 Feb 2025 07:13:35 GMT

GET
H2 200 p55HfXW__mM.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yF/r/ Frame 2D3C 507 B
938 B 317ms
5ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e57fedb96b3686621bccd5521f43a2037a823c74f062176952890b179b3955b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: L5E9gSgR735vyjAzTFly4g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 293
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: a0cIDX6lxKPOwe7voJ0O/VIIu/WJXEQaAdUDSH/FtVXJXeCyz6JQYVl+smeOa8r4r4HsPbnUo8Ht8/HaLWxKLA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), display-capture=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Thu, 13 Feb 2025 19:39:59 GMT

GET
H2 200 421783786_757821279708005_3415763033702776265_n.jpg
scontent-syd2-1.xx.fbcdn.net/v/t39.30808-6/ Frame 2D3C 10 KB
10 KB 314ms
2ms Image
image/jpeg 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-syd2-1.xx.fbcdn.net/v/t39.30808-6/421783786_757821279708005_3415763033702776265_n.jpg?stp=dst-jpg_s228x119&_nc_cat=104&ccb=1-7&_nc_sid=081abc&_nc_ohc=h9In72mmJrYAX8w_2Ou&_nc_ht=scontent-syd2-1.xx&edm=ADwHzz8EAAAA&oh=00_AfCuFqspkZZfpWdPz9rdXK8IrrBhzkfJmOk37AemF516mg&oe=65DA4251
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-syd2.fbcdn.net
Software: /
Resource Hash: 23f9404eaf10042498763f560353d7c6170da3cded8e421046bd55438ae75c85

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Thu, 25 Jan 2024 11:34:21 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2899054492
thrift_fmhk: GBBof5O4giae0I3cQTJ0yKO7FfDr4Z0EvFUAAAA=
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2587537366
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 10024

GET
H2 200 411399018_735508431939290_3822841252990809093_n.jpg
scontent-syd2-1.xx.fbcdn.net/v/t39.30808-1/ Frame 2D3C 2 KB
2 KB 2ms
2ms Image
image/jpeg 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-syd2-1.xx.fbcdn.net/v/t39.30808-1/411399018_735508431939290_3822841252990809093_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=106&ccb=1-7&_nc_sid=4da83f&_nc_ohc=hFvdm8T89jEAX_W03oZ&_nc_ht=scontent-syd2-1.xx&edm=ADwHzz8EAAAA&oh=00_AfAHHU8u42IdGr8VcUaqhWpVfly-U8ePX0v-qXmXeQ5oZg&oe=65DA4C5F
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Fmoney18%2F&tabs&width=220&height=70&small_header=true&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-syd2.fbcdn.net
Software: /
Resource Hash: e58c14ee18b95464982e08b6545dfa1fdf03ff27abb523eeaa62810c214c620a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Tue, 19 Dec 2023 09:14:56 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=40636710
thrift_fmhk: GBAM+T/GnSbMqpZF4rzdYnR+FfDr4Z0EvFUAAAA=
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 339714560
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 1577

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 3 KB
1 KB 286ms
285ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=7
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e6a01e679f58fd1ef17aa31875f3bc6694fc61506b4ac20dc0c6c88f26e8332

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:09 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcb0bb00a7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 titlebar_20221005.jpg
ad6.on.cc/web/html/JPMO-2021_1489/202210/ 6 KB
7 KB 24ms
21ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad6.on.cc/web/html/JPMO-2021_1489/202210/titlebar_20221005.jpg
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 390378de9e4cb233e80a030f7b37a954434b5f4b31cb281179496c07a54e49cd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
cf-cache-status: HIT
x-cacheable: L03
age: 27524
alt-svc: h3=":443"; ma=86400
content-length: 6625
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 05 Oct 2022 09:34:49 GMT
server: cloudflare
etag: "19e1-5ea4649b95c29"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 1050210238 1051408531
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 858fbcb29c2fa7ff-SYD

GET
H3 200 hsicbbc4.png
money18.on.cc/ad/jpad/ 13 KB
13 KB 26ms
23ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad/hsicbbc4.png?20240125
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b6f296261fcf7846a854f7ee81dcfdf055259d24218aaff1535443165d17295

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:09 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 12:31:51 GMT
server: cloudflare
age: 1789
etag: "65d5ed37-3338"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcb29c33a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 13112

GET
H3 200 space.gif
ad6.on.cc/web/html/ 43 B
299 B 30ms
27ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad6.on.cc/web/html/space.gif
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
cf-cache-status: HIT
x-cacheable: L04
age: 27959
alt-svc: h3=":443"; ma=86400
content-length: 43
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 06 Aug 2014 02:46:44 GMT
server: cloudflare
etag: "2b-4ffecfb84ed00"
vary: Accept-Encoding
x-varnish: 68337993 56518584
content-type: image/gif
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 858fbcb29c35a7ff-SYD

GET
H2

200

B23303268.307005129;dc_pre=CIHLktHUvIQDFXGjZgIdjJcDDA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1708526349.0135;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_co...
ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1708526349.0135;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;t...
https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_pre=CIHLktHUvIQDFXGjZgIdjJcDDA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1708526349.0135;dc_lat=;dc_rdid=;t...

42 B
442 B

114ms
113ms

Image
image/gif

142.250.66.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_pre=CIHLktHUvIQDFXGjZgIdjJcDDA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1708526349.0135;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

142.250.66.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:09 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N729509.3041567MONEY18/B23303268.307005129;dc_pre=CIHLktHUvIQDFXGjZgIdjJcDDA;dc_trk_aid=499844697;dc_trk_cid=128886450;ord=1708526349.0135;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
369 B 277ms
274ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=684&campaignid=62&zoneid=7&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=374142bdd1
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
cf-cache-status: MISS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: no-cache
last-modified: Wed, 21 Feb 2024 14:39:09 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 858fbcb29c37a7ff-SYD
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 644 B
707 B 282ms
280ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=9&sw=1600
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d998b4b03e9a7321050c969c726c0bb47c9817a6effb902ea7f1b053b748443

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:09 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcb29c3ea7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 qGoWo6gBwwP.png
static.xx.fbcdn.net/rsrc.php/v3/yy/r/ Frame 2D3C 3 KB
3 KB 304ms
3ms Image
image/png 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/qGoWo6gBwwP.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y0/l/0,cross/_u9v75tarnE.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

66efeaacbd90eba053bda6c0f17599873a6d2023a9408bd9ad2d414cf9813444

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/y0/l/0,cross/_u9v75tarnE.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
x-content-type-options: nosniff
content-md5: iN31dShDArRt9ZikrDb13w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2616
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: IHaTuGx2vnxulDdhJvLWfaLGkGmX2TqTM13qb1V9k0rR7XSeFaRLyp2IjgbwHlizuUrlDfVp3MjcK2aBg/pDUw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Fri, 14 Feb 2025 17:05:39 GMT

GET
H2 200 UXtr_j2Fwe-.png
static.xx.fbcdn.net/rsrc.php/v3/yw/r/ Frame 2D3C 573 B
2 KB 304ms
3ms Image
image/png 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yw/r/UXtr_j2Fwe-.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/_HwBCJENsRe.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/_HwBCJENsRe.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
date: Wed, 21 Feb 2024 14:39:09 GMT
x-content-type-options: nosniff
content-md5: 07aG/2AEtDHVAZ5LUajMDQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 573
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-debug: +eMZBoKO4GtytWIXD/ApAmThWyqNE3S7sukWus9yJuKneYCDAKOlkLxdU1OxT7OpglsnYXhbUNfdycTF3zxYYg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), display-capture=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin: *
expires: Thu, 13 Feb 2025 17:08:07 GMT

POST
H2 204 AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w== Show response
fundingchoicesmessages.google.com/el/ 0
1 KB 804ms
104ms XHR
text/html 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.g85JAEsKBtc.es5.O/am=YA/d=1/rs=AJlcJMxWzVy-rDtjvVt3oHoNyL6-8-ulTg/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-BCGy-7N3sFdsp4nKaamohg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-BCGy-7N3sFdsp4nKaamohg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmJw0pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYQIBbi5uibdmMdm8CEL6-TAS1oFUQ"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://money18.on.cc
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxV9gErM-lnjJkdSUYNUtUfmosNV-pEQFKS4hcd8aQn5vLxJcmuQPX69gkDhSNPfmeK_vw4zuR9N9Yzq9eFHNGI6KkWhqL9AQmFmWsGZaSB_jZX4tPerMGyHQNDyNvrp0e_reLwKug== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 237ms
237ms Script
application/javascript 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV9gErM-lnjJkdSUYNUtUfmosNV-pEQFKS4hcd8aQn5vLxJcmuQPX69gkDhSNPfmeK_vw4zuR9N9Yzq9eFHNGI6KkWhqL9AQmFmWsGZaSB_jZX4tPerMGyHQNDyNvrp0e_reLwKug==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTI2MzQ5LDQ1NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9tb25leTE4Lm9uLmNjLyIsbnVsbCxbWzgsImc4NUpBRXNLQnRjIl0sWzksImVuLUdCIl0sWzcsIjIiXSxbMTEsIltdIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

23594d23eacae9139152f9a44323a3f3f26472e1e3dcc879f53dcbcd09d18352

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-bnyVBS3FYxnrqbVcUktxRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
content-security-policy: script-src 'report-sample' 'nonce-bnyVBS3FYxnrqbVcUktxRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJicNCQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6O3mk31rEJ7Di0ci0TAG8qP84"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
902 B 1036ms
140ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 21 Feb 2024 14:39:10 GMT
x-content-type-options: nosniff
content-encoding: br
age: 32355
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-bfi-kbfi7400067-BFI
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 307ms
297ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e388e19ca38c825b329e762c79c66bbd41bd334f18312c5e97fde0a8f64bca36

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
via: 1.1 google, 1.1 google
last-modified: Mon, 05 Feb 2024 22:07:56 GMT
server: Google Frontend
etag: cd19e0900da0cdbc6697310fd9330fb6
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 84904503bc5bcb9a8b0d0d7318b6d05b
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1195

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 41 KB
13 KB 620ms
130ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

309c794d20c6824c9c401713bc7ba07938e85509e557ddbc944f6fa17e7b7469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 07 Feb 2024 07:37:39 GMT
server: nginx
etag: W/"65c33343-a585"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 22 Feb 2024 14:39:10 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 833 B
801 B 490ms
490ms Fetch
text/plain 142.250.66.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2647609613333048&correlator=2776618838614902&eid=31079957%2C31079527%2C21065724&output=ldjh&gdfp_req=1&vrg=202402150101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=21589405%2Cca-pub-1862194061110379-tag%2C6171032222&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=1&didk=660620739&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1708526349471&lmt=1675393102&adxs=0&adys=950&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fmoney18.on.cc%2F&ref=http%3A%2F%2Fmoney18.on.cc%2F&vis=1&psz=300x-1&msz=300x-1&fws=512&ohw=0&ga_vid=2011605256.1708526349&ga_sid=1708526349&ga_hid=1259507742&ga_fc=false&a3p=EhsKDGxpdmVyYW1wLmNvbRic2ezg3DFIAFICCGQSGQoKcHViY2lkLm9yZxic2ezg3DFIAFICCGQSFwoIcnRiaG91c2UYnNns4NwxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGJzZ7ODcMUgAUgIIZA..&dlt=1708526345980&idt=2683&adks=459110763&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b552c1179a2b566fa0a9ba82ffeeddeddf8868fa5cc05a1e1819b7f48e248e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 411
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://money18.on.cc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FD8F 6 KB
3 KB 507ms
100ms Document
text/html 142.250.67.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.1 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:09 GMT
expires: Thu, 20 Feb 2025 14:39:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
369 B 271ms
270ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=786&campaignid=387&zoneid=9&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=96a3abc7b2
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
cf-cache-status: MISS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: no-cache
last-modified: Wed, 21 Feb 2024 14:39:09 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 858fbcb45d71a7ff-SYD
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 687 B
704 B 286ms
286ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=10&sw=1600
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9de27a85655a253b09d146b2a0fc066ef2aa24af587800b6812ddc36919b6af5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:09 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcb45d72a7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
369 B 267ms
267ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=787&campaignid=387&zoneid=10&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=5ee0db0142
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
cf-cache-status: MISS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: no-cache
last-modified: Wed, 21 Feb 2024 14:39:09 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 858fbcb62e61a7ff-SYD
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 video-m18-new.html Show response
money18.on.cc/ Frame C840 7 KB
3 KB 264ms
263ms Document
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/video-m18-new.html
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91bc6d2ea7af117b9159a71a810e3322bac5f06de8849afef2d62076e33ae2ac

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=5, s-maxage=5
cf-cache-status: REVALIDATED
cf-ray: 858fbcb62e63a7ff-SYD
content-encoding: br
content-type: text/html
date: Wed, 21 Feb 2024 14:39:10 GMT
etag: W/"622085fc-1aa0"
last-modified: Thu, 03 Mar 2022 09:10:20 GMT
referrer-policy: no-referrer-when-downgrade
server: cloudflare
vary: Accept-Encoding

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 664 B
712 B 972ms
972ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=6
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a566da4e5e87c1e3d2575fa16cd0f704a2ea0a7139483cd90d6097b123df7771

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:10 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcb62e62a7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 177 B
451 B 315ms
305ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 3136750b525b593f866daf487e47d9f1ab5b127026ae5b5069daca28ee9b0b9c

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:09 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 0a08ab23da82dbfa013a5a954d86b9fe
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 section-icon.sprite.png
money18.on.cc/img/section/ 20 KB
20 KB 19ms
18ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/section/section-icon.sprite.png?v=vhRW5nR0oOxeVSZyViCWUeHOpRKv9XEkTJMxO
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfd290d5b14fdfbe291f5632095b56cb5101a66752c22df6c5d50b6077638253

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:09 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:25 GMT
server: cloudflare
age: 1787
etag: "5ecbad05-4f6b"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcb63e6ba7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 20331

GET
H3 200 money18.woff
money18.on.cc/fonts/ 1 KB
1 KB 279ms
278ms Font
application/font-woff 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/fonts/money18.woff
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1755c62c1a21c72efe303a5d2722d3ab68f5e678502da6d38297d98c5f777576

Request headers

Referer: https://money18.on.cc/css/style.min.css
Origin: https://money18.on.cc
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 28 Apr 2020 09:26:23 GMT
server: cloudflare
etag: W/"5ea7f6bf-4cc"
vary: Accept-Encoding
content-type: application/font-woff
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcb63e6ca7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 h5player.css
hk.on.cc/module/player/ Frame C840 46 KB
8 KB 22ms
22ms Stylesheet
text/css 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/module/player/h5player.css
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/video-m18-new.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0350eaf35ccdb5e81fd6410f924aa857b491fce3bb1bc48e0935ad2b26a138e9

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y09
age: 13473
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Aug 2021 07:06:41 GMT
server: cloudflare
etag: W/"610a3c81-b706"
vary: Accept-Encoding
content-type: text/css
x-varnish: 199253870 200517607
cache-control: public, max-age=14400
cf-ray: 858fbcb7df5aa7ff-SYD

GET
H2 200 jquery-1.12.1.min.js Show response
code.jquery.com/ Frame C840 95 KB
33 KB 603ms
13ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.12.1.min.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/video-m18-new.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 13724118
x-cache: HIT, HIT
content-length: 33838
x-served-by: cache-lga21947-LGA, cache-bne12528-BNE
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1708526351.645661,VS0,VE0
etag: W/"28feccc0-17c7b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 20, 13780

GET
H3 200 h5player.js Show response
hk.on.cc/module/player/ Frame C840 304 KB
62 KB 25ms
25ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/module/player/h5player.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/video-m18-new.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c3d82e1e57c1133212844ba12c991e95133a2aaa2bf2120afde4cf9d76ea3be

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y10
age: 13436
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 18 Sep 2023 05:30:24 GMT
server: cloudflare
etag: W/"6507e070-4c1ef"
vary: Accept-Encoding
content-type: application/javascript
x-varnish: 98676456 101785694
cache-control: public, max-age=14400
cf-ray: 858fbcb7df5ca7ff-SYD

GET
H2 200 affiliate_show_banner. Show response
fundingchoicesmessages.google.com/f/AGSKWxWztw7D28KzsXwEGNX_MNGeV1ISbUPCxUHyZsjRraAEASxyrl2_lJyIiN5GhS6vnwUUXDMdDr0LiBBdIG2xkj5a-j2MJmU-T0MofpbMwrGmmbVg4MEfOTFzHcvVVA8Cx7NDy_hu3_8_5FkpUQ-RJMfAhUJGs... 54 B
504 B 102ms
101ms Script
application/javascript 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWztw7D28KzsXwEGNX_MNGeV1ISbUPCxUHyZsjRraAEASxyrl2_lJyIiN5GhS6vnwUUXDMdDr0LiBBdIG2xkj5a-j2MJmU-T0MofpbMwrGmmbVg4MEfOTFzHcvVVA8Cx7NDy_hu3_8_5FkpUQ-RJMfAhUJGsSK3TqWfoW3ZSSw6bMf2c2rkvdAKt8GN/_/markpop.js/ad_box2./pubads._728x90v1./affiliate_show_banner.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.g85JAEsKBtc.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwxF-2uAm4u1HDRdnR9QuMLV4Erlg/m=ad_blocking_detection_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a9c46c78f5e5b843599be0696b18772c09bac3f02b880c55802d3d5a3eae1b12

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-wBAQQj1WU0ah7TBxGFZjQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-wBAQQj1WU0ah7TBxGFZjQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJicNaQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6Ovmk31rEJrFhweTUjAHCYP8c"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 85 KB
31 KB 403ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ff9025f16b428475d5a57e133ec69cfdfa2f26f5edc6ac744cb3d2aa8622d18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:25:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 795
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30993
x-xss-protection: 0
server: cafe
etag: 5655574714832874877
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 15:25:55 GMT

POST
H2 204 AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w== Show response
fundingchoicesmessages.google.com/el/ 0
313 B 413ms
413ms XHR
text/html 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_nORb1U-wkkACV2jwRgMjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-security-policy: script-src 'report-sample' 'nonce-_nORb1U-wkkACV2jwRgMjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmLw1pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYQIBbi4eibdmMdm8CEptcHmABDkxU7"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://money18.on.cc
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w== Show response
fundingchoicesmessages.google.com/el/ 0
313 B 466ms
466ms XHR
text/html 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lPTKqHgJ1wwGYg0yJTa_ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-security-policy: script-src 'report-sample' 'nonce-lPTKqHgJ1wwGYg0yJTa_ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmLw1pBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYQIBbi4eibdmMdm8CKKSu6mQFDIRTu"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://money18.on.cc
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 270 KB
76 KB 1159ms
1158ms Fetch
text/plain 142.250.66.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2647609613333048&correlator=4484630696899536&eid=31079957%2C31079527%2C21065724&output=ldjh&gdfp_req=1&vrg=202402150101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=21589405%2Cca-pub-1862194061110379-tag%2C6171032222%2Cweb_interstitial%2C1205252462%2C3098574441%2C5062126862%2CWebm18inreadLREC%2CWebm18inreadLREC2&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6%2C%2F0%2F1%2F7%2C%2F0%2F1%2F8&prev_iu_szs=300x250%2C1x1%2C600x250%7C650x250%7C970x250%7C750x100%7C750x200%7C750x300%7C930x180%7C950x90%7C960x90%7C970x66%7C970x90%7C980x90%7C980x120%7C1000x150%7C728x90%2C300x250%7C300x600%2C300x250%7C300x600%2C300x250%2C300x250&ifi=2&didk=660620739~635480741~2551891067~3983685257~3983685262~1144200171~1144200170&sfv=1-0-40&rcs=1%2C0%2C0%2C0%2C0%2C0%2C0&ists=32&fas=0%2C8%2C0%2C0%2C0%2C0%2C0&eri=1&sc=1&cookie=ID%3D937c3a0b3798ec1a%3AT%3D1708526349%3ART%3D1708526349%3AS%3DALNI_MYPn9VHcEc-yr_QAZ5tGETOv71sgg&gpic=UID%3D00000d0c53bdc6dd%3AT%3D1708526349%3ART%3D1708526349%3AS%3DALNI_MYueXj6gXMz6WQr844iSs5Yy_3apA&abxe=1&dt=1708526350568&lmt=1675393102&adxs=0%2C-9%2C500%2C1000%2C1000%2C-9%2C-9&adys=950%2C-9%2C244%2C252%2C513%2C-9%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C-1%7C0%7C0%7C0%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fmoney18.on.cc%2F&ref=http%3A%2F%2Fmoney18.on.cc%2F&vis=1&psz=300x-1%7C0x-1%7C1000x0%7C300x252%7C300x252%7C0x-1%7C0x-1&msz=300x-1%7C0x-1%7C728x90%7C300x0%7C300x0%7C0x-1%7C0x-1&fws=512%2C2%2C132%2C132%2C132%2C2%2C2&ohw=0%2C0%2C1000%2C767%2C767%2C0%2C0&ga_vid=2011605256.1708526349&ga_sid=1708526349&ga_hid=1259507742&ga_fc=false&a3p=Eh8KDGxpdmVyYW1wLmNvbRIGc2lnbmFsGKnZ7ODcMUgAEhkKCnB1YmNpZC5vcmcYteHs4NwxSABSAghqEpYBCghydGJob3VzZRKAAXJ0aHJSQkpoU2dDSENwOHdTUU16b0hyZ1VBTWh2QXR0T3RORERYR041dWNYL0JvVkJkcEkwM25qNjVSZHBxNjl0MDUyczEzMjIwL3ZHZS9XZEt3WU5na0ZhY3F0M0JnTDlxNVhrUzRzeDN5SXh1ZjB1bEFoa1BweXF0ZmdNRFVuGJne7ODcMUgAEh0KDmVzcC5jcml0ZW8uY29tGJzZ7ODcMUgAUgIIZA..&dlt=1708526345980&idt=2683&adks=459110763%2C2691357424%2C993126795%2C250760903%2C2125769945%2C4048358900%2C3695243195&frm=20&eo_id_str=ID%3D49ce9ef6b5d3c843%3AT%3D1708526349%3ART%3D1708526349%3AS%3DAA-AfjalzPhN0mnsPrxD6EwmFDCN

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dc59ffb3f7962c35bdeb4ae193295672800ef759c36ae57552c3265d5f9ef66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77930
x-xss-protection: 0
google-lineitem-id: -2,-1,-1,-1,-1,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-1,-1,-1,-1,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://money18.on.cc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/ 46 KB
15 KB 3ms
2ms Script
text/javascript 142.250.66.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5677953672cdc5a7bc37981b3a8445f1aa57f79d310a28cbba9fe4f7672fe83e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 19:16:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69739
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15021
x-xss-protection: 0
server: cafe
etag: 2346651094939736056
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 19 Feb 2025 19:16:51 GMT

GET
H2 200 top50_2.xml Show response
datafeed.on.cc/ontv/xml/Group/ Frame C840 6 KB
3 KB 287ms
272ms XHR
text/xml 104.16.170.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://datafeed.on.cc/ontv/xml/Group/top50_2.xml
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.170.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07b9c7b7e1abf64fb74ac0e4db91b943b8a43b7b0965cbeb6d9143892f116c23

Request headers

Accept: application/xml, text/xml, */*; q=0.01
Referer: https://money18.on.cc/video-m18-new.html
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-encoding: br
cf-cache-status: EXPIRED
x-cacheable: L03
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Feb 2024 09:41:19 GMT
server: cloudflare
etag: W/"193f-611e120fe86e9"
vary: Origin, Accept-Encoding
content-type: text/xml
x-varnish: 51314761
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30
cf-ray: 858fbcbbc870a977-SYD
expires: Wed, 21 Feb 2024 14:44:10 GMT

POST
H2 204 AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w== Show response
fundingchoicesmessages.google.com/el/ 0
314 B 260ms
260ms XHR
text/html 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0QGtgEKWewCSl8nfSgtYbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-security-policy: script-src 'report-sample' 'nonce-0QGtgEKWewCSl8nfSgtYbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmJw15BiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYQIBbi4eibdmMdm8CBOwv3MAMARC4VdA"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://money18.on.cc
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w== Show response
fundingchoicesmessages.google.com/el/ 0
313 B 568ms
567ms XHR
text/html 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVNzzwtX5B95pntn0o-ZUyZByg50AKMLgW20MeM2pnR4XvqrB3z6bWAuRevKGu7xx8faoRqJ0rjInvpTuFrbt4CLNgLC-Ff4SWUSEAdeUek5hhT9Dtj1yPKWRirg3nuuc9-n0xE6w==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UOG9oNTyT6YB-UCM4TsWmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-security-policy: script-src 'report-sample' 'nonce-UOG9oNTyT6YB-UCM4TsWmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmLw0ZBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYQIBbi5uifdmMdm8CFy1uKAC_CFUY"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://money18.on.cc
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 AGSKWxWIiufZBxKLlHrU_W8ZmBO0eI1V-Bg4nPDq4D5wz7x4_IDHEbVTB9u7AAIOKV3gAHs2que3Zel8KW_E8cCEBJR6CQrLEkqhtS3anV2cmPqn1M4d3nyWx6koMDzQFURxu9o2p1lW-A== Show response
fundingchoicesmessages.google.com/f/ 8 KB
3 KB 212ms
212ms Script
application/javascript 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWIiufZBxKLlHrU_W8ZmBO0eI1V-Bg4nPDq4D5wz7x4_IDHEbVTB9u7AAIOKV3gAHs2que3Zel8KW_E8cCEBJR6CQrLEkqhtS3anV2cmPqn1M4d3nyWx6koMDzQFURxu9o2p1lW-A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTI2MzUwLDcyMTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vbW9uZXkxOC5vbi5jYy8iLG51bGwsW1s4LCJnODVKQUVzS0J0YyJdLFs5LCJlbi1HQiJdLFs3LCIyIl0sWzExLCJbXSJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e94eee60af6d4587a919bc3ac81e3dfdcbcc286db88429459c443ac87130840a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YC4hgMN7VGGxuhfrKdiyBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:10 GMT
content-security-policy: script-src 'report-sample' 'nonce-YC4hgMN7VGGxuhfrKdiyBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJicNSQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6Ovmk31rEJHLj5bQEzAHEdQDA"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
369 B 293ms
292ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=789&campaignid=387&zoneid=6&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=05028a643a
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: MISS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: no-cache
last-modified: Wed, 21 Feb 2024 14:39:10 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 858fbcbc3ceea7ff-SYD
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 667 B
715 B 282ms
282ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=8
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 665b6c431e3d81b44404ef5cf4f54c292b0145115372b8eb9de5e73027fb94a3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:10 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcbc3cf0a7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 AGSKWxURA2-1fz1ENMdTr8y5A0xcb9xh2PlbEiebfeMvGFm8R1uKRapa7tjAgSQ8UacguWhEipPLbrsnELLzxL2QrFucK9NgM7ob1boFbCzM5AVUpyGDKE2OYNH4D-caDitR-jSDxznQZw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 375ms
375ms Script
application/javascript 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxURA2-1fz1ENMdTr8y5A0xcb9xh2PlbEiebfeMvGFm8R1uKRapa7tjAgSQ8UacguWhEipPLbrsnELLzxL2QrFucK9NgM7ob1boFbCzM5AVUpyGDKE2OYNH4D-caDitR-jSDxznQZw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTI2MzUwLDkzNzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vbW9uZXkxOC5vbi5jYy8iLG51bGwsW1s4LCJnODVKQUVzS0J0YyJdLFs5LCJlbi1HQiJdLFs3LCIyIl0sWzExLCJbXSJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

09e4288c1a4d28bec125556ff796c8d495232ad9065aeafa45872cf5d737068e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-9M06s1al-NNy2tKa1KcaAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-9M06s1al-NNy2tKa1KcaAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjmsKoxSXF4K4hxXDi1m2mC0B83ukO03UgvqjylOkmENcyPGNqBeIH4c-YXgCxgcZzJgsgZvzzgokTiN99ecnE8fUlkwQQqwHxO8lXTN-AeIePBwvfuumsKkCsuX46ayAQxzyfzpoCxItZZ7CuBmKn9BmsAUD8OXMG628g9qmfwRoFxELcHP3TbqxjE9jw9m8tADZbRSk"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 OBZ240221-15294-21-M.xml Show response
tv.on.cc/xml/Metadata/Video/202402/ Frame C840 4 KB
2 KB 323ms
267ms XHR
text/xml 104.16.170.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tv.on.cc/xml/Metadata/Video/202402/OBZ240221-15294-21-M.xml
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.170.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e47ee4df55cf07d53c1e211a3abe3027504aa2fa19bada5e7b44da7cf564da6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-cacheable: L03
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Feb 2024 09:41:19 GMT
server: cloudflare
etag: W/"10f0-611e120feb9b1"
vary: Origin, Accept-Encoding
x-varnish: 47095041
content-type: text/xml
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30
cf-ray: 858fbcbde941a977-SYD
expires: Wed, 21 Feb 2024 14:43:54 GMT

GET
H3 200 lg.php
ad5.on.cc/money18/www/delivery/ 43 B
369 B 272ms
272ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad5.on.cc/money18/www/delivery/lg.php?bannerid=790&campaignid=387&zoneid=8&loc=1&referer=https%3A%2F%2Fmoney18.on.cc%2F&cb=65c9387b68
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: MISS
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: no-cache
last-modified: Wed, 21 Feb 2024 14:39:11 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=0, no-cache
accept-ranges: bytes
cf-ray: 858fbcbe0f72a7ff-SYD
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 ajs.php Show response
ad5.on.cc/money18/www/delivery/ 52 B
391 B 276ms
275ms Script
text/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad5.on.cc/money18/www/delivery/ajs.php?zoneid=5
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/ad/common/skycraper.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1930ec9f317e14708b15be5bcf63f9e4d9c44c98c2a9d8ad48b76289b1a15746

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Feb 2024 14:39:11 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=0, no-cache
cf-ray: 858fbcbe0f73a7ff-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 OBZ240221-15294-21-M_1708507600.js Show response
hk.on.cc/hk/video/segments/ Frame C840 23 B
486 B 270ms
264ms XHR
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/hk/video/segments/OBZ240221-15294-21-M_1708507600.js
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38bef13839fe2969461f7db1b36007b254d12152268dd2fdb302f9b7923148ad

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y10
x-host: webappdocker06
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
server: cloudflare
etag: W/"090ab3bf66440972448b96f1c0218afa6"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
x-varnish: 205425491
cache-control: public, max-age=60, s-maxage=300, stale-if-error=86400, stale-while-revalidate=30
cf-ray: 858fbcbfaee3558d-SYD
access-control-allow-headers: Content-Type

GET
H3 200 hls.js Show response
hk.on.cc/module/player/ Frame C840 235 KB
71 KB 23ms
22ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/module/player/hls.js
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b7a5a4cc369fbf887fc098793578f308d0b3e1f51c6fdb5765e5b433e1dfc89

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y09
age: 12294
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Mar 2021 03:57:55 GMT
server: cloudflare
etag: W/"60596743-3ab62"
vary: Accept-Encoding
content-type: application/javascript
x-varnish: 191459496 200059433
cache-control: public, max-age=14400
cf-ray: 858fbcc14b2ca7ff-SYD

GET
H2 200 hitCount.faces
bknwebapp.on.cc/onccMainWebapp/ Frame C840 0
0 293ms
287ms Image
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bknwebapp.on.cc/onccMainWebapp/hitCount.faces?newsId=OBZ240221-15294-21-M&pubCode=video&psCode=498&mediaType=web&1708526351564
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 200 OBZ240221-15294-21-M.jpg
tv.on.cc/xml/Thumbnail/202402/bigthumbnail/ Frame C840 184 KB
185 KB 274ms
273ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tv.on.cc/xml/Thumbnail/202402/bigthumbnail/OBZ240221-15294-21-M.jpg?t=1708508418
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a131cb55c2b28fc12d4bae03bfc7d7b89532549231b4acb7574493f7338b4de

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: REVALIDATED
x-cacheable: L04
alt-svc: h3=":443"; ma=86400
content-length: 188705
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 09:41:19 GMT
server: cloudflare
etag: "2e121-611e1210319ac"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-varnish: 142959312
cache-control: public, max-age=5, s-maxage=5, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcc14b2da7ff-SYD
expires: Wed, 21 Feb 2024 14:44:11 GMT

GET
H2 200 AGSKWxVpSycqaKn1z15fVIDy8v8ut17FJD8peS1MvGFbZ1Zq9spzQ-6W3mT987MEepaVD11P4na1RgmBx5QoWE04FKpUaRQwKxF-SkpubzJuVH19F2BYX-_e-j2auQg8AoCKue4XOIWJxw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 140ms
140ms Script
application/javascript 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVpSycqaKn1z15fVIDy8v8ut17FJD8peS1MvGFbZ1Zq9spzQ-6W3mT987MEepaVD11P4na1RgmBx5QoWE04FKpUaRQwKxF-SkpubzJuVH19F2BYX-_e-j2auQg8AoCKue4XOIWJxw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA4NTI2MzUxLDU2OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9tb25leTE4Lm9uLmNjLyIsbnVsbCxbWzgsImc4NUpBRXNLQnRjIl0sWzksImVuLUdCIl0sWzcsIjIiXSxbMTEsIltdIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1d2bf29e1233e688b73ee77ceb0a17ee28b002f1235bcccf9e8adf2c7a9ed168

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-M2m-zD4mO8NZw0uRjhLlbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-M2m-zD4mO8NZw0uRjhLlbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzj6mHU4pJicNKQYjjvdIfpOhBfVHnKdBOIaxmeMbUC8YPwZ0wvgNhA4zmTBRAz_nnBxAnE7768ZOL4-pJJAojVgPid5Cumb0C8w8eDhW_ddFYVINZcP501EIhjnk9nTQHixawzWFcDsVP6DNYAIP6cOYP1NxD71M9gjQJiIR6O_mk31rEJPPixdxsTAHJaQE0"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 toTop.png
money18.on.cc/img/ 1 KB
2 KB 43ms
43ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/toTop.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f1cf4fb54da85f6d90d28175e926fd279441e33b404493ef4f29b7eaddb0d5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:10 GMT
server: cloudflare
age: 2600
etag: "5ecbacf6-5bd"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcc15b4ca7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1469

GET
H3 200 index.js Show response
money18.on.cc/js/app/ 60 KB
13 KB 280ms
280ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/app/index.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 93e25f3308bc703ae3a5566fdf0f08df4a71bfe86c0ba9520b67727443140830

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Tue, 10 Jan 2023 03:47:16 GMT
server: cloudflare
etag: W/"63bcdfc4-f1ca"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc16b69a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 templates_helpers.js Show response
money18.on.cc/lib/ 851 B
533 B 20ms
19ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/templates_helpers.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95e34e916c953c9a1ebdd15260d3ae24d37550ea65e8735d40eb973c3c8b80ec

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 03 Sep 2020 04:13:13 GMT
server: cloudflare
age: 2600
etag: W/"5f506d59-353"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc16b71a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 index.js Show response
money18.on.cc/modules/desktop_compenents/header/ 40 KB
9 KB 269ms
268ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/header/index.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a9f5ee2dc0660a6063970d6a4fdd95425a75c62914718821bdb27148058092e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 01 Jan 2024 01:55:49 GMT
server: cloudflare
etag: W/"65921ba5-a1ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc16b74a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 unicorp_v4.js Show response
on.cc/adv/web/corp/source/ 123 KB
32 KB 21ms
20ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05853f08839fd8c26aa0243ad1be32bc35a42ef8696aa4decc371d8b6af9ebc6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L07
age: 1788
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 15 Dec 2023 05:26:28 GMT
server: cloudflare
etag: W/"657be384-1ea81"
vary: Accept-Encoding
x-varnish: 150668542 102306015
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 858fbcc16b77a7ff-SYD

GET
H3 200 urchin.js Show response
money18.on.cc/lib/ 18 KB
6 KB 24ms
23ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/urchin.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab229322552892c8734d333a6b52b479f3d9cf7c8a1fc9cf2d8bd6ba3420284b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
age: 2600
etag: W/"5ec4efb0-4661"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc16b79a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 urchin-lib.js Show response
money18.on.cc/lib/ 9 KB
3 KB 18ms
17ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/urchin-lib.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76a1ffaa9a177acc8e6ad0fe8f7e89a76f765e0c5f88ff2438248d983b9201d8

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 03:50:17 GMT
server: cloudflare
age: 2600
etag: W/"5e86b279-25d1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc16b7ba7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 function.js Show response
money18.on.cc/js/ 39 KB
11 KB 275ms
274ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/function.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdc7df4064ff4e70ba6b50694cf3674afd2fca208d3d78aeefd4742b640387c1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Thu, 10 Dec 2020 04:23:50 GMT
server: cloudflare
etag: W/"5fd1a2d6-9c4b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc16b7ea7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 OBZ240221-15294-21-M.m3u8 Show response
video-cdn.on.cc/Video/202402/ Frame C840 226 B
398 B 137ms
27ms XHR
application/vnd.apple.mpegurl 104.16.170.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M.m3u8?t=1708508418
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.170.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6e1955f8517f110eb7861390bc7ce8fecd1dd28c988bf4bbbd3b33324020900

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:35 GMT
server: cloudflare
age: 17707
etag: W/"65d5c3e7-e2"
vary: Accept-Encoding
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=2592000
cf-ray: 858fbcc23eeea977-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 yahoo_keywords.js Show response
on.cc/adv/web/corp/js/ 4 KB
883 B 20ms
20ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/js/yahoo_keywords.js
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79c369802018b75882ec40d4896c33c99ff78227d8ccce93357fc8167b32d386

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 10912
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 09 Mar 2011 04:11:26 GMT
server: cloudflare
etag: W/"4d76fdee-1198"
vary: Accept-Encoding
x-varnish: 121563225 150357200
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 858fbcc19bc7a7ff-SYD

GET
H3 200 unicorp_disclaimer.js Show response
on.cc/adv/web/corp/source/ 4 KB
1 KB 20ms
19ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_disclaimer.js
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ddefc841780227c51caba3a14c2e05c0d342b3ede01cd448f79341d4b221f7a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 2196
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 24 Oct 2023 02:36:55 GMT
server: cloudflare
etag: W/"65372dc7-eec"
vary: Accept-Encoding
x-varnish: 146590466 149262324
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 858fbcc1abc8a7ff-SYD

GET
H3 200 unicorp_v4.css
on.cc/adv/web/corp/source/ 7 KB
2 KB 17ms
17ms Stylesheet
text/css 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_v4.css?v=31
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cdfc421265602e0a9c952b7c9e7ee8f58cfbdfb27b0d3649b818ecbb24f8908

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 1537
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 27 May 2020 01:59:01 GMT
server: cloudflare
etag: W/"5ecdc965-1de5"
vary: Accept-Encoding
x-varnish: 146791013 151892510
content-type: text/css
cache-control: public, max-age=3600
cf-ray: 858fbcc1abc9a7ff-SYD

GET
H3 200 unicorp_v4_hk.css
on.cc/adv/web/corp/source/ 13 KB
3 KB 27ms
26ms Stylesheet
text/css 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 777b7600d3a06697ee88b073cb2a29470562821cb5a92cd9773d61cb757f6bb8

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 2353
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 19 Sep 2023 02:51:05 GMT
server: cloudflare
etag: W/"65090c99-346a"
vary: Accept-Encoding
x-varnish: 150443651 2173407
content-type: text/css
cache-control: public, max-age=3600
cf-ray: 858fbcc1abcba7ff-SYD

GET
H2 200 checkrev.gif
home.on.cc/adv/web/corp/img/ 43 B
246 B 21ms
15ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://home.on.cc/adv/web/corp/img/checkrev.gif
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 273
alt-svc: h3=":443"; ma=86400
content-length: 43
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 20 Oct 2008 03:57:30 GMT
server: cloudflare
etag: "48fc01aa-2b"
vary: Accept-Encoding
content-type: image/gif
x-varnish: 1081349 950275
cache-control: max-age=600
accept-ranges: bytes
cf-ray: 858fbcc1b82c5c0c-SYD

GET
H3 200 text.js Show response
money18.on.cc/lib/es5/ 16 KB
5 KB 22ms
21ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/es5/text.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c31bc55a5c70471e6307c73fcf5f764764eaf79778511ced360b5db2617ed4f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
age: 2599
etag: W/"5ec4efb0-3f83"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc1bbf7a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 es5-sham.min.js Show response
money18.on.cc/lib/es5/ 6 KB
2 KB 24ms
23ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/es5/es5-sham.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0524344056b41aeb573d5d500659ba65af1bf8aadb6c1b7dbb5e5c151b72f14

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
age: 2600
etag: W/"5ec4efb0-1610"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc1bbf8a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 es5-shim.min.js Show response
money18.on.cc/lib/es5/ 25 KB
9 KB 38ms
37ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/es5/es5-shim.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f733dab20a413c25abbc4c1daad7b4abcf3249e108e26e2e079c8d8099b80d3a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
age: 2600
etag: W/"5ec4efb0-6340"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc1bbfaa7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 json3.min.js Show response
money18.on.cc/lib/json3/ 8 KB
4 KB 19ms
18ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/json3/json3.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c3e64ef84e5290feef3e6e6943c4618cd3b609995b6d7bde6e898b06bbf5d5a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:01 GMT
server: cloudflare
age: 2600
etag: W/"5ec4efb1-1fd1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc1bbfba7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 unicorp_disclaimer.css
hk.on.cc/adv/web/corp/source/ 1 KB
738 B 17ms
16ms Stylesheet
text/css 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/adv/web/corp/source/unicorp_disclaimer.css
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_disclaimer.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a89c5d02602316b77d7d50cb7b8a168c10d707994d6f2aba75788365896bf5ed

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y10
age: 2195
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 06 Aug 2018 06:48:01 GMT
server: cloudflare
etag: W/"5b67ef21-5ab"
vary: Accept-Encoding
content-type: text/css
x-varnish: 948972997
cache-control: public, max-age=3600
cf-ray: 858fbcc1cc19a7ff-SYD

GET
H3 200 ic_arrow_hkhk_off.gif
on.cc/img/v2/ 1 KB
1 KB 19ms
18ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/img/v2/ic_arrow_hkhk_off.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b4a8698e5c880ff6090a1c0cd2558e42b26c5a1bdf6cb08b9d8f2d78077fdd8

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 20501
alt-svc: h3=":443"; ma=86400
content-length: 1172
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Nov 2013 03:59:55 GMT
server: cloudflare
etag: "5275ca3b-494"
vary: Accept-Encoding
content-type: image/gif
x-varnish: 41037152 150703309
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1ec29a7ff-SYD

GET
H3 200 web_menu_m18.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 28ms
20ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_menu_m18.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10a1c3546508a4f60041203cd2de027ba35189ccac7bcc4701c98ac6595bc434

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 2799
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-aef"
vary: Accept-Encoding
content-type: image/png
x-varnish: 149155728 26331984
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc2ca7ff-SYD

GET
H3 200 web_menu_m18_over.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 32ms
23ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_menu_m18_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b75455f6bc681b8ccf92a51442f1ac2c91fbfe1c813837a9650e975b3456913

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 2832
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-b10"
vary: Accept-Encoding
content-type: image/png
x-varnish: 151302607 149001968
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc2da7ff-SYD

GET
H3 200 web_ball_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 24ms
16ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2139db140b042be2a5bafd65fa757f0eb3cf3e0f97c6a8eec957052530b03d77

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 2168
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-878"
vary: Accept-Encoding
content-type: image/png
x-varnish: 141804237 149131683
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc2ea7ff-SYD

GET
H3 200 web_ball_over.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 43ms
34ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eef61507e5ba153c053a683aefc1e14a84044b401e846c5736572094dd2fe5c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 2175
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-87f"
vary: Accept-Encoding
content-type: image/png
x-varnish: 141804235 152568365
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc2fa7ff-SYD

GET
H3 200 web_ball_off_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 28ms
19ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_off_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5587ca41f509ea115a518336f6ac6e376379a25fda215b58c4921f84040f0f39

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 2124
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-84c"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150443665 147139855
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc30a7ff-SYD

GET
H3 200 web_ball_over_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 30ms
22ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_ball_over_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9de0c8978e69302a3aa776ff407769b18f57ffa7d8122c2da9ef747f93cd43cc

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 2138
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-85a"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150668520 150357194
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc31a7ff-SYD

GET
H3 200 web_horse_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 25ms
17ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: deebccefdbb9e3846fb52bdeb875696fa33b4fcafb00d83ac8f89631084df26b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 1953
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-7a1"
vary: Accept-Encoding
content-type: image/png
x-varnish: 100915590 147139852
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc32a7ff-SYD

GET
H3 200 web_horse_over.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 25ms
17ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e26801b344d9fb191aa53ea743d2d8b5f4888cebac66ce1128f63078aa53f750

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 1952
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-7a0"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150668518 102306006
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc33a7ff-SYD

GET
H3 200 web_horse_off_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 27ms
19ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_off_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9c56677f5e4bf4db2d10b3e4251337f9c954733c8b35b24f6861cf634ae42a9

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 1856
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-740"
vary: Accept-Encoding
content-type: image/png
x-varnish: 41037136 149262337
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc34a7ff-SYD

GET
H3 200 web_horse_over_sc.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 28ms
19ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_horse_over_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9613f7645c91aacd5d5027d72140f3ffcb148eb265aeee3b529303e28f8bd03

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 1861
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-745"
vary: Accept-Encoding
content-type: image/png
x-varnish: 41037138 149262340
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc35a7ff-SYD

GET
H3 200 web_net_off.png
on.cc/adv/web/corp/img/ 2 KB
3 KB 31ms
23ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_net_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce61748ce893b3ec7b81cd022f4a9ed673ab4c118f5cff9a4c72a2160d04b496

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 20501
alt-svc: h3=":443"; ma=86400
content-length: 2343
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-927"
vary: Accept-Encoding
content-type: image/png
x-varnish: 149089331 148826197
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc36a7ff-SYD

GET
H3 200 web_net_over.png
on.cc/adv/web/corp/img/ 2 KB
3 KB 34ms
27ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/web_net_over.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 176b6e30b48ace76fce19e261ac688bde72e2defab631d9c2fafea242c559714

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 2352
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-930"
vary: Accept-Encoding
content-type: image/png
x-varnish: 121563227 150668446
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc37a7ff-SYD

GET
H3 200 logo_TC_on.gif
on.cc/adv/web/corp/img/ 12 KB
12 KB 40ms
33ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_TC_on.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5124d27328c2f5c4b2a560fe2ad40a2ece04ed9f465f354fa35b741c124fd466

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 11875
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:52:01 GMT
server: cloudflare
etag: "5fa8caf1-2e63"
vary: Accept-Encoding
content-type: image/gif
x-varnish: 151892607 149131670
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc38a7ff-SYD

GET
H3 200 logo_SC_on.gif
on.cc/adv/web/corp/img/ 12 KB
12 KB 24ms
17ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_SC_on.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a12c17ab23790461e677329f9dac5efb0ce19a38fcece15f785ff7f42423cc26

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 11974
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:52:00 GMT
server: cloudflare
etag: "5fa8caf0-2ec6"
vary: Accept-Encoding
content-type: image/gif
x-varnish: 147318937 149001971
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc39a7ff-SYD

GET
H3 200 logo_TC_off.png
on.cc/adv/web/corp/img/ 28 KB
28 KB 40ms
34ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_TC_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2ba400a3542c7f986dd240f2def70cc8d021912a6376e6da574c28630a67b3b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 28481
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:51:59 GMT
server: cloudflare
etag: "5fa8caef-6f41"
vary: Accept-Encoding
content-type: image/png
x-varnish: 100915588 147139836
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc3aa7ff-SYD

GET
H3 200 logo_SC_off.png
on.cc/adv/web/corp/img/ 27 KB
27 KB 32ms
26ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_SC_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1de66009eea3c9f435d5bea771a3717b0c9dc7abc9418e9357442c1afec63117

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 27615
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 09 Nov 2020 04:52:05 GMT
server: cloudflare
etag: "5fa8caf5-6bdf"
vary: Accept-Encoding
content-type: image/png
x-varnish: 145150473 150703312
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc3ba7ff-SYD

GET
H3 200 logo_net_off.png
on.cc/adv/web/corp/img/ 3 KB
3 KB 25ms
19ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_net_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ab6ed9795e2f7e4f657148a92d36798a27dd29ab2d4e992fbce352de9a2e42b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 3057
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-bf1"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150443647 100915514
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc3da7ff-SYD

GET
H3 200 logo_net_on.png
on.cc/adv/web/corp/img/ 4 KB
4 KB 29ms
23ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/logo_net_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2120ebbbe270d6417b8d272c6450d10ef0d94235287b3eb2e2c8a52de73cb17e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 4259
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 02 Feb 2021 03:35:56 GMT
server: cloudflare
etag: "6018c89c-10a3"
vary: Accept-Encoding
content-type: image/png
x-varnish: 100915592 102306009
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc3ea7ff-SYD

GET
H3 200 net_icon_off.png
on.cc/adv/web/corp/img/ 4 KB
4 KB 31ms
25ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/net_icon_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e91e1f5f9ab1b71b71686baf06d7a1661f89786df2019f315b2d3b8d1186f61

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 20501
alt-svc: h3=":443"; ma=86400
content-length: 3802
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jun 2020 06:39:24 GMT
server: cloudflare
etag: "5ed9e89c-eda"
vary: Accept-Encoding
content-type: image/png
x-varnish: 147139949 100915531
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc3fa7ff-SYD

GET
H3 200 net_icon_on.png
on.cc/adv/web/corp/img/ 3 KB
4 KB 34ms
28ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/net_icon_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2c044e8e8af87330e2c1c28479713e3107e8b9fe79b3a881bcb247902531db1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 3377
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 05 Jun 2020 06:39:24 GMT
server: cloudflare
etag: "5ed9e89c-d31"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150915168 151953837
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc40a7ff-SYD

GET
H3 200 test_off.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 27ms
21ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/test_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af2d583999658b96ba5bc7d5cf834ca654a8930d5937c8f4830ee9c7e6fac5ed

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 1421
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-58d"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150443643 147139841
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc41a7ff-SYD

GET
H3 200 test_on.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 34ms
28ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/test_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc5e0245a9f89d144afabfb55c88f190a4153ad8c3baa67e340a2a7715a64940

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 1370
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-55a"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150443645 102305998
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc42a7ff-SYD

GET
H3 200 dot_off.png
on.cc/adv/web/corp/img/ 1 KB
1 KB 44ms
38ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/dot_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c660dec6cd5e8f9e0b3c518da51439c7a47a1b28da85193926a06b005f0905b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 1029
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-405"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150915166 141804204
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc43a7ff-SYD

GET
H3 200 dot_on.png
on.cc/adv/web/corp/img/ 1 KB
1 KB 47ms
41ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/dot_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45f029b0dec12e864c693266265b33e968158edb8ae5761c09013c8069544c2d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 24082
alt-svc: h3=":443"; ma=86400
content-length: 1025
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:47:55 GMT
server: cloudflare
etag: "5e6ae64b-401"
vary: Accept-Encoding
content-type: image/png
x-varnish: 147139951 147139844
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc44a7ff-SYD

GET
H3 200 health_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 27ms
21ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/health_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b5514e397dfa4b681f07408e843b186c8e40f0c429e6b956154ac2c385aac34

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 20501
alt-svc: h3=":443"; ma=86400
content-length: 1546
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:35 GMT
server: cloudflare
etag: "5e6ae727-60a"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150703403 150668435
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc45a7ff-SYD

GET
H3 200 health_on.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 31ms
26ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/health_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e32b017a5bc36cfd7104924ee59da3e015206b7be6132b36f5951b0e7775c4c6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 1455
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:35 GMT
server: cloudflare
etag: "5e6ae727-5af"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150703405 100915520
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc46a7ff-SYD

GET
H3 200 sport_off.png
on.cc/adv/web/corp/img/ 2 KB
2 KB 28ms
23ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/sport_off.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48deef5a4537b8c2d3bbc1c4cf8b5133ec55fade9fb3ab81bbe36bb4f7cc3f73

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 20501
alt-svc: h3=":443"; ma=86400
content-length: 1608
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:36 GMT
server: cloudflare
etag: "5e6ae728-648"
vary: Accept-Encoding
content-type: image/png
x-varnish: 100915583 102306001
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc47a7ff-SYD

GET
H3 200 sport_on.png
on.cc/adv/web/corp/img/ 1 KB
2 KB 31ms
26ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/sport_on.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f6a761102c6ab539f8c8886b76f6c4f92a49955a4bc5fec019a0e741638cac3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 1806
alt-svc: h3=":443"; ma=86400
content-length: 1497
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 13 Mar 2020 01:51:36 GMT
server: cloudflare
etag: "5e6ae728-5d9"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150703401 26331978
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc48a7ff-SYD

GET
H3 200 oncc_web_icon_683_tc.png
on.cc/adv/web/corp/img/ 17 KB
17 KB 35ms
30ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/oncc_web_icon_683_tc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2906b4bb918191ec99bb72967904aa285513563d9370432284a96f9de95d333b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 17068
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 19 Sep 2023 02:58:05 GMT
server: cloudflare
etag: "65090e3d-42ac"
vary: Accept-Encoding
content-type: image/png
x-varnish: 150703409 100915523
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc49a7ff-SYD

GET
H3 200 oncc_web_icon_683_tc.gif
on.cc/adv/web/corp/img/ 11 KB
12 KB 33ms
28ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/oncc_web_icon_683_tc.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 629f21270cb4040f455dfefcce445f78a2fd7bc3889e3f006488b167c33d70ec

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 11560
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 19 Sep 2023 02:58:06 GMT
server: cloudflare
etag: "65090e3e-2d28"
vary: Accept-Encoding
content-type: image/gif
x-varnish: 115535360 150357189
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc4aa7ff-SYD

GET
H3 200 oncc_web_icon_683_sc.png
on.cc/adv/web/corp/img/ 16 KB
17 KB 34ms
29ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/oncc_web_icon_683_sc.png
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a345dec29ede03562dec28291b4b8ae91271f4f34d1598ec2d0d04da72b04b43

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 16818
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 19 Sep 2023 02:58:05 GMT
server: cloudflare
etag: "65090e3d-41b2"
vary: Accept-Encoding
content-type: image/png
x-varnish: 41037140 26331981
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc4ba7ff-SYD

GET
H3 200 oncc_web_icon_683_sc.gif
on.cc/adv/web/corp/img/ 11 KB
11 KB 28ms
23ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/adv/web/corp/img/oncc_web_icon_683_sc.gif
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f1e50fa8ba0387bad94110fc1dbdbb5d1e9f1543a5f1fc99f2733e1c00b7b44

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://on.cc/adv/web/corp/source/unicorp_v4_hk.css?v=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: L08
accept-language: bytes
age: 6745
alt-svc: h3=":443"; ma=86400
content-length: 11283
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 19 Sep 2023 02:58:05 GMT
server: cloudflare
etag: "65090e3d-2c13"
vary: Accept-Encoding
content-type: image/gif
x-varnish: 151302605 152601097
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc1fc4da7ff-SYD

GET
H2 200 14019 Show response
check.analytics.rlcdn.com/check/ 25 B
385 B 376ms
260ms Fetch
application/json 13.35.147.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://check.analytics.rlcdn.com/check/14019
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.147.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-147-78.syd1.r.cloudfront.net
Software: /
Resource Hash: 8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
via: 1.1 55995d846c30878fb2be24f27b355ccc.cloudfront.net (CloudFront)
x-amz-cf-pop: SYD1-C1
x-amzn-trace-id: Root=1-65d60b0f-4452a59734564d850bea41e1
x-amzn-requestid: bfabb569-7449-4030-addd-93a513f3be90
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: TfaqiGA6DoEEQ5A=
content-length: 25
x-amz-cf-id: SR6Lm7168svmjZjC7bzldaCXCaFZzFXFLAGGOYVMa5gISsGD69s3Nw==

GET
H3 200 template-web.js Show response
money18.on.cc/lib/art_template_lib/ 34 KB
8 KB 25ms
25ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/lib/art_template_lib/template-web.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 875cd855e4eeee833011223fd7acf1d6910b50a8821e1cd426ff3eb79c320ec9

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 May 2020 08:52:00 GMT
server: cloudflare
age: 2599
etag: W/"5ec4efb0-881d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=3600
cf-ray: 858fbcc1fc4fa7ff-SYD
alt-svc: h3=":443"; ma=86400

POST
H2 204 AGSKWxX7OtLNf379VKfFMp4YJNvZeCg4oRzzkzbtUlsT0Z-rKAI_AyiZNy-DrseX2dUSNcHWqEAysRmS3bfyK_5PVmHgEgTGtFDNUF3goIY_cTVCVEHghNZrwz_L_ktboLd4sg3Zbnbh_A== Show response
fundingchoicesmessages.google.com/el/ 0
314 B 102ms
102ms XHR
text/html 172.217.167.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX7OtLNf379VKfFMp4YJNvZeCg4oRzzkzbtUlsT0Z-rKAI_AyiZNy-DrseX2dUSNcHWqEAysRmS3bfyK_5PVmHgEgTGtFDNUF3goIY_cTVCVEHghNZrwz_L_ktboLd4sg3Zbnbh_A==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NAJAm2F17Lr85uWOV-ij1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NAJAm2F17Lr85uWOV-ij1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tHikmJw1JBiqGV4xtQKxIx_XjBxAvE7yVdM34B4h48Hi1P6DNYQIBbi4eifdmMdm8CKPaffMgEAQtwVkQ"
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://money18.on.cc
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 OBZ240221-15294-21-M_ipad.m3u8 Show response
video-cdn.on.cc/Video/202402/ Frame C840 826 B
486 B 26ms
26ms XHR
application/vnd.apple.mpegurl 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_ipad.m3u8?20240221173534
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 041722f0c15ab71c6fd77b7a192f776f305f303d0ef657b8bac7d9cf3468c79b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:35 GMT
server: cloudflare
age: 17706
etag: W/"65d5c3e7-33a"
vary: Accept-Encoding
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=2592000
cf-ray: 858fbcc2685e558d-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 m18_playicon.png
hk.on.cc/img/v2/ Frame C840 2 KB
2 KB 17ms
17ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/img/v2/m18_playicon.png
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7cf6749a7db1997d259a6f1921dc8cec500780a7584f1e47d3cb165aecd3d102

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://hk.on.cc/module/player/h5player.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 14968
alt-svc: h3=":443"; ma=86400
content-length: 2176
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Jul 2019 06:35:19 GMT
server: cloudflare
etag: "5d37fc27-880"
vary: Accept-Encoding
content-type: image/png
x-varnish: 102634395 961363498
cache-control: public, max-age=28800
accept-ranges: bytes
cf-ray: 858fbcc27cb7a7ff-SYD

GET
H3 404 OBZ240221-15294-21-M.js Show response
hk.on.cc/hk/videoAdv/ Frame C840 0
336 B 263ms
263ms XHR
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/hk/videoAdv/OBZ240221-15294-21-M.js
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
x-cacheable: Y09
server: cloudflare
etag: "641c2851-0"
vary: Accept-Encoding
x-varnish: 300708961 323298476
access-control-allow-origin: *
content-type: text/html
cache-control: public, max-age=120, s-maxage=30
cf-ray: 858fbcc2787a558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 404 OBZ240221-15294-21-M.js Show response
hk.on.cc/hk/videoAdv/ Frame C840 0
337 B 271ms
271ms XHR
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/hk/videoAdv/OBZ240221-15294-21-M.js
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/h5player.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
x-cacheable: Y09
server: cloudflare
etag: "641c2851-0"
vary: Accept-Encoding
x-varnish: 300708961 323298476
access-control-allow-origin: *
content-type: text/html
cache-control: public, max-age=120, s-maxage=30
cf-ray: 858fbcc2787b558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 OBZ240221-15294-21-M_ipad000.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 525 KB
525 KB 28ms
28ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_ipad000.ts?20240221173534
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06777319d889a9eaeb93a5caafddf8652ef4dadd65632b10a019cc4ed12b4a58

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:35 GMT
server: cloudflare
age: 17705
etag: "65d5c3e7-83394"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc2989a558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 537492

GET
BLOB 200
OK 639422bf-5e9d-483f-ae3e-43d6739e8edb
https://money18.on.cc/ Frame C840 61 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://money18.on.cc/639422bf-5e9d-483f-ae3e-43d6739e8edb
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d825cf02f25f38879ac6f09a7eccf1a2b7c6322b50b742d469c8f83976ba5f97

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Length: 62028
Content-Type: text/javascript

GET
H3 200 OBZ240221-15294-21-M_hd.m3u8 Show response
video-cdn.on.cc/Video/202402/ Frame C840 804 B
486 B 26ms
26ms XHR
application/vnd.apple.mpegurl 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd.m3u8?20240221173534
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1cadf7e0cbb3b6dd09b25dc37d730b302d608ffce06b5f64a1b148320dbfea1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17703
etag: W/"65d5c3de-324"
vary: Accept-Encoding
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=2592000
cf-ray: 858fbcc2f8c7558d-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 sitemap.js Show response
money18.on.cc/modules/sitemap/ 19 KB
5 KB 296ms
294ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/sitemap/sitemap.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 880432090e731532e45d1f693d455d7298228c8430666c96c4b4469be15100b0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 09:02:57 GMT
server: cloudflare
etag: W/"62c2acc1-4caf"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32d9ea7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 portfolio.js Show response
money18.on.cc/modules/portfolio/ 19 KB
6 KB 266ms
264ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/portfolio/portfolio.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b8424c63e300834ade3944e4ccd88112e4513b8d61d80fe9e936ca960faf40f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 19 Feb 2024 04:40:15 GMT
server: cloudflare
etag: W/"65d2dbaf-4bf4"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32da1a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 stock.js Show response
money18.on.cc/modules/stock/ 26 KB
6 KB 267ms
266ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/stock/stock.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33d14e4313ca1450f896ae0ce28587c553b632ec2497ae69909cd251474d437d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Tue, 28 Jul 2020 07:08:11 GMT
server: cloudflare
etag: W/"5f1fcedb-687d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32daba7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 index.js Show response
money18.on.cc/modules/AdvBox/ 13 KB
3 KB 277ms
274ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/AdvBox/index.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d522f2c60b3af717664ff274992e22a17ee66d65a4311d882ad21216c4610cbf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 29 Dec 2021 03:08:17 GMT
server: cloudflare
etag: W/"61cbd121-32df"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32db0a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 section.js Show response
money18.on.cc/modules/desktop_compenents/ 8 KB
2 KB 266ms
263ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/section.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 050e08e56b6538663051acd5630c68b38cfd57ffb2266bd9658c887c4e897484

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 27 May 2020 10:16:54 GMT
server: cloudflare
etag: W/"5ece3e16-203b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32db1a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 news-entries.js Show response
money18.on.cc/modules/desktop_compenents/ 4 KB
2 KB 277ms
275ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/news-entries.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59dc1db7c86f610a3bcb9a5fdbd869c18456673d70f59ff9ac23971eaaa2d104

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: EXPIRED
last-modified: Fri, 05 Jun 2020 08:37:14 GMT
server: cloudflare
etag: W/"5eda043a-1172"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32db2a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 technical_status.js Show response
money18.on.cc/modules/technical_status/ 8 KB
2 KB 275ms
273ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/technical_status/technical_status.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d24c071024e74a458c209bfd4e85f699582769c0f011bc41d4e3d791a348bae7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 09 Nov 2020 08:24:49 GMT
server: cloudflare
etag: W/"5fa8fcd1-2037"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32db3a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 transaction.js Show response
money18.on.cc/modules/desktop_compenents/ 29 KB
7 KB 274ms
272ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/transaction.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48cab58b276592a1d7abe874a59184e79ed3eee6308754b7d01fc1b465e13b6c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Mon, 01 Jan 2024 01:55:37 GMT
server: cloudflare
etag: W/"65921b99-7570"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32db4a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 slider.swiper.min.js Show response
hk.on.cc/js/v4/ 71 KB
19 KB 19ms
18ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/js/v4/slider.swiper.min.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e9f51bb07dbcb82846933a187635db37b42c271c5902b05c14a31be3b7622d4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y09
age: 25514
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 26 Aug 2019 02:51:26 GMT
server: cloudflare
etag: W/"5d63492e-11a68"
vary: Accept-Encoding
content-type: application/javascript
x-varnish: 194045058 199642721
cache-control: public, max-age=28800
cf-ray: 858fbcc32db5a7ff-SYD

GET
H3 200 chart.js Show response
money18.on.cc/modules/chart/ 136 KB
29 KB 268ms
267ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/chart/chart.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d229eb7179d8b005aa7b8fb7291cb5d4cad8bb8cd2fb7009068861bede18dde

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Thu, 04 Jan 2024 08:38:04 GMT
server: cloudflare
etag: W/"65966e6c-220f8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc32db7a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 OBZ240221-15294-21-M_hd001.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 822 KB
823 KB 20ms
19ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd001.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78ab7d61756ea41a329386b888a69997d495084f0dfbe75eafd6e9f9e8653947

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:11 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17277
etag: "65d5c3de-cd888"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc328e1558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 841864

GET
H2 200 container.html Show response
7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C202 6 KB
3 KB 4ms
2ms Document
text/html 142.250.67.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.1 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:09 GMT
expires: Thu, 20 Feb 2025 14:39:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 95BF 6 KB
3 KB 7ms
3ms Document
text/html 142.250.67.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.1 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:09 GMT
expires: Thu, 20 Feb 2025 14:39:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 74D3 6 KB
3 KB 3ms
2ms Document
text/html 142.250.67.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.1 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:09 GMT
expires: Thu, 20 Feb 2025 14:39:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2205 6 KB
3 KB 3ms
2ms Document
text/html 142.250.67.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.1 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f10.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:09 GMT
expires: Thu, 20 Feb 2025 14:39:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame C202 5 KB
1 KB 449ms
96ms Stylesheet
text/css 142.251.221.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.74 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 21 Feb 2024 13:00:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 21 Feb 2024 14:39:12 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 20FE 14 KB
1 KB 437ms
96ms Stylesheet
text/css 142.251.221.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.74 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f10.1e100.net

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 21 Feb 2024 13:41:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 21 Feb 2024 14:39:12 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 20FE 2 KB
903 B 428ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:42:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25030
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:42:02 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 20FE 23 KB
9 KB 426ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite_fy2021.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 16:59:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Mar 2024 16:59:34 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4BA4 143 B
383 B 415ms
0ms Document
text/html 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 575
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:29:37 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 20FE 3 KB
1 KB 424ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/window_focus_fy2021.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:55:09 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AEE7 1 KB
758 B 5ms
4ms Document
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 30053
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 06:18:19 GMT
etag: 48472445140208031
expires: Thu, 22 Feb 2024 06:18:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 20FE 20 KB
8 KB 410ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 20FE 0
0 552ms
132ms Image
text/html 142.250.67.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR06I5y9OWBUkF1_ys20ettt0Zw50F0ZbGGlSm_Y614XT3f4vquDCrT04n7fuCu9KQK8th47mxLGtKXi0f5cZuQ8Y0Emg
Requested by: Host: money18.on.cc
URL: http://money18.on.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.67.4 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd15s16-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 20FE 204 KB
62 KB 4ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

hkg07s23-in-f35.1e100.net

Software

cafe /

Resource Hash

48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:42:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62854
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:42:12 GMT

GET
H2 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame 20FE 36 KB
15 KB 417ms
0ms Script
text/javascript 172.217.24.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.24.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 04:24:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36855
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Tue, 20 Feb 2024 22:48:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 21 May 2024 04:24:57 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame C202 22 KB
9 KB 410ms
2ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

hkg07s23-in-f35.1e100.net

Software

cafe /

Resource Hash

716b2a35acfc8e6a247c9e4d9e3c32dc2354b3a8a6e6481835a64b783a5ba4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 08:27:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9141
x-xss-protection: 0
server: cafe
etag: 6041988417631582345
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 08:27:35 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame C202 205 B
651 B 410ms
0ms Image
image/png 172.217.24.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.24.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 19:22:13 GMT
x-content-type-options: nosniff
age: 155819
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 18 Feb 2025 19:22:13 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame C202 604 B
696 B 410ms
0ms Image
image/png 172.217.24.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.24.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

hkg07s23-in-f35.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 16:29:25 GMT
x-content-type-options: nosniff
age: 166187
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 18 Feb 2025 16:29:25 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0D76 645 B
297 B 557ms
138ms Document
text/html 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBELnvJhiikJ-IAjAB&v=APEucNW1TRHR3k5vd3UlzQwMHhTwKr5-decw0amfYVTWotlwgDvPrKWPPPHzglJbKQlADtwpwRsSbj9NXLhIr4lEnByx0T5dmgrGL414ecWiABgz7-0HWKw

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 95BF 93 KB
33 KB 154ms
150ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:12 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95BF 42 B
173 B 141ms
138ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A3IJx7DqBEyawarEo-7EWTowbn4_L6OLFAlrD2ftn77QejXkwb1u84bNXIY6FL0WjPioX1eUZhGGYAeHrt9LB3lUDKotA_ueJaWRvuau6L5h8MnNU

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 95BF 3 KB
1 KB 415ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/window_focus_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:55:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 95BF 20 KB
8 KB 403ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 95BF 0
0 541ms
130ms Image
text/html 142.250.67.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSV3xT2LBZ0Jmdm3Bhgy5nLIxfPWsI7Af9BDkFm4u3spKmZal1iWqqZppkaAzJD39sgc7zHzpJG3rYabUOe01iD8jfdkg
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.67.4 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd15s16-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 95BF 204 KB
61 KB 3ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:42:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62854
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:42:12 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 42D5 668 B
313 B 688ms
274ms Document
text/html 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNXI_vBF902ZVsvi245KGMxor9EQTo_7zZlUiHcHYIVex9y_l0P3tN9K-Muc3XqeO6Tb2dWzj0Kbv08p8mTLlFLkgU-dT7ecq8JaSl0hUpKAsDLO5Do

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 246
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 74D3 93 KB
33 KB 294ms
287ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:12 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74D3 42 B
107 B 145ms
138ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dx_UzF6uzV23aRWQFHc1swO2Ydkf0wPNjP6CLd5vm1ibaj9k2qqs-zuUUpjjNhXKrXPCJgfSBNeSz-NmDjun72MxihtuY6PO0vDj8zIkYNrcNhjPs

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 74D3 18 KB
8 KB 262ms
3ms Script
text/javascript 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 21 Feb 2024 14:54:12 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 74D3 3 KB
1 KB 409ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/window_focus_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:55:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 74D3 20 KB
8 KB 397ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 74D3 0
0 537ms
131ms Image
text/html 142.250.67.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSkDdI6pYPHpJFSq2LZFyHIIQA5NZO2Y71cDe3yohdYmIrAMsMUcqziMzReOZsADkuWCEV3k4cQfij1LoqZSW4U_q1nZw
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.67.4 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd15s16-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 74D3 204 KB
61 KB 6ms
1ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:42:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62854
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:42:12 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9366 645 B
435 B 548ms
137ms Document
text/html 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNU2eaTWxi37BZXMlwSsKdk34EzEjHdoCzbahxc7lBsqS4fC0-mz91ZIOIceTljgVOgts2FHp2FSfw0eUlClfZycOS5tXyeFjCoDKUcVNzBhkEaHbqs

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2205 93 KB
33 KB 289ms
286ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:12 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2205 42 B
107 B 142ms
138ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DWOOts7ADodFet9qxlnKge4HzlNaYAsay5Pzo2LSa9D-hKlNmdZAtui8zN9l355fT7JO--oXkgzI5qjiCaAprpHz2gdOTBhxD4ySCx9hOG2hCYTZ0

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 2205 18 KB
8 KB 257ms
2ms Script
text/javascript 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 21 Feb 2024 14:54:12 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 2205 3 KB
1 KB 407ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/window_focus_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:55:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/ Frame 2205 20 KB
8 KB 395ms
0ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240215/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2205 0
0 533ms
130ms Image
text/html 142.250.67.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQuFEoRBNJDfy15lYczmtAsvd3MghQF8GYOEs9dlVXoNyVX4fQ7cg0vElwAPKJz6tgWGmR_fTaa8rryhYhCn1LMz-YvVA
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.67.4 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd15s16-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2205 204 KB
61 KB 5ms
3ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48639bd7695fc270e23859d9b74231f49bc78f05e3a96ed0332a9b0b80d8c2e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 13:42:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62854
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:42:12 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame AEE7
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESECT42wvWQ8e-xd3m2w0oa5k&google_cver=1&google_push=AXcoOmRdG_DUZPo_1tn5l72QsmJoYuDX3PoFVe-3AZVIq_eI2NXqOcwLd_OYRd2-7rEdpK3HCEkJ9ugZgnF4991ieyuB5ZkvvzQ_M...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDQyODU1MTE4ODY5MDQ4MTI4MQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECT42wvWQ8e-xd3m2w0oa5k&google_cver=1

43 B
398 B

1039ms
205ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECT42wvWQ8e-xd3m2w0oa5k&google_cver=1
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECT42wvWQ8e-xd3m2w0oa5k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame AEE7
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIsKoyYBogKzeHkj5VoMotE&google_cver=1&google_push=AXcoOmR21lTdDveM2RnmP4kB2s8rTWamIF1S_TXnxxNzdf2Rz7ursU436VfyXDn9NENEjM9dGcA9mvn-LWrVvND1AO...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEIsKoyYBogKzeHkj5VoMotE&google_cver=1&google_push=AXcoOmR21lTdDveM2RnmP4kB2s8rTWamIF1S_TXnxxNzdf2Rz7ursU436VfyXDn9NENEjM9dGcA9mvn-LWrVvND1AO...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjYyN2ZlOWMtNTNjYy00NDA5LWJmYWQtOTMzNzhlY2Y0YzYy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f627fe9c-53cc-4409-bfad-93378ecf4c62

170 B
329 B

183ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjYyN2ZlOWMtNTNjYy00NDA5LWJmYWQtOTMzNzhlY2Y0YzYy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f627fe9c-53cc-4409-bfad-93378ecf4c62

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZjYyN2ZlOWMtNTNjYy00NDA5LWJmYWQtOTMzNzhlY2Y0YzYy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=f627fe9c-53cc-4409-bfad-93378ecf4c62
date: Wed, 21 Feb 2024 14:39:12 GMT
server: Kestrel
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE7
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESECHgSEkfKEZi_nsJW0_EeBk&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MTMwOTIyYzktZjRjMC00MDk4LWEzNTgtZDRmZDc3MTc0Yjgy&google_gid=CAESECHgSEkfKEZi_nsJW0_EeBk&google_cver=1&google_push=AXcoOmSS...

170 B
188 B

103ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MTMwOTIyYzktZjRjMC00MDk4LWEzNTgtZDRmZDc3MTc0Yjgy&google_gid=CAESECHgSEkfKEZi_nsJW0_EeBk&google_cver=1&google_push=AXcoOmSS-sVLmRtiWFzYfcwkFXThIzI4BTZknp73S1VYITgE3LuZrztPOO0atl-rLfizXntJCdcl8F4U6xjPPNHirEtXRLMAY97b7uxadk8TUdZ8P4VKiTnfO0OMplk4s47SUrh7NPj60sg3sNNvYeBjJ2c

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MTMwOTIyYzktZjRjMC00MDk4LWEzNTgtZDRmZDc3MTc0Yjgy&google_gid=CAESECHgSEkfKEZi_nsJW0_EeBk&google_cver=1&google_push=AXcoOmSS-sVLmRtiWFzYfcwkFXThIzI4BTZknp73S1VYITgE3LuZrztPOO0atl-rLfizXntJCdcl8F4U6xjPPNHirEtXRLMAY97b7uxadk8TUdZ8P4VKiTnfO0OMplk4s47SUrh7NPj60sg3sNNvYeBjJ2c
date: Wed, 21 Feb 2024 14:39:12 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
200 asr
aid.send.microad.jp/g/ Frame AEE7 43 B
641 B 870ms
288ms Image
image/gif 202.233.84.1
MICROAD MicroAd

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aid.send.microad.jp/g/asr?google_gid=CAESEAuryjfDja27wDpBr3PIxTs&google_cver=1&google_push=AXcoOmTVSu5Mm2iqRmsSa9bDIA4LxLpPfqhMouCWc2E618r4cmZG0vaUXiiRHLgQ9ZyAjwHaDKJWwOW9lNw-7uhpU-bUIbqDPv_wrsMJ0czsTJDZ2pPRk4I4_9a9yU58QMksjtoQY7uPV31PzkAes5Jbdw

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

202.233.84.1 , Japan, ASN131957 (MICROAD MicroAd, Inc., JP),

Reverse DNS

Software

Apache /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 21 Feb 2024 14:39:12 GMT
Strict-Transport-Security: max-age=3600
Server: Apache
P3P: policyref="http://www.microad.jp/w3c/p3p.xml",CP="NOI DSP COR NID DEVo PSAo OUR STP STA PRE"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Connection: close
Access-Control-Allow-Headers: origin, x-requested-with, If-Modified-Since, content-type, Pragma, Cache-Control
Content-Length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE7
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESED525huJuhJTjWwtEDMATgI&google_cver=1&google_push=AXcoOmQHY7miOZERA0CGDUt1J3MswXHVZGRaKy9v3Nqfa6EGztktOJNK49yoSePwbkagZhEO80wZW8iM-KSKV8rI4d801ip4PaT...
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQHY7miOZERA0CGDUt1J3MswXHVZGRaKy9v3Nqfa6EGztktOJNK49yoSePwbkagZhEO80wZW8iM-KSKV8rI4d801ip4PaT5Op9RXdu1R3ai4nMEPQ53WcivKTp2l7i...

170 B
188 B

103ms
101ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQHY7miOZERA0CGDUt1J3MswXHVZGRaKy9v3Nqfa6EGztktOJNK49yoSePwbkagZhEO80wZW8iM-KSKV8rI4d801ip4PaT5Op9RXdu1R3ai4nMEPQ53WcivKTp2l7if2IuwEHzErpz30PIRgXJ9an0&google_hm=Vl9yX0FpaXR0VWlkb1A2aXlScUk=

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQHY7miOZERA0CGDUt1J3MswXHVZGRaKy9v3Nqfa6EGztktOJNK49yoSePwbkagZhEO80wZW8iM-KSKV8rI4d801ip4PaT5Op9RXdu1R3ai4nMEPQ53WcivKTp2l7if2IuwEHzErpz30PIRgXJ9an0&google_hm=Vl9yX0FpaXR0VWlkb1A2aXlScUk=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cm
cm.creativecdn.com/adx/ Frame AEE7
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1&google_push=AXcoOmRkoaKa5JVUPF-yKZ8AefpVXspqM2wiWVFbJoXzJEol3B1QvFxAM4ZqWCIaCrgWMZWuGTpTvhAi8H8qHnSzs...
https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1&google_push=AXcoOmRkoaKa5JVUPF-yKZ8AefpVXspqM2wiWVFbJoXzJEol3B1QvFxAM4ZqWCIaCrgWMZWuGTpTvhAi8H8qHnSzs...
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=nIpDRHVgeAr2rw0SeImtaVK-IzU1MDR2VkyiNRuWCs8&pi=adx&pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1...
https://cm.creativecdn.com/adx/cm?v=2&pi=adx&pi=adxab&tc=1&google_error=5

42 B
260 B

526ms
93ms

Image
image/gif

103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.creativecdn.com/adx/cm?v=2&pi=adx&pi=adxab&tc=1&google_error=5
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H2
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT, Wed, 21 Feb 2024 14:39:13 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 42
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.creativecdn.com/adx/cm?v=2&pi=adx&pi=adxab&tc=1&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 286
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pub
cs.chocolateplatform.com/ Frame AEE7 0
134 B 594ms
197ms Image
text/plain 159.203.145.121
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEGTPjSF79AKBe1In_aYeV9I&google_cver=1&google_push=AXcoOmSkofJgHIlikDYe3uAw3p1TPY3DD2gXBDVLhGhabMf7p7iXifo-Qo_nbvw-5ljANNMPoyG5AASC1PmJXsypRy9DsmhmbN47ApJyeXapYcLm-lZ4T_PeD_n4gLiooLUqTdcIY39kp5EKc3WpcY2TJhY
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.145.121 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: CookieSync Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 21 Feb 2024 14:39:12 GMT
server: CookieSync Server
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame AEE7 0
139 B 201ms
99ms Image
text/html 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LgmIScG_wjvsqG1jgtzCRt2puW8k1Lf7FdDj4JWwPik74nUH8_nUXUiOPGBmP0v8BRBd-2

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 OBZ240221-15294-21-M_hd002.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 866 KB
866 KB 20ms
20ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd002.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7e984381cae09642e222dd825f13c0fb9b5b861d0f15c02510a901e21577509

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17703
etag: "65d5c3de-d8750"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc4a98b558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 886608

GET
H3 200 threadLoader.js Show response
money18.on.cc/modules/desktop_compenents/ 589 B
439 B 274ms
273ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/threadLoader.js?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/require.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f8103aab209fec222afaaacb2f3542ab5417dd40e9f9fecafc16d6acfd3b504

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 27 May 2020 03:20:40 GMT
server: cloudflare
etag: W/"5ecddc88-24d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc4dfc3a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 expired_stock.js Show response
money18.on.cc/js/ 463 B
418 B 272ms
271ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/expired_stock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b06bb1dd73b3e923650dece0534c8cff3dd54d035d7ff643aaa68cc5e3bcfc14

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Thu, 08 Feb 2024 06:40:22 GMT
server: cloudflare
etag: W/"65c47756-1cf"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc4efc7a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 OBZ240221-15294-21-M_hd003.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 864 KB
864 KB 23ms
23ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd003.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d46a31d783789a53f754c23c69ba27b356017066c88854d7280ed25441cedb51

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17701
etag: "65d5c3de-d7f3c"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc4f9b1558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 884540

GET
H3 200 OBZ240221-15294-21-M_hd004.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 859 KB
860 KB 21ms
21ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd004.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79ef7dcc06b9d7de0e3a682ddd8fbc96a5943f8325be0acca9f60947168f18af

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17700
etag: "65d5c3de-d6d9c"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc539d4558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 880028

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95BF 0
58 B 137ms
137ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=592937586103&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95BF 0
56 B 138ms
138ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=592937586103&version=m202401290101&ct=76&x=1&cor=17993345040343450000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 95BF 80 KB
37 KB 832ms
632ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DXwqvdr5uL1RclxTqYAtYgjJUun2W7QtDrSgW_gIQHtYHwjP9ufI3_vsrdzVHgb8-e-cXHV5sRHf69jMmfp-HHZ_C0J09HoJaYiwAgsTLJQlZ3Mka1TNDqRWpuG_jWZVhZQMkLpnwGtQz-NYjGqsXOfNxhCSG9tuzk0DMVwOTjW3d-Zj5cpgucC3XQVS85fuA0Cxrg04uOuoqfLOFD_UJN1qvEXQ&dbm_d=AKAmf-CxwgK6XIpD4blcB9H6K13ypY1VmcDMGSrRL4E6VAy-oaecKRzE4mj7UEgN0ooVadxFYcfTyLBfZmS5ntVwNERiw4tAWmGtfqgdwK00cPmPmOMsMBXfNFRraOzwQo3ulr9phFlf3XDs0o72r3T4rus0ce6H_SEVGQ0Elsf9uvpDJemslMIGmAcW9D3tUqGNj5WwYX5fMWI4uSuPE2oOzbnKZ4pu_ucs_3OtRoK7rv77Ez3VPDu9FhMNJx4Zbf1xdcBmq4Ma71tfL6Xbm-8UDJ4YEYljbxebtSf_pz_bNKChL2vNlKCf0FWVIk1pL0Pq57jqnAEFNtjfy35w89kQUWPrO7IpxcPUOJqcWzn5IiPwSDLMrv8RvneDh2CteY0I5u51pcyFdYX5U6rnvjXqnYEk8SZ_3TceDLFJs32hRVcDOA_IYqu4txlyDKym3p09vXCi96eLXzuJaPf4oxMc3vskUNrVriJE7L0vqBSEhRtx_4-o1BkUdtgYYHkvHkp-660wdIeMs1EPE_UL8J9K1rwKfZ_t9DBcJoUd9EPyus20Nbj6d3AVghhlVBgIB-RRYN4bynBwwqSVaV9fk1LOal9LNoSk4rCdwtCNoseaXqcC79NaUfjnQk8oqP-_-j8uDpodIAPXxJ-l3s33xT6XwK7KArp575KGWGPCa9QRULosYjLfLfGXbfXo0mv7_uvRHVAKyx7-pEla69yAGydN8AbFxinFBX_mZonflmDrOk4Y8zH4wlNZ6_SZVbIopQDKdOMUEltgpXlzbmQpmPa_-4nKPXDRYaKjvHVw6PPV8X2SC6fVuUKnhHKYxSJZvOVFMDtDLEZiuU7jkjGh493XfBzDp26ThayirWM9RhVAfqD9pplgJ-FykvdIHUY-ljtLYnR83zS_9CCyiZgabFFnD_zeTaiNpwiOsk8etk0vWW-QkQrOKdv8kGX5SH9YxtudAv-V57aG87MEhGqOl9rfTjL7dxfxJXCgaDGdQyAvLNsl7PJhO-FE2E87rrqvAJ0bqd4fhqRxpjo1EWwEwyUpNSTaXB3coVwO5Ea2ZbJ26I4Ab0zAEkofi4KZ0mrBwmhW21-bpx9ASFeVactmTDOdUn3_PmClhbI-FeenyEok4GDbOU2PQmzNI2G1QtZEQlfpY_GOyybHvaQG8QoNdaFSxrCHkFHHi1comz75cUUTZNbjCrzTmsQVVdOrqt3sQHML5GPAgMWZHbN6cqWpczk9xsz-sRhn_PxgSJjRh90rpFbNHPul_FUZUkZkIck5Tz18dexhRYBtnRNK0QLisMVmdmuaCGLNVmBim2EPb7IckvV4aLRHhJTCqBNyIDaBhvVHAPJ6vwQxm3aIDZkn6zwlDW2KoTl49BTHLzmZXLgvdFT6vV96C9uMdd_YPnYNPRishyU-QJFvNbOT8SvHe6QkfMuK4INSbgMEos4OICtxzj3B9q4rIFFcYSd31YzbUMFbFBUZXvaE60p0opRKuEH5_8Tv-f0ZETK7Z6oAhH7MSNol0gUp7iokhkQ2zBhF7jjtfWbZzwfAoFzULAm2glwKONNH-TDyxKF4PGEro4js6gnHbJMOupdOG4T2CDueSqANSdFLC_Xe5y65MKmJHT_RlsYAQg8QL4a8t-i2M20LpolZYPc38PMANbg9Me9G0MT6eXfAgqhrsomgSbep5pwtaenUSIdevlVeuH-D9_jYGMO3UDAskfAb-JxCEV3j2UM_cP-P5oM64kAUP1GZ8weIKYyrfYzwnlI0UEXjxm87UUILskxnGyd-4WPhoBDEF4G728rSEX43qaVGP6WLNRA3RO-LO3bD4liXqykiyfqdDu3rPgkloZH7TxxzRfXq1uibCCS9sduhq8sgDvlATtHdALWBfbVnJqzoxiH8YL45H0uf9EiRD3wlEAsIg3WI33DEs8qJRqAvzbihMudfD1ZKnJ5pTut8gQr2S3n415kItI3gBWct2NC0ewkjkrrVOwwNfh_jIioV4WzA4wmdrIN9x3wrAS6oGASIUrGWlXPHKeR2Xdxu4z8BO7T47tU1SKt5wOcu34cxCgQ_UhNyoWB92DzVmHl0I3Mx51mO_CnTrCWwWH2X1k05w05QkUinK69iyC8kDOWMFZCiUV4GI3d04QK5txLKrZEOuaUO4ochjxOo1WUdN4JNUVGX22keF49xtkYg5H-adI-XijUJliUQ3ZXtSwusD4RKH7SySFK78qr4z-n5FiXjs3z0eCOJ-laK_lFeEv36oQv1rSIa9A_uxF92Jvj4It3pmxyV0Lg7D9_JsDojsIl3ECmeMaiKvuKreX4I4Fh_izHnDdxNZMZkTXeYAybq5o6fWc0goC8fGzc5K31jFi933-KZ470pJQm91R5X5MYjGukcvlLMaAfYVC4rEpM8YhhG3O7i-gyTaQsRDpWnBnyMRNXh2PSOqBoSJ6KTlKbjjG-cs_1yd8qesxbVeTXXxSd5Jz7uiqNenScMNxjdqbhsNfGQVt2FmKnirwp0vLdJllW7Es1ECqm6BDV7BGqIQzQU42A5qWHtz0RechphaUBJdhrFd3IQ67lOWhRQ3VEP6SkBK-klibU50xl6dhrVCD1offVUUtIhTvIXjp677Ae5cERdoeHno5IC8ih4--nMig__vpmxlXkdpEVWVzAbQMjPizONNu1w0wRXT-RQlno_QG3IuD_ppjTJ7JD0z3BavIV7fpg7Xg-R-HsxsviLF01fDFjLTi5dcsrnOtsXf32k94c47vKYcX4VcVEMujJ7EtTwxPNbqjcc1VrN9RHo6CDOPtdIudYO7kI1H5c8Da7McjKU0GcE0zAsldfiBDYuJFM-Cwu_XvU0ErBKNXBoyt69h3cZTI7kFYNg_NX8yzQehFLRhUB-5LWtnoDxydRNSM9jelkfEyiwZ5fMupFduYqWMFDH8L223HezmFLR8DbJC8WFixDcNjexsP0I8n91Qu9g3iNADjuZhGsktOOQcioLfzNQhJ1RDdh__MFTG36EX73ZFoxexIwXYvegyIhToFPtYo4NcnIIt1vX7cWtfRE1qEyI9WAjIKEMuzZmqSkRYns89-Q2lUhmA8_fh6lLRQJuhpgV8cEhIruWcTtG8YbSTk9IUIbVO8dZbY7VCx46PQKvKGfUNxinaNMDfKaRC8gcTrGzpzVGQsp3Z6G67b_ZoSoyHpM8Xq-ZH1o7xELvCREosnDeBXaLP4EhPrTLPyMc2P4usoMLsEJWiAifNc-nR6g0yykLMND0KQUrWDFurWhsYHkk6I3XYTPeO5AM_MI4DU28AQUW9ZlvVgFNUG5hSreFP7R5JadVTAklYHsTX2JqFIAyCOG8kP1tXtnhNX5bmkamesX-f3FW_hakKBvvCAVeugX_nZ1J3Zw2U3_ZBojx2OFQJrVkJ-6r_7c-GZTT6hDt40iSmALHC0F4HWbB5w-rQrXxbroeCnH8SnXqLWXbnvxX72Xw-0FNz7Suai3VfRCyMZImQaC2ozp7ZsYzbig3-h2wDlWoE-OhGvJg87-Ty-8oFTz53JfYJiqSG6oTmbNXZ6hN27ajRLQRC13Q_aR09evhDDSTP4d8qbLEJjMKrbKY6f0KnxaQjztKRz8MWVmeVVHgXZ8C_-fOYVC23BB-tW6E5UxZyAfPYJPGQUBPsLbL022SBh6SISUN4namoSMY1b7fzORvQ54L97PbkERZPvBdl_cCEs9oLC0&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmoney18.on.cc%2F&ds=l&xdt=1&iif=1&cor=17993345040343450000&adk=943508964&idt=174&cac=0&dtd=30

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0400d220ccf8ce5166e02a91820d8c86aed6d032fdaa4b79850587a5dc5be7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37952
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 OBZ240221-15294-21-M_hd005.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 869 KB
869 KB 22ms
21ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd005.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12c86e4e39e4c13f6cedab599b00fd9f727c0a231bfd7fa3504f82da503f7705

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17698
etag: "65d5c3de-d9254"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc5ea21558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 889428

GET
H3 200 OBZ240221-15294-21-M_hd006.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 870 KB
870 KB 25ms
25ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd006.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 52da0b9ffc50a04fb2c61b4cab54947e7b2107e316ab8e4f914d90c814189181

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17696
etag: "65d5c3de-d9600"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc63aae558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 890368

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74D3 0
56 B 135ms
135ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1286548217109&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74D3 0
56 B 138ms
137ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1286548217109&version=m202401290101&ct=77&x=1&cor=123522637713810340

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 74D3 35 KB
20 KB 703ms
625ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CJPUasuaCJpmLnyDEQU8KGvHZKWDMbaxdxjx3AZRJWBjYVCj1ksT3vChIOI-rjPigG9o9_dXeyV-S11jvuXcXESM6agbqJD4zgHLhL3IjVTRHHRe9QBsIdahOzfMVOx1KDHpgX5ySwTP2kJc_xNWhEK9twDrUsoToun0ctj2X9smCVScBjxsqaM-RUBxLFtrHRGi2FHSP2WJsJm9RJo7BG62Vo9g&cry=1&dbm_d=AKAmf-DF7rNIfwNPXAA_SeB54lhlg_qUuF57PpG-IS-LXIbD--28IQQ87mHjGW0icRGzvPwukA0sWHWUnqFDtYcoEbu5dZ6Uqlr41qPjTnMU6kgHo2mqHkp7ebobVgkA9cVyaZE1EP3PdaZaVIgUEalleSZsff8xzyFdZnaSqZWaLgKrMfR30bJN4W1bUD9FWww9Qj4etlX2XWn0mQR8foCZJ7eFUuSg2Jq8p8f0BMveOAWWDDVf8iZGufdrjx80A3YKfpJayIa_P5DLPqcRyAoWAK8cMY4AwG6LDQPyFwlVAhUJcyPSbu8yD7KEFUgPpJsWHop355zkdJjcZCISfCdB2gNoPE7zS7ZdKcWWwRnbhjm_uf4-4gW0DA-yKQZiHNK6hXPLlT6YeeVI6W5BFHvJ7z5E5XQPiqUPeMclUCFJ_P31FT_y1GwdRCDoOtvV6mzhWKi63A3mgtJH2vIQwH9y8ljQ3XiwoohOlI9T0UzFHKEOnTrL7hhjkPFuASFIPneXy22xI_59yTK5jaV8yQxmHWOrQOzfZ2jBjjyc-rbZUXVczlym-F-oWw9ShLC57gjy9YJzFLIUzjGf1lx3BDC_X6bf0Gk9Ux-b4SBcWI1y6odzUWQMMhpb7Qv6lJwjTYMdGu_gITtzQA0AZtGEg_Tv85tEilIgX8n4APiynm0oDRHwSjai1AP2YMXAU-er3qpFJmS-Xikw29PoDreRrSE26tsjoacYTxGWUML3qkLe9zMp1MvzwfqjHm5TB3ATsHVHQA6mEgMnBcyLH2p03ZDa3KoLuAwM7QitwIinJbDDOk3XSxRChhgySqswFLbOYxANRKVvdwgJElscQF9RTFJUo6uYyLar8uK3BMM2S4bc3cAymBPewz8QUlCKLJ1wxidBXgxd8AZE3BGJHCGmq94qlfrA5MgRNigCz8ABQCpbukMibRlMysyYfAf0GNo09-1o-P8lzjPtguNWAnkZ6QBIZuap9Qs-8eRoY-r0SexawW5CsruaxYPt2wDTAYyuRNnuMXyHM4fmE5qCn4vBoZ-xwYXVOUEVfFflvKALfBSg7uCs67mZUnn5gRQc1xLh7P9Ea6SUdm2Xl4kraBI0QN406-F57CB4GXtZqL6N7UDXNDLXbSv1jk2RrdT7J2pncEd7S08WVz0AvBSy10reh84Fsm-dIwAOacgxuRzF8t2MPWXKpcnwuhVCJbJaPW80xbShrMOEReJwR2Fgw-Pm8qW7KA4FyTrn-Y5zqAicY6bLCFHAZdkc6usQkaPWVx0xCkdXMZxctIY3DyTxguuNuM0Ww1XjnmNtmAo9WJueJM8-hRWyyK4QLMyLQ_zXrRtE6w11809xNbrWiAbmJDMQZS2IuoQiDSgHSH-qYbSwPEqarBeNZ5knYT52tM3BEXyKaNoAVUq_JF4DZ0tMfkRQ0d5ui8ER8zUcMXwkwdq597TDX1SHEjW5lxFnC3bKA4hCD04yL1T1DwIHbbaYogvO84JgUOsEIJYzTzcg37zZbUZO9M8fSktNsYWiOW5cwSLVKSWCEZt_sLHSbkfqQzXJkk5SxSAVc86QtV0_ZY-RrGpsYp9Lmhh_g5Qd8BTJg9gXQHEBAQr8lZupXFPR0R5lYmtIXHlCQf8RnsT5i0ACbZdb7Szq9DhH93fCULp1262FK2CsRTFqBoGFSt1nkuX-gM79vu6subcdya-tT0qATutSPSF-VvSyEa9Bp6gGDq93cwX0ReKkB7aXJV7c667_5EdKEwNsr9PkAn9pa881amyOoIfUhOfOG6dw6F1rC3y4WH2jWxy9WcwcrPnG2jm27fdgvHUNJ6to8Q1q6gYyfg2EkXG1FWb9JFwznbkDjrABLbNVakAOognleolMlzFJQPH683r1QinPbW6PgzPF6y0UkNELAGRnSzBuiKPxBzZjD4-tusnHfgYHB6rn2p6aOelELEmPtUU1Ar9-S4dWd-3WEQDw2WeHlq46KLop7ESUHe5Fo9RfATIA6sGQeg7clvHO3QB_6cZrl2gQepV8z3xZZe8TQwqQesYlatiGZrMFHYdT8UMOVg_IfECTrGJFoM4p2q0CVXusJP6sra49kk6V_jTu-LHSdqSLwSOjEirh-eAZx650bFzbm2boZoBe1uICT2MX9XYx-IbUybJM-MJzxu2etKpMDRg2M0wxx2r7W57fGvHeifjXYKsb-2KexJ9IA4bM_S6lCUsc6y_eSrtqzVCJVVwBPTMVoZYUoxpZQToH7VwWrrcvVRtqzgXsKsFzASW4AdcQmCpOXjmzeKea4wACCqT2riHbRNm2vCxYAS97d1bpZQCRjp8sY9yiNLIIJ-RwXvO-qlNjtex7V9Tf6BnaWsrKdGqm8f4kpgvsI6RrG7MC6KQ8KUsRELnkKrhAp1L2VbjMbdVvke6lfVTi4cm5S5QGjAx1Z4VeugoL5Nh54KbIQVg66VAJSRPWyqVGiK5z-TI-_6j6gWzeTxixz3Y9gEHPfSzPFAwFFP_HilyWSHnvu1wvUIYoAASBn2ZVoF-UxN5tagwN_nhnWYP5vjUsnwgtHt9ZtVPl8v9Xmb_T8-ztXQ-ptTmMIT9DGY07qhmViV8g3YqOBcVTTYpEJFwXtPmZrdWNkiK3GAIdk77fikBb5HbEs8fXT9Ty20Y_JERhPTMscGLm7obOSs9FMPUjgtt4X4BdZGRbpNioY-WXwTHhHkq4fVKoV7nOOTDwKK-jeok-5jjhZF4QB-Z08oguegElqRfcz58iQAoZLomAEAuRLv2Wn3S6gdpJCpKO04hmlF306Dg2b7ptj-Z2UojUSCnokMe4n76GfyZOFZIwgJwTQfV6eGLTJfGSm-mQm4hIUxIHWHKARqtCngoj0C4O-_t_7iksa9hcC5yEkPwAe4vRWFbF8OeB8V-i90wZdehckwL9Chg1pc6_LbgA3Zx91wgtDsOg91CCcwuGrfZU6vJwTdnMP6x5_b3A33psr4SUbKJJMSjOMy-jB218yyqcmuTWgO26zvmNBM1SJ-6RwT1QZKJEL0WRMlvKBpWR9zAKsL1Z1H3FsbsEp9iX47tUk3ShsD8sAhZ903iJCiikMmKTDTFSFpot2y6P2N4vzDxIVBSjJ5EZkuKgWjXkaZOY25n9tGcnsRGc5EIGJyGXBs-tQBM4VxC7fTqGyee5HgMKpZzADbgFNJ8qWPiXoBJnaVse1XcwG-kyq-4zZo6TWhEW6q553afrWqcdJsne6gkGRzKjoQoUrdaBeITf1lBStxIzFi_QQzuHQ1PXEgPEUWZPBZ4F7A8Fgoh-1h7r_MO1RGhXubqFr_AkmW6Lnt7PA3HXoBXL2ZalTw-YuIeu8dw3jZ9Un5zOGB8r_SzdkYKqOFQtbsgCugi42tidYncy-B2K-FhZt3GeZ5Z-EAu0lKlxlpfLmI4xzRG4Cb66lJoby-QhM1XjZn68DrLI2I3boVxaAizGUOpIX21BiQY_tJ0zba3wTWOOB5CzuGzYwWoGuDB6wfbAeDcfpXukUIPzJfer7V3ndhIyO11EGWfBHu6W1V5RpuHB_VuGSjSJR28_wRStKNSWupkWUFaVM_sQmZxssEPwDy6dWN9MzPHeIrj31R9IHUUvOenK0ovoRNoOoBBCTJDmkzppvqV4chxvPs6Aws9w69AAvryPfuQyZGDEZzLM5a0qU2vvq3ermacUAt44MMHqrwmwCHuGpidj1eTE49CRStVVdWu-CDmQ2YVBtNyNhMKxz8DRn1JLmniSq2aaixWvNZ8ixokecLCBZwwSAeXO285XPfziWmRlP_Lk9I8i-ZgO7mrmWxrDSyN69LEKCmtEzTv5Aa3UI8iY-J1Gi5X41xLfayzSRVs9qPdytrd1np8rcuxZMQtqWjFawlcj3B1oO7ca_zS3yAQhhCKMToYeYGEHyIs--IYh0vSz1pRl37yysYljwAgW3QPSJcqv618mfz0mDz466kI0Dzwf9K8lF2yxZnKTqP9-diXSmxu4BSe13CLVrEq-B0-m3mYbOFKWsu3gr9TAi0L0_92g69BANVgfda2CVbx80EiKX8R9Mpg5j4ibv8sVioladJcS8M7j5_FDnxESaBhq5tofK4C7Qb_HirDZLd6VbMEzmRsvTczapnQRKvO_WvvF2HhygPEHqPKJQWP5_lwlrdmABHtEQ3Pb1KJ30rIs34UmP9W8CRg-OmwuCNrflkfjnEEFQnPF5v838199jRrh6t-UqWWpuUPaKqto5NWg_YZhS1MUnSVSiv_1YEp4-ECbiodQD_4n2BtWvjAjAQn2cfozpX6a-YyOXL82LV10bZxFO8UYp3_3vN5M0fP5WqG4mNUL3RPy_6T601fkVFvUJqC1eLvaHdajU0w7zaTlUA4OaaWJcm_HtCLDqnCZte5CwcgpSMdt5yR1-ABXcJJZATxkRLiyYvWwK50RJlVGEjsRA-VYnKZW8m0j_SiQMtixJi4sfPlIRV0g__0mfIfqN9qI8TCPZ0I0q6qT9i12AqyxpVxT-Hi-ghXolusat34U3CEfySNpH1PrxarPviZAdSQ57DYALyWAvM7OOHAfrWlKtxVNadx75L-qdCE9RMavIPm9V3I9p5ojrI1yNPfqJ_RIVW28ohFlxDnL58dz3TzKAXnijuRPMzLNdfYPDH4bAHHebg&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmoney18.on.cc%2F&ds=l&xdt=1&iif=1&cor=123522637713810340&adk=3690638928&idt=330&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

675952b3e59223e92b5bf973d80192a1d3f308391597283c6cb818a7660cf9d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20403
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2205 0
56 B 138ms
137ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1807352322951&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2205 0
56 B 137ms
137ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1807352322951&version=m202401290101&ct=77&x=1&cor=151603926275874300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2205 35 KB
20 KB 230ms
156ms Script
text/javascript 142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CqGAsyGH1kHC7FX_X6gytehOk2YwNWqYlDipZd7fY5Jyf3DGrCffIW9QUTxNwsynzCA7twC-fryxMPfiPN82cMlFhtLa7HB7N8WJR-BTqm2PqVkoy0w9bRhAhrpcnscPL1gjRI2eNGcgYMdoJnlYxAYbYb1a7uaoivHV9FzuWrYgwcPJcjsiOOzecPzkAiFyHQXZa1zbV73ycLb7kuJ8PV21Payw&cry=1&dbm_d=AKAmf-Bl5wBndntqrrwYc64NWiRTSfVWxFmzKrfGYDuNllRhPwdiEASGRi_r-JQ06vMadfMuETzNcqp-tJd0nFqACkAeKyfYf8wE5CUJfSKpjteYannc0IjlYEO70YIJ1iE42Ggiq5NLqlUQ1RCUg5_CLId_ycfc1F6qpUZ1VoQEtvAVo8KVuACqD2I37q_axn5_L0uYqI_36JsEUM3gD3tkvzeNG5q2zErMH391NmZK8iFVCeC5yTcMFIqIfA8GGyGKTIpzFhGFxOo6cohRZkze04heNKHf81yuiGikXReQ0MsGRRUj-r1SKd0QOL2YucxXB9VZghPlJat_GWGoy5pUm2InRhHwqIGFFXsA7c7brO3DmicTtQyXjFNl5T5PsaIHpkkzdFU0q08kq5q79hQwyXegASM5GTV3BYShTsDpADcUzuI4Wc0Fpz1oEsJYT-bvqBxlP2Ua_A9qLhiYD-xFi9ZzJFdPxqSZ_UOyzt1nD9lVkOCwNeuTOFC63sg_Vq8zMQqsrzgXxDlZUOFA2Tmxh3iwo4bXJE5yXTk2K-1qZpbo1LRgeJlppZ9THZwbO8J6PEnaWsiPCGtyNOoHa6MW6wmbM01Pdxz51vQBW3eZwsrV-SKT4aGIZlu1kK9GmQzQPFK2-kVid-IXS9TIt0AMYVnCYCc6Ay93knXWMikvHfrA-hi1XVb9BlldFW_2km0DPFFuMoaQxq8azB18qxH8y-NLTmkp_uLfpixOS79LoYEYwquVnS-N3g9H7njVfY07mJE49qvMKqY83_Y9U6HF3-utuNRq_t89uNY42G2hcM43pU8GON_MAhf1jjoELAaHSkj-ITmij8BGDsAFtYCjiYF3gaeE2QxifEK_Dk-5VEjroMZgxORJkGFFNChUR7RG52WFLK80NtbdB7veV2mYyAfwSQe0O1lWPtx8tgbdG-RX8yVstycrAFGcR7_AmFEmjwp8eEZCgGCZfW9E6nO6F-ualb6oCKD9lPZonEiB56vVtVJI0-vz-Qg000PbtW6uNZzmbcW_0hs1C_EHOPTNbot2stOOLxd-8JOWIK7Syy4Ik1oFpU0ErpCeYHDRvmgwRSuHt55PoCHnffygD-sIrkFi0DmmR88zsoMA_O997YY0NoeMdLPS7lJpSjCqdfTjPg8rmfO4_GZfyhpW0ai1-InYCZczu96weINV4YbB3TaXF_-NKduNsPSrrBy7V75zwCMifqMiyMmQUdapwkCN6FHCA6F_Z-h-IheTVsWP30ZnATqNEJGw311fxjDv6Z7P8I511Hof4Eot841T2h2jrP0RVHJV35Q0K7RZvCTJgAHMKySktoUSFwhvgobAnZ5vF8AvxX42gSlgeU8x4yRkYBS1Qv8qz3tJNrcotIoQpEysQWvwe4dI9w1-9M9hB8DUoODAjDy-zGfHSmDAzzcOCLlBQeV4H6tCZ_spxuzVHZLjfYmqONy3H0JlGSLTpB6tI2b-gmC-1Mtkn5w2VdgM4lnbBB_UbqQaZPK-hunRUCSBLU5UnGtc6zI8VNs7TYuOgchmU5_etpmnq_iHNgiMK2KtayTxxY6lylVwy0xPOnsMizMtMvD-ZgRlJFKo7wsq8Qbszfqi1e3o5aIdUq1NtImi1QNrHpSDK6loou_s9QVNLjg6ahMUOxGCklBDQOEf7oDLaAvWwT6PE4DVwov2SwBnHjYuvZxUoRVGOPurgPQD3zcvnzThdSLDJD8jaAq_BuVqXSvPaYpuwXpZ1mhTqq3Wiy1yyjzIrQ8PG2iggkrMlX3i33xko5FWbflDFscVdFb0hpDM7jsKMk4zxBXo36EaxCLew5qEM6GlsliyBkO-ztMpSEO0k46F1qds1Qh37TjWwHGvt_NAZfldXibmtmxRcpu_lVRfvPAA2tst5Vpb4tklha2XTrM4_a7q7PcZodUY9P91FJ-vVn22VzgY8W9xKNJbPp3RJIs2m2ahBbrDEyug4uwKCuojnOLeHIA5SI3R5gGSDhA5gLVOwcWpwR9mgnb3gIA49l3uQjAyKLXz2UssWYlEaA_KaPgoOINr0oKXmo318bJHHDJckN4pA5wuqQQTy9V9dAGe7CUm6F5rH4ZMikrk7Z5jOYeFh3dhZZuvelh-EK8NNbzwjCClOF9UgKSBx4lZGjLe8reVWFz8r_p-evxq-nyDdMDi3XwEkPaPnW6-6UEd8aMWNH6VgyWw5i5ijzb28TvwPIy0dgIO75TZGmk3yhzAb9-89oDcaf2PHmUWoBbVhlb4NC3slQIJWvtPiz-WtactUXHMNjkxOx0wScmqnKgqI3v7UGs0J_MyAAdxg9JyBufj9gwr6tIbuWgfPBrLUmCasvvWBNFf8PA98yLI6WHB4HPrLdzVMylT2duiQ7o9R3XVUXvRErEVPvwfX7-7dWFdpBE7zWBJ5gry7TCq_LUYqqGNdepcn3ohOFZWpURAMCxOPOoPoMJ9cqMFEeTlN_axx80XDgCwdlXwFarPoijx-XlgL1lcaHbQNI8-8bys_iTDabGZfIHGhmVoZsxUpIBC8yQsDMX6lTl5wBXI5aV_G_N8WiDS0CiTpsa_3PPq9njv3XONjVoXhccG0iEqJBJ8sPkc3oaS2eh9USX95OBTRon4cvye2C9RMfM6N9N02wbEgyN_CoXt9mxYbMuAGQ0tPM87zrTjUZfRCci6rT9Ndh00L3kJdIm8W-LRbPwwP1D0t9x6UHR1kNu1bkbpdRQU4Kdl4T5LWtd8-k7WCZ35iXgfD8XEoJITOdViguSRtMgukbWSwgMQpvfskBJBUR1mTtWn4jzrsQI2hQ7lHYtGF1nwHFqjwgX6JVh5yjcGe6CKi7EspH7Z96-Yi85XelrWwCUTlM2GzP_SrA3bMS2W4VnhwsVJO3a-q8SHQtSv4Ai5bqBkfc_j44wz8L_WsJHeSiCNfUcFULlG-0Gx6tfYS72EbwVUBbSFnVEdyTxyJQd_SP1AalChhrRF4_866OduxN8ExLXj9wymi6EvhRFHBYWJB9HERJnQxBw_TYDl1Ad54oNMeO8nZ58wXzO04fyR4tedqYw74PMtm5fXp8dA24P_o_1eac-RqAD-kOh-exhvMoeJC7YDMbqbjB_jco1KpvcryB6MqlYqfl5dvV0vUA9pXP4u8VL4BpXpmdYVq71e8PiBKxy0JVthLZ8kXJL1RQSlOqFLQcYydwRLAoteVQ4T4k5yO3sxIhk7bAy0lPugSYqMxOvB87Q-e8ELmEcGzd-2k36ig10QSdzIb2AemEMpqaPLxg6uAue9dHKCvqutgbBM5C-hxeLy2ZQHFcQC0opciC4HL74c9OFb_gJTJUvxPTbPR1Teejy9lXQRGzRhe78TFUwqs3jJSIb7KNVl38gCBauUKDhXRMNwHUVqb7MOMdcZjfk5qT67XjaDiOD25Brr9RZSUd1Z957ztGZZlcWP6JuZFZIFuRRx1r4_Ue-TeaAbl2b2IFErlbyxjDpQWv-kWp1gp0q0MFc94sFbwvvfFx3HNJaj1bSTG22uy3JV2l6kRGh5oOY2yAaSf9PrbglPt0Im7B32fWrVKYmRHiMawC1vq3LDjKO3Bk2VaFqunlBPtvhnzjsoiq_4f1Isc0sjwPtPtG83kanCD09EyUS1qMGrKrkwJNRcWHG5UER9s8gfQ88WssYpToLscfjkezduv7J8K9jHiQreVefkGG24ahW0eS2fhOQVoJkMKc1qG1Oc-_ok8RSU3BWcpAemwEG06L9L2SVSFfwQ3NbEvV1jQSoySN7eCyfQ6Hdo2k9v_hllIjDl89FNHkztzJeKLDTx89q7xApAB950bNA59ZoDBy4N5gSfdEeekG65dflYtV1dG8vkNpPhp-GuYAn3IS5tisSQ1jiSXKluQK9We1ASVGEWIRu_qRmWfs_1mh9ivhl3Ba45hTa7gFCw5xtrP9PJEr7TiwmKcynVESzpzpylP_7TjkpkbBmcPKHN-aHgw0T-usU6Xu0MMnR9mgfKEterTME-VHTfwcOOfs_8K_z5UKtkd_d4n5xRA9ESL68it9T_Pb1reRqn9zwHYs1AqVRnz9ommMkVbDzHEAXFwNQYoJvyCXOFn6iSj_reuidSl15VTq6sPVYEJQBWbRB_IY2ouWF-buHaE4M40gylURBuOFhKnHl4Fp7VHaK2VjA9fxoZFEy2QgZyucbi3YPwTNw6UfrtJc2mQghCKVh218MIu6mL3P0Ze1r-x_mFIHVK5bmS4x8WGVtIzJeXIOKrm9O90jTbOFESVpniZ72kSkZ_WERksdMi4w8t47KSMoi7dJ3j901EvxMaclDKCKq5OwOx6ieYmMlJnoeuD1thS1eLuxTJr9YIsFlA5fgbRafqF6e7MYxM6q_l1Bp1vB0enASKX-CcvxPn4PEqKfo5KDmwTsf6uuywkJb7XBefzoUYpNGaBfp5087sf1Gv0lmPMA3-TRuSsc9op86NJy2sTTpDqhPn7-OmRdGCf6A0W3oCc7qYsrlDJSQh9WJ76a8faP4z9SL9CfoNeiOJFA-J-JV8mhottOkoIAFYm6LTSRCEW9hyqB57Gq8LpN6_qi0pxQzPcTU4VxEAqNR6K-S0SF3IgDJC6wcXL5KUKKKF5rSGF35Be_YWfzIGh6x9VtQ79RAmnhSj8L_EcA&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmoney18.on.cc%2F&ds=l&xdt=1&iif=1&cor=151603926275874300&adk=1033480540&idt=315&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5fb5d16d302235b50d2592e8a927347b47f3dffc415ed9dcb8d801c60765557e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20361
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 genIndexDetailHKJSON.php Show response
realtime-money18-cdn.on.cc/securityQuote/ 810 B
681 B 273ms
273ms XHR
application/json 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/securityQuote/genIndexDetailHKJSON.php?code=HSI
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc3c219608894d9a73aed13d9f125812181c4b9abdc720acce5fbeda284a3eca

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
etag: W/"34a1a792e5e16f3e54975466df615232"
vary: Accept-Encoding
x-cache: EXPIRED
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=5
cf-ray: 858fbcc69adb558d-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 __utm.gif
money18.on.cc/img/ 35 B
266 B 164ms
163ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/__utm.gif?utmwv=1&utmn=1408839634&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=desktop_%E7%B9%81%E9%AB%94_%E5%A4%A7%E5%B8%82%E6%A6%82%E6%B3%81_%E4%B8%BB%E9%A0%81&utmhn=money18.on.cc&utmr=0&utmp=/m18_web/desktop/zh-hk/summary/main
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: DYNAMIC
last-modified: Thu, 10 Feb 2011 08:17:24 GMT
server: cloudflare
etag: "4d539f14-23"
content-type: image/gif
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcc6a993a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 35

GET
H3 200 menu.sprite.png
money18.on.cc/img/menu/ 16 KB
17 KB 26ms
26ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/menu/menu.sprite.png?v=WpOQ818i3jcFV5FZLAfmrnkSjqs8t77InmG0Y
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d42cd9e11d9341031f46258a1cb51a0ba686da0153b2fd835ad577aa3397dedb

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:25 GMT
server: cloudflare
age: 1787
etag: "5ecbad05-41a9"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcc6c9a4a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 16809

GET
H3 200 menu_property.png
money18.on.cc/img/ 1 KB
1 KB 267ms
267ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/menu_property.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66d23c7479886f7a32f1ac6309b41e901e8740c00fec9bdfcc0af1e04041c07f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Tue, 27 Oct 2020 07:47:46 GMT
server: cloudflare
etag: "5f97d0a2-4e9"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcc6c9a7a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1257

GET
H3 200 section.html Show response
money18.on.cc/modules/desktop_compenents/ 1005 B
605 B 972ms
971ms XHR
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/modules/desktop_compenents/section.html?
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/es5/text.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 371419c24a699d2b254c8676b35892064835f3d423845377af0c3d56e7508284

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 27 May 2020 03:20:40 GMT
server: cloudflare
etag: W/"5ecddc88-3ed"
vary: Accept-Encoding
content-type: text/html
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcc6c9c9a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 OBZ240221-15294-21-M_hd007.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 874 KB
875 KB 31ms
31ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd007.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88d49ca2255790c03f8aa7fc634d94fba67efa52c90bdc0b8b7fbf5f3659f201

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17694
etag: "65d5c3de-da918"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc6daf2558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 895256

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4BA4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
176 B

103ms
102ms

Document
text/html

142.250.204.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:12 GMT
expires: Wed, 21 Feb 2024 14:39:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:12 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 OBZ240221-15294-21-M_hd008.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 881 KB
881 KB 17ms
16ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd008.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eca092be9d9fcfc0c2e1b6d2b652cca41d3ac3af1307767426c21dfba19c4fa3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17693
etag: "65d5c3de-dc2cc"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc77b40558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 901836

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
251 B 218ms
5ms Fetch 34.149.26.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=14019
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.26.226 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 226.26.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
via: 1.1 google
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://money18.on.cc
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H3 200 OBZ240221-15294-21-M_hd009.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 468 KB
468 KB 20ms
20ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd009.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06fe6b87a9f2bad0266a92dd91fd961ebc1b79b2c304a39b2804af29fe32fecd

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17692
etag: "65d5c3de-74fec"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc7ebc7558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 479212

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 9366
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0

43 B
434 B

114ms
114ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNU2eaTWxi37BZXMlwSsKdk34EzEjHdoCzbahxc7lBsqS4fC0-mz91ZIOIceTljgVOgts2FHp2FSfw0eUlClfZycOS5tXyeFjCoDKUcVNzBhkEaHbqs
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sW4AFuk8Wd7c2FfFh1VIICOjexoU%2FwiJYrD%2F5VjszHamWjP6NeFw9blG9QYv2IlS5MZvzzQsD3KkxO9Jy2MYwISE5opDLOmPgA9w5Szkea6oYY3hU7BttPncsTgCtTEkwbCZiVFuXBQ87A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 858fbcc8dadeaae9-SYD
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9366
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZdYLEIsFVeUAAAyxADUD-AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1

43 B
732 B

113ms
113ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNU2eaTWxi37BZXMlwSsKdk34EzEjHdoCzbahxc7lBsqS4fC0-mz91ZIOIceTljgVOgts2FHp2FSfw0eUlClfZycOS5tXyeFjCoDKUcVNzBhkEaHbqs
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=POGg%2FcWj9jKo%2FIEwYRr08oqD6E89lFMolzdReEIe7mcACL9lSlOJlM3YXIxUocZToACb85RPHF5JXmc5zncCccSMXbEK0w%2FIErq9B04iU72CLSXeaJp5PzhQxewm62Ihmf5fsT3gKcx4vQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 858fbcca3b50a886-SYD
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 9366
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEMZSc_xQ7Jqj0waPTIXtCjQ&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEMZSc_xQ7Jqj0waPTIXtCjQ%26google_cver%3D1

43 B
1 KB

95ms
94ms

Image
image/gif

103.43.90.54
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEMZSc_xQ7Jqj0waPTIXtCjQ%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNU2eaTWxi37BZXMlwSsKdk34EzEjHdoCzbahxc7lBsqS4fC0-mz91ZIOIceTljgVOgts2FHp2FSfw0eUlClfZycOS5tXyeFjCoDKUcVNzBhkEaHbqs

Protocol

Server

103.43.90.54 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
an-x-request-uuid: ae72242f-718b-4096-aa71-4279281db8ca
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 66.203.112.161; 66.203.112.161; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
an-x-request-uuid: 4e820902-51f1-4a52-a5c7-aaebdf9ff52d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEMZSc_xQ7Jqj0waPTIXtCjQ%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 66.203.112.161; 66.203.112.161; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9366
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMTgxNTczODgyMDYyNjYwMw%3D%3D

170 B
188 B

100ms
100ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMTgxNTczODgyMDYyNjYwMw%3D%3D

Requested by

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
an-x-request-uuid: 76e910f6-73a0-4145-8931-ae21bbb5cdba
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMTgxNTczODgyMDYyNjYwMw%3D%3D
x-proxy-origin: 66.203.112.161; 66.203.112.161; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0D76
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0&C=1

43 B
771 B

115ms
115ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBELnvJhiikJ-IAjAB&v=APEucNW1TRHR3k5vd3UlzQwMHhTwKr5-decw0amfYVTWotlwgDvPrKWPPPHzglJbKQlADtwpwRsSbj9NXLhIr4lEnByx0T5dmgrGL414ecWiABgz7-0HWKw
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xdyxvA7KTzMY2tPwyQByYwCz%2BdP2LgialCFerhyIvIKtTkPr87AAX9nXxBdre0TJ%2FXO0%2FYL9OI9OwOC8b1BBM%2FHAfjcxtnxLmKnWx7D5eVkbEsOfxUfhJDbAiJHHAvT5FwJeteu4VA9SxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 858fbcc96ac8a886-SYD
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2FHkku1JOwfdtO7lScw5%2FftXLEkxhFSZ5L2whRiCrSwiv%2FSjMyMnhOE%2F9B0q5%2FA6JTkjtxdQCZx0d95IHIHxPGuarn%2FMNaiIeHgoaOwBZNL6gjrIhRT%2FO6VGDHs4TkdvSXXo0mLCzWM9Qg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1&gdpr=0&C=1
cache-control: no-cache
cf-ray: 858fbcc8aa7faae9-SYD
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0D76
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZdYLEIsFVeUAAAyxADUD-AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1

43 B
736 B

121ms
119ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBELnvJhiikJ-IAjAB&v=APEucNW1TRHR3k5vd3UlzQwMHhTwKr5-decw0amfYVTWotlwgDvPrKWPPPHzglJbKQlADtwpwRsSbj9NXLhIr4lEnByx0T5dmgrGL414ecWiABgz7-0HWKw
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c7Hm%2BW7FqOKTCmW97PezEKHAKqaGF0W2E03x3xk13kmy9DwZ2%2BCevd5SJVvb2luRMIEikg7fdRp7ARNg7LQevzmwiNy8%2BhlvWM0U557xWFyQONEZlmlO9R1R1x%2FHHpvqYnl%2FzM3PrajhBA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 858fbcca3b53a886-SYD
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDalS8PISp0wjcH3rs-rHpI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 0D76
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEMZSc_xQ7Jqj0waPTIXtCjQ&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEMZSc_xQ7Jqj0waPTIXtCjQ%26google_cver%3D1

43 B
1 KB

100ms
99ms

Image
image/gif

103.43.90.54
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEMZSc_xQ7Jqj0waPTIXtCjQ%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBELnvJhiikJ-IAjAB&v=APEucNW1TRHR3k5vd3UlzQwMHhTwKr5-decw0amfYVTWotlwgDvPrKWPPPHzglJbKQlADtwpwRsSbj9NXLhIr4lEnByx0T5dmgrGL414ecWiABgz7-0HWKw

Protocol

Server

103.43.90.54 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
an-x-request-uuid: f9998462-6ae6-4793-9d65-05b39ddbf00f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 66.203.112.161; 66.203.112.161; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
an-x-request-uuid: 0d065653-c302-4f8a-95a7-b84ae0dcb60e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEMZSc_xQ7Jqj0waPTIXtCjQ%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 66.203.112.161; 66.203.112.161; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D76
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMTgxNTczODgyMDYyNjYwMw%3D%3D

170 B
188 B

100ms
99ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMTgxNTczODgyMDYyNjYwMw%3D%3D

Requested by

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
an-x-request-uuid: 3dde5ec3-7d48-47b7-828d-c778a59059da
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMTgxNTczODgyMDYyNjYwMw%3D%3D
x-proxy-origin: 66.203.112.161; 66.203.112.161; 598.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 2205 30 KB
11 KB 3ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CqGAsyGH1kHC7FX_X6gytehOk2YwNWqYlDipZd7fY5Jyf3DGrCffIW9QUTxNwsynzCA7twC-fryxMPfiPN82cMlFhtLa7HB7N8WJR-BTqm2PqVkoy0w9bRhAhrpcnscPL1gjRI2eNGcgYMdoJnlYxAYbYb1a7uaoivHV9FzuWrYgwcPJcjsiOOzecPzkAiFyHQXZa1zbV73ycLb7kuJ8PV21Payw&cry=1&dbm_d=AKAmf-Bl5wBndntqrrwYc64NWiRTSfVWxFmzKrfGYDuNllRhPwdiEASGRi_r-JQ06vMadfMuETzNcqp-tJd0nFqACkAeKyfYf8wE5CUJfSKpjteYannc0IjlYEO70YIJ1iE42Ggiq5NLqlUQ1RCUg5_CLId_ycfc1F6qpUZ1VoQEtvAVo8KVuACqD2I37q_axn5_L0uYqI_36JsEUM3gD3tkvzeNG5q2zErMH391NmZK8iFVCeC5yTcMFIqIfA8GGyGKTIpzFhGFxOo6cohRZkze04heNKHf81yuiGikXReQ0MsGRRUj-r1SKd0QOL2YucxXB9VZghPlJat_GWGoy5pUm2InRhHwqIGFFXsA7c7brO3DmicTtQyXjFNl5T5PsaIHpkkzdFU0q08kq5q79hQwyXegASM5GTV3BYShTsDpADcUzuI4Wc0Fpz1oEsJYT-bvqBxlP2Ua_A9qLhiYD-xFi9ZzJFdPxqSZ_UOyzt1nD9lVkOCwNeuTOFC63sg_Vq8zMQqsrzgXxDlZUOFA2Tmxh3iwo4bXJE5yXTk2K-1qZpbo1LRgeJlppZ9THZwbO8J6PEnaWsiPCGtyNOoHa6MW6wmbM01Pdxz51vQBW3eZwsrV-SKT4aGIZlu1kK9GmQzQPFK2-kVid-IXS9TIt0AMYVnCYCc6Ay93knXWMikvHfrA-hi1XVb9BlldFW_2km0DPFFuMoaQxq8azB18qxH8y-NLTmkp_uLfpixOS79LoYEYwquVnS-N3g9H7njVfY07mJE49qvMKqY83_Y9U6HF3-utuNRq_t89uNY42G2hcM43pU8GON_MAhf1jjoELAaHSkj-ITmij8BGDsAFtYCjiYF3gaeE2QxifEK_Dk-5VEjroMZgxORJkGFFNChUR7RG52WFLK80NtbdB7veV2mYyAfwSQe0O1lWPtx8tgbdG-RX8yVstycrAFGcR7_AmFEmjwp8eEZCgGCZfW9E6nO6F-ualb6oCKD9lPZonEiB56vVtVJI0-vz-Qg000PbtW6uNZzmbcW_0hs1C_EHOPTNbot2stOOLxd-8JOWIK7Syy4Ik1oFpU0ErpCeYHDRvmgwRSuHt55PoCHnffygD-sIrkFi0DmmR88zsoMA_O997YY0NoeMdLPS7lJpSjCqdfTjPg8rmfO4_GZfyhpW0ai1-InYCZczu96weINV4YbB3TaXF_-NKduNsPSrrBy7V75zwCMifqMiyMmQUdapwkCN6FHCA6F_Z-h-IheTVsWP30ZnATqNEJGw311fxjDv6Z7P8I511Hof4Eot841T2h2jrP0RVHJV35Q0K7RZvCTJgAHMKySktoUSFwhvgobAnZ5vF8AvxX42gSlgeU8x4yRkYBS1Qv8qz3tJNrcotIoQpEysQWvwe4dI9w1-9M9hB8DUoODAjDy-zGfHSmDAzzcOCLlBQeV4H6tCZ_spxuzVHZLjfYmqONy3H0JlGSLTpB6tI2b-gmC-1Mtkn5w2VdgM4lnbBB_UbqQaZPK-hunRUCSBLU5UnGtc6zI8VNs7TYuOgchmU5_etpmnq_iHNgiMK2KtayTxxY6lylVwy0xPOnsMizMtMvD-ZgRlJFKo7wsq8Qbszfqi1e3o5aIdUq1NtImi1QNrHpSDK6loou_s9QVNLjg6ahMUOxGCklBDQOEf7oDLaAvWwT6PE4DVwov2SwBnHjYuvZxUoRVGOPurgPQD3zcvnzThdSLDJD8jaAq_BuVqXSvPaYpuwXpZ1mhTqq3Wiy1yyjzIrQ8PG2iggkrMlX3i33xko5FWbflDFscVdFb0hpDM7jsKMk4zxBXo36EaxCLew5qEM6GlsliyBkO-ztMpSEO0k46F1qds1Qh37TjWwHGvt_NAZfldXibmtmxRcpu_lVRfvPAA2tst5Vpb4tklha2XTrM4_a7q7PcZodUY9P91FJ-vVn22VzgY8W9xKNJbPp3RJIs2m2ahBbrDEyug4uwKCuojnOLeHIA5SI3R5gGSDhA5gLVOwcWpwR9mgnb3gIA49l3uQjAyKLXz2UssWYlEaA_KaPgoOINr0oKXmo318bJHHDJckN4pA5wuqQQTy9V9dAGe7CUm6F5rH4ZMikrk7Z5jOYeFh3dhZZuvelh-EK8NNbzwjCClOF9UgKSBx4lZGjLe8reVWFz8r_p-evxq-nyDdMDi3XwEkPaPnW6-6UEd8aMWNH6VgyWw5i5ijzb28TvwPIy0dgIO75TZGmk3yhzAb9-89oDcaf2PHmUWoBbVhlb4NC3slQIJWvtPiz-WtactUXHMNjkxOx0wScmqnKgqI3v7UGs0J_MyAAdxg9JyBufj9gwr6tIbuWgfPBrLUmCasvvWBNFf8PA98yLI6WHB4HPrLdzVMylT2duiQ7o9R3XVUXvRErEVPvwfX7-7dWFdpBE7zWBJ5gry7TCq_LUYqqGNdepcn3ohOFZWpURAMCxOPOoPoMJ9cqMFEeTlN_axx80XDgCwdlXwFarPoijx-XlgL1lcaHbQNI8-8bys_iTDabGZfIHGhmVoZsxUpIBC8yQsDMX6lTl5wBXI5aV_G_N8WiDS0CiTpsa_3PPq9njv3XONjVoXhccG0iEqJBJ8sPkc3oaS2eh9USX95OBTRon4cvye2C9RMfM6N9N02wbEgyN_CoXt9mxYbMuAGQ0tPM87zrTjUZfRCci6rT9Ndh00L3kJdIm8W-LRbPwwP1D0t9x6UHR1kNu1bkbpdRQU4Kdl4T5LWtd8-k7WCZ35iXgfD8XEoJITOdViguSRtMgukbWSwgMQpvfskBJBUR1mTtWn4jzrsQI2hQ7lHYtGF1nwHFqjwgX6JVh5yjcGe6CKi7EspH7Z96-Yi85XelrWwCUTlM2GzP_SrA3bMS2W4VnhwsVJO3a-q8SHQtSv4Ai5bqBkfc_j44wz8L_WsJHeSiCNfUcFULlG-0Gx6tfYS72EbwVUBbSFnVEdyTxyJQd_SP1AalChhrRF4_866OduxN8ExLXj9wymi6EvhRFHBYWJB9HERJnQxBw_TYDl1Ad54oNMeO8nZ58wXzO04fyR4tedqYw74PMtm5fXp8dA24P_o_1eac-RqAD-kOh-exhvMoeJC7YDMbqbjB_jco1KpvcryB6MqlYqfl5dvV0vUA9pXP4u8VL4BpXpmdYVq71e8PiBKxy0JVthLZ8kXJL1RQSlOqFLQcYydwRLAoteVQ4T4k5yO3sxIhk7bAy0lPugSYqMxOvB87Q-e8ELmEcGzd-2k36ig10QSdzIb2AemEMpqaPLxg6uAue9dHKCvqutgbBM5C-hxeLy2ZQHFcQC0opciC4HL74c9OFb_gJTJUvxPTbPR1Teejy9lXQRGzRhe78TFUwqs3jJSIb7KNVl38gCBauUKDhXRMNwHUVqb7MOMdcZjfk5qT67XjaDiOD25Brr9RZSUd1Z957ztGZZlcWP6JuZFZIFuRRx1r4_Ue-TeaAbl2b2IFErlbyxjDpQWv-kWp1gp0q0MFc94sFbwvvfFx3HNJaj1bSTG22uy3JV2l6kRGh5oOY2yAaSf9PrbglPt0Im7B32fWrVKYmRHiMawC1vq3LDjKO3Bk2VaFqunlBPtvhnzjsoiq_4f1Isc0sjwPtPtG83kanCD09EyUS1qMGrKrkwJNRcWHG5UER9s8gfQ88WssYpToLscfjkezduv7J8K9jHiQreVefkGG24ahW0eS2fhOQVoJkMKc1qG1Oc-_ok8RSU3BWcpAemwEG06L9L2SVSFfwQ3NbEvV1jQSoySN7eCyfQ6Hdo2k9v_hllIjDl89FNHkztzJeKLDTx89q7xApAB950bNA59ZoDBy4N5gSfdEeekG65dflYtV1dG8vkNpPhp-GuYAn3IS5tisSQ1jiSXKluQK9We1ASVGEWIRu_qRmWfs_1mh9ivhl3Ba45hTa7gFCw5xtrP9PJEr7TiwmKcynVESzpzpylP_7TjkpkbBmcPKHN-aHgw0T-usU6Xu0MMnR9mgfKEterTME-VHTfwcOOfs_8K_z5UKtkd_d4n5xRA9ESL68it9T_Pb1reRqn9zwHYs1AqVRnz9ommMkVbDzHEAXFwNQYoJvyCXOFn6iSj_reuidSl15VTq6sPVYEJQBWbRB_IY2ouWF-buHaE4M40gylURBuOFhKnHl4Fp7VHaK2VjA9fxoZFEy2QgZyucbi3YPwTNw6UfrtJc2mQghCKVh218MIu6mL3P0Ze1r-x_mFIHVK5bmS4x8WGVtIzJeXIOKrm9O90jTbOFESVpniZ72kSkZ_WERksdMi4w8t47KSMoi7dJ3j901EvxMaclDKCKq5OwOx6ieYmMlJnoeuD1thS1eLuxTJr9YIsFlA5fgbRafqF6e7MYxM6q_l1Bp1vB0enASKX-CcvxPn4PEqKfo5KDmwTsf6uuywkJb7XBefzoUYpNGaBfp5087sf1Gv0lmPMA3-TRuSsc9op86NJy2sTTpDqhPn7-OmRdGCf6A0W3oCc7qYsrlDJSQh9WJ76a8faP4z9SL9CfoNeiOJFA-J-JV8mhottOkoIAFYm6LTSRCEW9hyqB57Gq8LpN6_qi0pxQzPcTU4VxEAqNR6K-S0SF3IgDJC6wcXL5KUKKKF5rSGF35Be_YWfzIGh6x9VtQ79RAmnhSj8L_EcA&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmoney18.on.cc%2F&ds=l&xdt=1&iif=1&cor=151603926275874300&adk=1033480540&idt=315&cac=0&dtd=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 05:42:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:42:53 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2205 41 KB
14 KB 3ms
2ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:04:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455659
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Feb 2025 08:04:53 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODUyNjM1MjU0NTcxNQogIHNlcnZlcl9pcDogMTYxMzAzMjAxCiAgcHJvY2Vzc19pZDogMzU5MDQzMDQ0Mgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA5ODkzMDY1...
ad.doubleclick.net/ddm/activity/ Frame 2205 0
22 B 147ms
147ms Image
image/png 142.250.66.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODUyNjM1MjU0NTcxNQogIHNlcnZlcl9pcDogMTYxMzAzMjAxCiAgcHJvY2Vzc19pZDogMzU5MDQzMDQ0Mgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA5ODkzMDY1CmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9jcm93bnN5ZG5leS5jb20uYXUiCnhmYV9hdHRyaWJ1dGlvbl9pbnRlcmFjdGlvbl90eXBlOiBWSUVXCmltcHJlc3Npb25fcHJpb3JpdHk6IDAKaW1wcmVzc2lvbl9leHBpcnlfaW5fZGF5czogMzAKZXZlbnRfaW1wcmVzc2lvbl9pZDogMzQ1NDYxNTEyNTMzMjQzNzAxOApkZWJ1Z19rZXk6IDEzMTc5MzI2OTgyMjExMzE0MTgyCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNC0wMi0yMSIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDk4OTMwNjUKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzODY2NTgxNTgKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDUxODYyMTAyMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyMDk2MTg1ODcwOAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDU0OTA3NDU1NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9jcm93bnN5ZG5leS5jb20uYXUiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9zZXZlbnJvb21zLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjEuY29tIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0CmRtYV9wcm9kdWN0X2lkOiAxMjI3MTU4MzcK

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.66.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2e1818206d52353f0000000000000000","13":"0xc812868c993fa52c0000000000000000","14":"0xdb88d7f905e6b1d30000000000000000","15":"0x2abc94322b6e06f50000000000000000"},"debug_key":"13179326982211314182","debug_reporting":true,"destination":"https://crownsydney.com.au","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["9893065"]},"priority":"0","source_event_id":"3454615125332437018"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 2205 59 KB
23 KB 3ms
2ms Script
text/javascript 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 15:40:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82727
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Feb 2025 15:40:25 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5D93 38 KB
13 KB 2ms
2ms Document
text/html 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 82726
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Feb 2024 15:40:26 GMT
expires: Wed, 19 Feb 2025 15:40:26 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 B31307780.386243046;dc_ver=99.292;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=1033480528;ord=zucvbh;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkSalDgvWZdrQKfPI... Show response
ad.doubleclick.net/ddm/adi/N1255798.4078729MATTERKINDAU/ Frame D0AE 67 KB
32 KB 154ms
154ms Document
text/html 142.250.66.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1255798.4078729MATTERKINDAU/B31307780.386243046;dc_ver=99.292;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=1033480528;ord=zucvbh;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkSalDgvWZdrQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QDRjcqed3eWLmuT3l5wekzR1Qls2p6CCxyjJUom7-MRyeILe1RZbcRPwJ9LUyLfISxJNTPRU-Ln2gFcblxYVtci0fAFq4oKCRDopqwKQA82-9LIGhjJy1FhUIym27aYqrXV66Rl24-kJpjuv8qWNuTvcqeFUh9F51kcu8Jh_kWVEOEKI4DL2nI0tWLt5sxMhLPzYa_u4U-jSYxlNKI-7GmSy-k4p7-unR6TKhD0PtSNfcMD3Cb6HpE4RJ1rlREa4jW1_bBEmrRYEqsGMm6uCITjuQOTzI4yCzMmvXly0HEdntdJ9zZjB5-g9fuDmfftU8GwRvR3w32gtWPEodWdaqaHgxKK33ewWsKb0ss4byn5tNzljdRLzABK_lh5TKBOAEA4gFlKmyi06QBgGgBk2AB_uBjNcBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAtgHANIIJAiAYRABGB0yAooCOgmAQIDAgICAgAhIvf3BOljwseDR1LyEA4AKA5gLAcgLAYAMAaoNAkFV4g0TCLCK4dHUvIQDFXPkcwEd_BkCLLAT4pO6FtATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB%26sig%3DAOD64_2X3p0wNOSFucRS8_ztAy4HOBabzg%26client%3Dca-pub-1862194061110379%26dbm_c%3DAKAmf-DOOii5ljeOEsLFEUfOU4sp_qPD1xRC4Uvt0zpExFp9uT14tpqhQz-b-4WOGaA54cgy2JWy5-TVyvVfU7w1ehQ7a76JxUrkSiDWOi9amCO7rPJ78yOyZ8R9wIEGLv9EQTvS3aiFsk0AwKisoV14RCdTnQabkqklV4VyHIhI6Vu8-spQG28vxyazdQKbuFll_rF5mycWJ9ur3BtSMnuc9NnEXe7PpA%26cry%3D1%26dbm_d%3DAKAmf-AdcS1nKy19Pp_UJOdqrMbFzU-PrzstE2C_x6TUl3SEK_a-EWCFnjUvn2IlLrzSxEHzEHMv1T1qI3RrXtz82ppnuvyb9420ZmrH_eUDG0y1-kJgtisSSUE5beikGPMJ5joYE3n2dJ7hYw5BPGPwFx3lojh-BvHHZREYGZP8i4tnYs33VsOgUzuu_QpHkrmm-12UqdQc4sZn0nxEKmkbRO2G9-1FWSMPrV4TVI_TzlZ66MsGLqWJCnnKUFa0T6Z_4hS98DGdmooXYZdopfx4VHUpjOo6XzObKo2W4KvO1F9G7apIQSJJGVagvJeLLAGkX8PZri7sPqGjXeho0qnfEJZ6O7ik-FRdRgDRHdE9DS9l8lA6PsUL_f26RX4NFF7Aa3gX8_mTiaosupTBoSGXc9B8uy8d_Xcd-YmVAZOitcmnATDSMbTauPKdyAqsLm0iT8ULPvLZN-FICf7RAvjs1FJT-OLgpjkbyFg3mondCxC6NxJwZQGBAJrxbXiGLFFsNuuZwbs4ME2L2p-vNIctscxC1MCvDUMnJ9qtBNtpSNLlhd6N2epO1m6JxcHorw-GEE0rIc-g-siIacVMTjQf4IyM8P0MNliR5GPTiqlY_Ednfe3bcww%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmoney18.on.cc%2F$0;xdt=1;dc_omid_p=Google2;dc_sdk_apis=7;crlt=T_qYeOH)mT;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=27;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.66.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7a38a0356b8d7f8869459a31856508bfcbb194b6b82e275c737eb2720f256ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 32964
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:12 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 genIndexDetailHKJSON.php Show response
realtime-money18-cdn.on.cc/securityQuote/ 810 B
682 B 21ms
21ms XHR
application/json 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/securityQuote/genIndexDetailHKJSON.php?code=HSI
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc3c219608894d9a73aed13d9f125812181c4b9abdc720acce5fbeda284a3eca

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 0
etag: W/"34a1a792e5e16f3e54975466df615232"
vary: Accept-Encoding
x-cache: EXPIRED
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=5
cf-ray: 858fbcc86c04558d-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EA9D 1 KB
677 B 3ms
2ms Document
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 30053
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 06:18:19 GMT
etag: 48472445140208031
expires: Thu, 22 Feb 2024 06:18:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2205 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 27c1c5ced5800865594d3e12101b14ac76fb0c9463e52c68dbdeea1a1f6d8806

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 5D93 51 KB
20 KB 3ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b47f12e5c46755af00c0d4fd2ff086e28a3cc486acfeab18854cd838db1d8ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 07:54:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 456263
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19867
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 07:54:49 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame EA9D
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESENf89PiwsnB1eON2WtdMsPI&google_cver=1&google_push=AXcoOmQh4dCyUHCLWJK_zNRug-akMhtYiEAdmTcKNZFW4n-wcCuYUovbDAelQapA7Ix1Ap50nRpRsaFbIwcTd9SIORZXTftpofVgt...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENf89PiwsnB1eON2WtdMsPI&google_cver=1&google_push=AXcoOmQh4dCyUHCLWJK_zNRug-akMhtYiEAdmTcKNZFW4n-wcCuYUovbDAelQapA7Ix1Ap50nRpRsaFbIwcTd9SIORZXTftpofV...

43 B
426 B

180ms
173ms

Image
image/gif

104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENf89PiwsnB1eON2WtdMsPI&google_cver=1&google_push=AXcoOmQh4dCyUHCLWJK_zNRug-akMhtYiEAdmTcKNZFW4n-wcCuYUovbDAelQapA7Ix1Ap50nRpRsaFbIwcTd9SIORZXTftpofVgtUfASkzMnG2SIcez7Zld-dRRnG2ridQ1KdJ-KT8CWday0srzkO76MjI&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQh4dCyUHCLWJK_zNRug-akMhtYiEAdmTcKNZFW4n-wcCuYUovbDAelQapA7Ix1Ap50nRpRsaFbIwcTd9SIORZXTftpofVgtUfASkzMnG2SIcez7Zld-dRRnG2ridQ1KdJ-KT8CWday0srzkO76MjI%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.18.24.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 858fbccbdc59aad8-SYD
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 784
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENf89PiwsnB1eON2WtdMsPI&google_cver=1&google_push=AXcoOmQh4dCyUHCLWJK_zNRug-akMhtYiEAdmTcKNZFW4n-wcCuYUovbDAelQapA7Ix1Ap50nRpRsaFbIwcTd9SIORZXTftpofVgtUfASkzMnG2SIcez7Zld-dRRnG2ridQ1KdJ-KT8CWday0srzkO76MjI&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQh4dCyUHCLWJK_zNRug-akMhtYiEAdmTcKNZFW4n-wcCuYUovbDAelQapA7Ix1Ap50nRpRsaFbIwcTd9SIORZXTftpofVgtUfASkzMnG2SIcez7Zld-dRRnG2ridQ1KdJ-KT8CWday0srzkO76MjI%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 858fbccabad2aad8-SYD
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA9D
Redirect Chain

https://cr-p1.ladsp.com/cookiesender/1?google_push=AXcoOmQSSS582nlevTbun6CcoI-hDLlTIH-DPeyUvN-XN_o1MkWJpi7PxjeGG-2T9M-zFwptLpnZf9uf4wnifuoeoZi37hF6Dic26EOwdRpu9-z4LaBQWACll8RWGEefzZJFyZpuhLUJyC2KPk...
https://cr-p1.ladsp.com/cookiesender/1?cr=true&google_push=AXcoOmQSSS582nlevTbun6CcoI-hDLlTIH-DPeyUvN-XN_o1MkWJpi7PxjeGG-2T9M-zFwptLpnZf9uf4wnifuoeoZi37hF6Dic26EOwdRpu9-z4LaBQWACll8RWGEefzZJFyZpuhL...
https://cm.g.doubleclick.net/pixel?google_nid=sonet&google_push=AXcoOmQSSS582nlevTbun6CcoI-hDLlTIH-DPeyUvN-XN_o1MkWJpi7PxjeGG-2T9M-zFwptLpnZf9uf4wnifuoeoZi37hF6Dic26EOwdRpu9-z4LaBQWACll8RWGEefzZJFy...

170 B
188 B

102ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sonet&google_push=AXcoOmQSSS582nlevTbun6CcoI-hDLlTIH-DPeyUvN-XN_o1MkWJpi7PxjeGG-2T9M-zFwptLpnZf9uf4wnifuoeoZi37hF6Dic26EOwdRpu9-z4LaBQWACll8RWGEefzZJFyZpuhLUJyC2KPkR6Q4X-oYM&google_hm=AVnNs0JlYdntks8AED1NEUXt2MA

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
via: 1.1 8eb3faf3f05da0ac024b118287e8d2bc.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SYD1-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=sonet&google_push=AXcoOmQSSS582nlevTbun6CcoI-hDLlTIH-DPeyUvN-XN_o1MkWJpi7PxjeGG-2T9M-zFwptLpnZf9uf4wnifuoeoZi37hF6Dic26EOwdRpu9-z4LaBQWACll8RWGEefzZJFyZpuhLUJyC2KPkR6Q4X-oYM&google_hm=AVnNs0JlYdntks8AED1NEUXt2MA
cache-control: no-cache
content-length: 0
x-amz-cf-id: CZ6wSiQCU9t0191aTbpkv6MN0koFPWryLxw0RVrUlaJXtqvCgumxJw==
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA9D
Redirect Chain

https://dynalyst-sync.adtdp.com/pixel?pid=10&google_gid=CAESEBwnIA0Z41fzM8ZFzL7OGaU&google_cver=1&google_push=AXcoOmTWBZ4PcTFVwOYACYY1SWvUJjA8K7D2A5PGCSQ8RvXtqlTZX2CxJ4R6uMJzN7Olg3rgiWkZNEcbzIQgF6j...
https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_hm=MTg3ODUxNDE1MDQ&google_push=AXcoOmTWBZ4PcTFVwOYACYY1SWvUJjA8K7D2A5PGCSQ8RvXtqlTZX2CxJ4R6uMJzN7Olg3rgiWkZNEcbzIQgF6j-ONIai...

170 B
188 B

102ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_hm=MTg3ODUxNDE1MDQ&google_push=AXcoOmTWBZ4PcTFVwOYACYY1SWvUJjA8K7D2A5PGCSQ8RvXtqlTZX2CxJ4R6uMJzN7Olg3rgiWkZNEcbzIQgF6j-ONIaiU-X5g6RBXfVd6Da094fuU22Sj7SSG4sm3k14rBfrMwRHwaLDuiTIk2GjF80AeU

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cyberagent_dynalyst&google_hm=MTg3ODUxNDE1MDQ&google_push=AXcoOmTWBZ4PcTFVwOYACYY1SWvUJjA8K7D2A5PGCSQ8RvXtqlTZX2CxJ4R6uMJzN7Olg3rgiWkZNEcbzIQgF6j-ONIaiU-X5g6RBXfVd6Da094fuU22Sj7SSG4sm3k14rBfrMwRHwaLDuiTIk2GjF80AeU
Date: Wed, 21 Feb 2024 14:39:13 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA9D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sVVSgjFQSJeUwxjxbrIQrA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

104ms
103ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sVVSgjFQSJeUwxjxbrIQrA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS2KeGjtmufH48v4KdK2r9HxzuZUKwo9S7rW3Jt6R4ZKl7MC7eyd6mY3RevdPG7AaWzJId_1IupXPOWQf27V4WovscozZeMiT0KN0RxQV77AQEPXEGVglq6odX2t01_ku58Dn_PDzPSd76N-RitbF4

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sVVSgjFQSJeUwxjxbrIQrA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS2KeGjtmufH48v4KdK2r9HxzuZUKwo9S7rW3Jt6R4ZKl7MC7eyd6mY3RevdPG7AaWzJId_1IupXPOWQf27V4WovscozZeMiT0KN0RxQV77AQEPXEGVglq6odX2t01_ku58Dn_PDzPSd76N-RitbF4
date: Wed, 21 Feb 2024 14:39:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA9D
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESED525huJuhJTjWwtEDMATgI&google_cver=1&google_push=AXcoOmQHjqb8jmrNpuXCM1ggf0Z-EUdkSfPAaNzLz_pDwKt1482F7d22uLRHBmwVUEh-JiUWqjKLWDwH7h6lYvHosm-7myihYfs...
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQHjqb8jmrNpuXCM1ggf0Z-EUdkSfPAaNzLz_pDwKt1482F7d22uLRHBmwVUEh-JiUWqjKLWDwH7h6lYvHosm-7myihYfsZ-iIyUZ4_SOV1TJY6VlfT-C-d8DQQDJJ...

170 B
188 B

104ms
103ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQHjqb8jmrNpuXCM1ggf0Z-EUdkSfPAaNzLz_pDwKt1482F7d22uLRHBmwVUEh-JiUWqjKLWDwH7h6lYvHosm-7myihYfsZ-iIyUZ4_SOV1TJY6VlfT-C-d8DQQDJJ2tGZwEKxzQGn4QgC3Tu5hans&google_hm=Vl9yX0FpaXR0VWl4cXZiazN2Mzc=

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQHjqb8jmrNpuXCM1ggf0Z-EUdkSfPAaNzLz_pDwKt1482F7d22uLRHBmwVUEh-JiUWqjKLWDwH7h6lYvHosm-7myihYfsZ-iIyUZ4_SOV1TJY6VlfT-C-d8DQQDJJ2tGZwEKxzQGn4QgC3Tu5hans&google_hm=Vl9yX0FpaXR0VWl4cXZiazN2Mzc=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H/1.1 200
OK ebda_cs
y.one.impact-ad.jp/ul_cb/ Frame EA9D 11 B
218 B 730ms
106ms Image
text/html 35.213.109.249
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://y.one.impact-ad.jp/ul_cb/ebda_cs?google_gid=CAESEA8hYA8CMEey_4kRfiROmSs&google_cver=1&google_push=AXcoOmT3_vF98wtBnLE5TldzRRu4hSRJVjJ-xyRR-y3m8V4yqOdpy1wVWnUsm3hzTA-VYFQNmctg0cU8e75WGB-kM4YJOhBFa6OqAo4nmlZe-6Kvi7RlJtGZuVdHXvrzhsKTNNbruW3Gt1fJpTHuugY3Iv0
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.109.249 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 249.109.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 21 Feb 2024 14:39:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 11
Content-Type: text/html; charset=UTF-8

GET
H2

200

/
onetag-sys.com/match/ Frame EA9D
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEGv7GAG-b0VTunLOAUDxE-4&google_cver=1&google_push=AXcoOmTGICylN5E2wVxjd7cCG_dIB0OiaGR-kh7EzPoP4ky4VXgdUdVt_oUlZP6GFq1TsuFFF1rS1sRUjuF...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTGICylN5E2wVxjd7cCG_dIB0OiaGR-kh7EzPoP4ky4VXgdUdVt_oUlZP6GFq1TsuFFF1rS1sRUjuFHpCQB7eycys_dcLjFQGTHYdsSYAOAPTZrsfX2...
https://onetag-sys.com/match/?int_id=19&google_error=5

0
200 B

211ms
209ms

Image
text/plain

51.79.154.9
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.79.154.9 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ip9.ip-51-79-154.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame EA9D 0
12 B 97ms
96ms Image
text/html 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KG6hgnLtg-MttG-TK6Z5Q5l4PJl97e9lXRDhnjoyo6Y5hLdM71DhBQIdEfO6UGoPt4EvgMHw

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 OBZ240221-15294-21-M_hd010.ts Show response
video-cdn.on.cc/Video/202402/ Frame C840 15 KB
15 KB 20ms
20ms XHR
video/mp2t 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video-cdn.on.cc/Video/202402/OBZ240221-15294-21-M_hd010.ts?20240221173525
Requested by: Host: hk.on.cc
URL: https://hk.on.cc/module/player/hls.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3fb9a771358bf7e2256a5d72f19329e0bc398a07439c5cefa284b606492bacf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/video-m18-new.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:12 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 09:35:26 GMT
server: cloudflare
age: 17691
etag: "65d5c3de-3c38"
vary: Accept-Encoding
content-type: video/mp2t
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=31536000
accept-ranges: bytes
cf-ray: 858fbcc8bc28558d-SYD
alt-svc: h3=":443"; ma=86400
content-length: 15416

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 42D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP4hfiPKPDe_kfKss7xnu3U&google_cver=1&gdpr=0
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEP4hfiPKPDe_kfKss7xnu3U&google_cver=1&gdpr=0

43 B
61 B

100ms
99ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEP4hfiPKPDe_kfKss7xnu3U&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNXI_vBF902ZVsvi245KGMxor9EQTo_7zZlUiHcHYIVex9y_l0P3tN9K-Muc3XqeO6Tb2dWzj0Kbv08p8mTLlFLkgU-dT7ecq8JaSl0hUpKAsDLO5Do
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEP4hfiPKPDe_kfKss7xnu3U&google_cver=1&gdpr=0
date: Wed, 21 Feb 2024 14:39:12 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 42D5
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTRkODE5MGItMjA4ZS0yNjhiLWM0NWItYTFlZjQ1OGEyOTJk

170 B
188 B

101ms
100ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTRkODE5MGItMjA4ZS0yNjhiLWM0NWItYTFlZjQ1OGEyOTJk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNXI_vBF902ZVsvi245KGMxor9EQTo_7zZlUiHcHYIVex9y_l0P3tN9K-Muc3XqeO6Tb2dWzj0Kbv08p8mTLlFLkgU-dT7ecq8JaSl0hUpKAsDLO5Do

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Feb 2024 14:39:12 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTRkODE5MGItMjA4ZS0yNjhiLWM0NWItYTFlZjQ1OGEyOTJk
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 42D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
https://sync.teads.tv/um?eid=3&uid=CAESECmPm56aPA3qSmxBE3DLn58&google_cver=1&gdpr=0

23 B
278 B

188ms
187ms

Image
image/gif

23.202.168.6
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESECmPm56aPA3qSmxBE3DLn58&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIT-3gIQ3I6m9wEY_ezohQIwAQ&v=APEucNXI_vBF902ZVsvi245KGMxor9EQTo_7zZlUiHcHYIVex9y_l0P3tN9K-Muc3XqeO6Tb2dWzj0Kbv08p8mTLlFLkgU-dT7ecq8JaSl0hUpKAsDLO5Do
Protocol: H2
Server: 23.202.168.6 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-168-6.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 21 Feb 2024 14:39:13 GMT
pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESECmPm56aPA3qSmxBE3DLn58&google_cver=1&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 292
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 42D5
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YjgxMTBkYjItNjBjNy00MDFiLTg5ODgtM2FmN2I1ZDFlOGQ3

170 B
188 B

99ms
98ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YjgxMTBkYjItNjBjNy00MDFiLTg5ODgtM2FmN2I1ZDFlOGQ3

Requested by

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
server: pekko-http/1.0.0
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YjgxMTBkYjItNjBjNy00MDFiLTg5ODgtM2FmN2I1ZDFlOGQ3
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Wed, 21 Feb 2024 14:39:12 GMT

GET
H2 200 O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 8B1B 51 KB
19 KB 2ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js

Requested by

Host: money18.on.cc
URL: http://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b47f12e5c46755af00c0d4fd2ff086e28a3cc486acfeab18854cd838db1d8ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 07:54:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 456263
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19867
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 07:54:49 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame D0AE 12 KB
4 KB 3ms
3ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1255798.4078729MATTERKINDAU/B31307780.386243046;dc_ver=99.292;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;dc_adk=1033480528;ord=zucvbh;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkSalDgvWZdrQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QDRjcqed3eWLmuT3l5wekzR1Qls2p6CCxyjJUom7-MRyeILe1RZbcRPwJ9LUyLfISxJNTPRU-Ln2gFcblxYVtci0fAFq4oKCRDopqwKQA82-9LIGhjJy1FhUIym27aYqrXV66Rl24-kJpjuv8qWNuTvcqeFUh9F51kcu8Jh_kWVEOEKI4DL2nI0tWLt5sxMhLPzYa_u4U-jSYxlNKI-7GmSy-k4p7-unR6TKhD0PtSNfcMD3Cb6HpE4RJ1rlREa4jW1_bBEmrRYEqsGMm6uCITjuQOTzI4yCzMmvXly0HEdntdJ9zZjB5-g9fuDmfftU8GwRvR3w32gtWPEodWdaqaHgxKK33ewWsKb0ss4byn5tNzljdRLzABK_lh5TKBOAEA4gFlKmyi06QBgGgBk2AB_uBjNcBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAtgHANIIJAiAYRABGB0yAooCOgmAQIDAgICAgAhIvf3BOljwseDR1LyEA4AKA5gLAcgLAYAMAaoNAkFV4g0TCLCK4dHUvIQDFXPkcwEd_BkCLLAT4pO6FtATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB%26sig%3DAOD64_2X3p0wNOSFucRS8_ztAy4HOBabzg%26client%3Dca-pub-1862194061110379%26dbm_c%3DAKAmf-DOOii5ljeOEsLFEUfOU4sp_qPD1xRC4Uvt0zpExFp9uT14tpqhQz-b-4WOGaA54cgy2JWy5-TVyvVfU7w1ehQ7a76JxUrkSiDWOi9amCO7rPJ78yOyZ8R9wIEGLv9EQTvS3aiFsk0AwKisoV14RCdTnQabkqklV4VyHIhI6Vu8-spQG28vxyazdQKbuFll_rF5mycWJ9ur3BtSMnuc9NnEXe7PpA%26cry%3D1%26dbm_d%3DAKAmf-AdcS1nKy19Pp_UJOdqrMbFzU-PrzstE2C_x6TUl3SEK_a-EWCFnjUvn2IlLrzSxEHzEHMv1T1qI3RrXtz82ppnuvyb9420ZmrH_eUDG0y1-kJgtisSSUE5beikGPMJ5joYE3n2dJ7hYw5BPGPwFx3lojh-BvHHZREYGZP8i4tnYs33VsOgUzuu_QpHkrmm-12UqdQc4sZn0nxEKmkbRO2G9-1FWSMPrV4TVI_TzlZ66MsGLqWJCnnKUFa0T6Z_4hS98DGdmooXYZdopfx4VHUpjOo6XzObKo2W4KvO1F9G7apIQSJJGVagvJeLLAGkX8PZri7sPqGjXeho0qnfEJZ6O7ik-FRdRgDRHdE9DS9l8lA6PsUL_f26RX4NFF7Aa3gX8_mTiaosupTBoSGXc9B8uy8d_Xcd-YmVAZOitcmnATDSMbTauPKdyAqsLm0iT8ULPvLZN-FICf7RAvjs1FJT-OLgpjkbyFg3mondCxC6NxJwZQGBAJrxbXiGLFFsNuuZwbs4ME2L2p-vNIctscxC1MCvDUMnJ9qtBNtpSNLlhd6N2epO1m6JxcHorw-GEE0rIc-g-siIacVMTjQf4IyM8P0MNliR5GPTiqlY_Ednfe3bcww%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmoney18.on.cc%2F$0;xdt=1;dc_omid_p=Google2;dc_sdk_apis=7;crlt=T_qYeOH)mT;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=27;prcl=s

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:57:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:57:01 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D0AE 111 KB
39 KB 411ms
2ms Script
text/javascript 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Origin: https://ad.doubleclick.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 20:46:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64356
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 21 Feb 2024 20:46:37 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D0AE 41 KB
14 KB 3ms
2ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:04:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455659
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Feb 2025 08:04:53 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5D93 0
56 B 139ms
139ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BdgR8EAvWZbOnIaGV9fwP6r2GsA0AAAAAOAHgBAI&bg=!lpWlldrNAAYBC1i-IQs7ADQBe5WfOIHftONXyGLX2OdBxzWNkMU9_QlIZYPWcJRBw1crgErP-Lh2IaYjfsafApi2M5Z2AgAAAKZSAAAAAmgBBwoAWfwc3YJ__lkE9tQM6i_CTFllGYQy07Vzcoza5mxSM-m_EhYO0NCrNrVuCOyb2Q4ibEJ_TZRQmabm1lR8jEI5tsY9iCtv6jxNt9lYbc9jGM_NRCOBm_tfs9qImQMURpiDDn1psM43QHt3cv2EtdkRis6uBb4gZ4EjIZQeDEBOuNeNDY4RDXEr6Yy6F-ZtKvc7PrkDK9FgfrQoLp-p2fVHB0HPOyUjwTmkZrSsFyTx3_aWMeJHgvfupvjD8-GAN3rgOKUebcvUUJsGOtrRB3-4HALFB2SR5-IuLtK7xWwX5UyqWWdVsaL2xnmtb_BQeDDgfYX7TqttMJz92D1bZ2RNEEP6xEt3_7oL49nYa2HOAz1Oe1ZjzNBB9Q6iXWh3AITl6uT0aZZqDrFWR-P2Y0JNJNYs8WLlEIc-Ka_MHCJylkuqwkVWuJ5MVizgdd9cuiQolivJPa1ZdQEtIGg3-bjNU3vakAnQIdu7nL29Ci0jiBm1Raw0TafVQQ3aQuVDceXEsNBJj6IY8VUCv1eoO97Lro9iyMokkGMVFr222zWqECKUXlti9HBlu30XjWMAekCoaoPeJ-OlZxOFSp4tKanqQ4wXSrMoNSlmbMpLEFG-vWVCQuwlZ9ijbWy79GWSRzM6aYahTBX57a0Nu2NPkDUPMAC1C_9rPkj1gMQ4UUUZSz1WuxLn2Zn9-zga6BlEWYeNGml0HQAHHUciVqF-pEUw6grJr9tF367vUtqc0pN5NzSD1G-cA6NKaF72dDwTdSGCQqVL55QiyUx7Q0WKJ3F2E4lIC33fj599BqPNFDnf9sserAk_uXNAQg-ySHyJHcOyplTRfc6zY_35XmneUAEeVklivdX--vIu6ap57yN5ZNoolehqWrq5dUD4JtwW1RtKy7ghF1KP482NhGaAaa9_fRwGCNCn7ZXKjbkWdlT6LX3E-9gTFe1gM1sJV061Jea2hCYmm9PUGEDlz264WMpjZcVH6KpBp7VkjtyWCS6SeZkWKKlFApcG8vahn2jXOIxO2vcuNnXZ-4vZYItGMVmY1C4yoywUIXKdy_0LLrvMesjxASMwcBnYTemGpcrE0JQCETmml1XxvTbLJIhus5BRfNhac_RyQoOHxwJR0qShb0yr6Zg_HMWinOMJqsl4oJ5MfgqQd1iDgHyTl9I5ZDbF-OM

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 6B78 38 KB
13 KB 4ms
2ms Document
text/html 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 82726
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Feb 2024 15:40:26 GMT
expires: Wed, 19 Feb 2025 15:40:26 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 6B78 51 KB
19 KB 3ms
1ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b47f12e5c46755af00c0d4fd2ff086e28a3cc486acfeab18854cd838db1d8ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 07:54:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 456263
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19867
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 07:54:49 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B78 0
56 B 140ms
139ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BiyY7EAvWZZOBLtLXmsMPgJ2_2A4AAAAAOAHgBAI&bg=!TU6lTgHNAAYBC1i-IQs7ADQBe5WfOPcD-2DECz2-iexh8Cel8GDelqJ4wyCTBidy7-a4stfepmEWVqVRhmve04_AP2DIAgAAAFRSAAAAA2gBB5kDMX6f-oOcuRPssdkJY9DkkVO0qllCwlDTGQHUyxtHS5bfz5BYQrnTDlrEfpcCjKZerSZ6VRYGGU1o299lH7rrauCmp4__faPLrmcmh5NarF4In3O61ETzGKYwBpGlPo4rDgKHH5sZQZLeWekVpNanV3lbbgRrK21hxvEVIBvnzQEgZON3V-NF7ZNj_Dccwjt96OVWIiGCdYKZj4-f82np0Kh3XU7C7XCyeOV-X3QcCgZKOuLaOX52mt8oGONv3P7RWUl8q9tWBRvlldFCq_VK5OqgPA8QfZOaMykfwkG9hsh_IGwA-2wsfLihdzJBJSikRweKl3eZ-b45MuhUsu2wUmkSQ69TxXv9QABusfV3WwkYDK7prw6trFjbwhdfIFPbSaid5EQXlwfavL-XewObpULf4WPMfcDuHLVNmDAJwqHQNpw-eumovQYR5lSDO3LPP2ipecdX5YeGjkWxW1O3iVIx0AsQCwV_aVvFdxZfBu0eke8BdFh59HHei6jlKfdibPYNHdflHwJEq7O7Yy7ulX1Y3_zhWoEbwQ0uN0Ttase0UcivOKwTUhBHA5EUhUZt3ipC96cIe-sQBY5lubPh5TLA00cqf4vjTsT9THagaQzB0my_MmyUjifhlIhidm2dNwdllT28hVqjczUnpqjUoIArqBy2zGRI5tKMkn0gn3za6BfaCRYb80L9ZZUOIPngJJ9bHga6wh_rr9R49cVY7oQbSylX6Pf3Vd2LMFGcvikJDXYMmSOn6Cl6KuQry8yTFo0b3T-zD0Tw1ArdkcuN9wXhY091kFzUlJVvPWx_fVAuuyqrNIvGfWI4Fy5eYEYXfyoiJ5VIVHtZ4aSezQCG6s3jKFXdfcnC6lnEb4YrNRKmXwQDyoWsuLer4EEYTDIQUeFjLWEWTSDlTL3ITVbS6PCOBtxiErRJjkg6OCo6RfHF_i6eJ4H0yQRlyFgtUgubjf7_g_VoTAAcs0J9aJ0gA0tsuwFpJ928AHg8l52ZhCz5tlW3ONZV36ip3XOdMAp8rC4UwUmzek6oPY5H6nxhh0LvthQMkWDjXFPUMkPrPoERGN0bUZeHzswA1mBkEsaYVqQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 74D3 30 KB
11 KB 2ms
1ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CJPUasuaCJpmLnyDEQU8KGvHZKWDMbaxdxjx3AZRJWBjYVCj1ksT3vChIOI-rjPigG9o9_dXeyV-S11jvuXcXESM6agbqJD4zgHLhL3IjVTRHHRe9QBsIdahOzfMVOx1KDHpgX5ySwTP2kJc_xNWhEK9twDrUsoToun0ctj2X9smCVScBjxsqaM-RUBxLFtrHRGi2FHSP2WJsJm9RJo7BG62Vo9g&cry=1&dbm_d=AKAmf-DF7rNIfwNPXAA_SeB54lhlg_qUuF57PpG-IS-LXIbD--28IQQ87mHjGW0icRGzvPwukA0sWHWUnqFDtYcoEbu5dZ6Uqlr41qPjTnMU6kgHo2mqHkp7ebobVgkA9cVyaZE1EP3PdaZaVIgUEalleSZsff8xzyFdZnaSqZWaLgKrMfR30bJN4W1bUD9FWww9Qj4etlX2XWn0mQR8foCZJ7eFUuSg2Jq8p8f0BMveOAWWDDVf8iZGufdrjx80A3YKfpJayIa_P5DLPqcRyAoWAK8cMY4AwG6LDQPyFwlVAhUJcyPSbu8yD7KEFUgPpJsWHop355zkdJjcZCISfCdB2gNoPE7zS7ZdKcWWwRnbhjm_uf4-4gW0DA-yKQZiHNK6hXPLlT6YeeVI6W5BFHvJ7z5E5XQPiqUPeMclUCFJ_P31FT_y1GwdRCDoOtvV6mzhWKi63A3mgtJH2vIQwH9y8ljQ3XiwoohOlI9T0UzFHKEOnTrL7hhjkPFuASFIPneXy22xI_59yTK5jaV8yQxmHWOrQOzfZ2jBjjyc-rbZUXVczlym-F-oWw9ShLC57gjy9YJzFLIUzjGf1lx3BDC_X6bf0Gk9Ux-b4SBcWI1y6odzUWQMMhpb7Qv6lJwjTYMdGu_gITtzQA0AZtGEg_Tv85tEilIgX8n4APiynm0oDRHwSjai1AP2YMXAU-er3qpFJmS-Xikw29PoDreRrSE26tsjoacYTxGWUML3qkLe9zMp1MvzwfqjHm5TB3ATsHVHQA6mEgMnBcyLH2p03ZDa3KoLuAwM7QitwIinJbDDOk3XSxRChhgySqswFLbOYxANRKVvdwgJElscQF9RTFJUo6uYyLar8uK3BMM2S4bc3cAymBPewz8QUlCKLJ1wxidBXgxd8AZE3BGJHCGmq94qlfrA5MgRNigCz8ABQCpbukMibRlMysyYfAf0GNo09-1o-P8lzjPtguNWAnkZ6QBIZuap9Qs-8eRoY-r0SexawW5CsruaxYPt2wDTAYyuRNnuMXyHM4fmE5qCn4vBoZ-xwYXVOUEVfFflvKALfBSg7uCs67mZUnn5gRQc1xLh7P9Ea6SUdm2Xl4kraBI0QN406-F57CB4GXtZqL6N7UDXNDLXbSv1jk2RrdT7J2pncEd7S08WVz0AvBSy10reh84Fsm-dIwAOacgxuRzF8t2MPWXKpcnwuhVCJbJaPW80xbShrMOEReJwR2Fgw-Pm8qW7KA4FyTrn-Y5zqAicY6bLCFHAZdkc6usQkaPWVx0xCkdXMZxctIY3DyTxguuNuM0Ww1XjnmNtmAo9WJueJM8-hRWyyK4QLMyLQ_zXrRtE6w11809xNbrWiAbmJDMQZS2IuoQiDSgHSH-qYbSwPEqarBeNZ5knYT52tM3BEXyKaNoAVUq_JF4DZ0tMfkRQ0d5ui8ER8zUcMXwkwdq597TDX1SHEjW5lxFnC3bKA4hCD04yL1T1DwIHbbaYogvO84JgUOsEIJYzTzcg37zZbUZO9M8fSktNsYWiOW5cwSLVKSWCEZt_sLHSbkfqQzXJkk5SxSAVc86QtV0_ZY-RrGpsYp9Lmhh_g5Qd8BTJg9gXQHEBAQr8lZupXFPR0R5lYmtIXHlCQf8RnsT5i0ACbZdb7Szq9DhH93fCULp1262FK2CsRTFqBoGFSt1nkuX-gM79vu6subcdya-tT0qATutSPSF-VvSyEa9Bp6gGDq93cwX0ReKkB7aXJV7c667_5EdKEwNsr9PkAn9pa881amyOoIfUhOfOG6dw6F1rC3y4WH2jWxy9WcwcrPnG2jm27fdgvHUNJ6to8Q1q6gYyfg2EkXG1FWb9JFwznbkDjrABLbNVakAOognleolMlzFJQPH683r1QinPbW6PgzPF6y0UkNELAGRnSzBuiKPxBzZjD4-tusnHfgYHB6rn2p6aOelELEmPtUU1Ar9-S4dWd-3WEQDw2WeHlq46KLop7ESUHe5Fo9RfATIA6sGQeg7clvHO3QB_6cZrl2gQepV8z3xZZe8TQwqQesYlatiGZrMFHYdT8UMOVg_IfECTrGJFoM4p2q0CVXusJP6sra49kk6V_jTu-LHSdqSLwSOjEirh-eAZx650bFzbm2boZoBe1uICT2MX9XYx-IbUybJM-MJzxu2etKpMDRg2M0wxx2r7W57fGvHeifjXYKsb-2KexJ9IA4bM_S6lCUsc6y_eSrtqzVCJVVwBPTMVoZYUoxpZQToH7VwWrrcvVRtqzgXsKsFzASW4AdcQmCpOXjmzeKea4wACCqT2riHbRNm2vCxYAS97d1bpZQCRjp8sY9yiNLIIJ-RwXvO-qlNjtex7V9Tf6BnaWsrKdGqm8f4kpgvsI6RrG7MC6KQ8KUsRELnkKrhAp1L2VbjMbdVvke6lfVTi4cm5S5QGjAx1Z4VeugoL5Nh54KbIQVg66VAJSRPWyqVGiK5z-TI-_6j6gWzeTxixz3Y9gEHPfSzPFAwFFP_HilyWSHnvu1wvUIYoAASBn2ZVoF-UxN5tagwN_nhnWYP5vjUsnwgtHt9ZtVPl8v9Xmb_T8-ztXQ-ptTmMIT9DGY07qhmViV8g3YqOBcVTTYpEJFwXtPmZrdWNkiK3GAIdk77fikBb5HbEs8fXT9Ty20Y_JERhPTMscGLm7obOSs9FMPUjgtt4X4BdZGRbpNioY-WXwTHhHkq4fVKoV7nOOTDwKK-jeok-5jjhZF4QB-Z08oguegElqRfcz58iQAoZLomAEAuRLv2Wn3S6gdpJCpKO04hmlF306Dg2b7ptj-Z2UojUSCnokMe4n76GfyZOFZIwgJwTQfV6eGLTJfGSm-mQm4hIUxIHWHKARqtCngoj0C4O-_t_7iksa9hcC5yEkPwAe4vRWFbF8OeB8V-i90wZdehckwL9Chg1pc6_LbgA3Zx91wgtDsOg91CCcwuGrfZU6vJwTdnMP6x5_b3A33psr4SUbKJJMSjOMy-jB218yyqcmuTWgO26zvmNBM1SJ-6RwT1QZKJEL0WRMlvKBpWR9zAKsL1Z1H3FsbsEp9iX47tUk3ShsD8sAhZ903iJCiikMmKTDTFSFpot2y6P2N4vzDxIVBSjJ5EZkuKgWjXkaZOY25n9tGcnsRGc5EIGJyGXBs-tQBM4VxC7fTqGyee5HgMKpZzADbgFNJ8qWPiXoBJnaVse1XcwG-kyq-4zZo6TWhEW6q553afrWqcdJsne6gkGRzKjoQoUrdaBeITf1lBStxIzFi_QQzuHQ1PXEgPEUWZPBZ4F7A8Fgoh-1h7r_MO1RGhXubqFr_AkmW6Lnt7PA3HXoBXL2ZalTw-YuIeu8dw3jZ9Un5zOGB8r_SzdkYKqOFQtbsgCugi42tidYncy-B2K-FhZt3GeZ5Z-EAu0lKlxlpfLmI4xzRG4Cb66lJoby-QhM1XjZn68DrLI2I3boVxaAizGUOpIX21BiQY_tJ0zba3wTWOOB5CzuGzYwWoGuDB6wfbAeDcfpXukUIPzJfer7V3ndhIyO11EGWfBHu6W1V5RpuHB_VuGSjSJR28_wRStKNSWupkWUFaVM_sQmZxssEPwDy6dWN9MzPHeIrj31R9IHUUvOenK0ovoRNoOoBBCTJDmkzppvqV4chxvPs6Aws9w69AAvryPfuQyZGDEZzLM5a0qU2vvq3ermacUAt44MMHqrwmwCHuGpidj1eTE49CRStVVdWu-CDmQ2YVBtNyNhMKxz8DRn1JLmniSq2aaixWvNZ8ixokecLCBZwwSAeXO285XPfziWmRlP_Lk9I8i-ZgO7mrmWxrDSyN69LEKCmtEzTv5Aa3UI8iY-J1Gi5X41xLfayzSRVs9qPdytrd1np8rcuxZMQtqWjFawlcj3B1oO7ca_zS3yAQhhCKMToYeYGEHyIs--IYh0vSz1pRl37yysYljwAgW3QPSJcqv618mfz0mDz466kI0Dzwf9K8lF2yxZnKTqP9-diXSmxu4BSe13CLVrEq-B0-m3mYbOFKWsu3gr9TAi0L0_92g69BANVgfda2CVbx80EiKX8R9Mpg5j4ibv8sVioladJcS8M7j5_FDnxESaBhq5tofK4C7Qb_HirDZLd6VbMEzmRsvTczapnQRKvO_WvvF2HhygPEHqPKJQWP5_lwlrdmABHtEQ3Pb1KJ30rIs34UmP9W8CRg-OmwuCNrflkfjnEEFQnPF5v838199jRrh6t-UqWWpuUPaKqto5NWg_YZhS1MUnSVSiv_1YEp4-ECbiodQD_4n2BtWvjAjAQn2cfozpX6a-YyOXL82LV10bZxFO8UYp3_3vN5M0fP5WqG4mNUL3RPy_6T601fkVFvUJqC1eLvaHdajU0w7zaTlUA4OaaWJcm_HtCLDqnCZte5CwcgpSMdt5yR1-ABXcJJZATxkRLiyYvWwK50RJlVGEjsRA-VYnKZW8m0j_SiQMtixJi4sfPlIRV0g__0mfIfqN9qI8TCPZ0I0q6qT9i12AqyxpVxT-Hi-ghXolusat34U3CEfySNpH1PrxarPviZAdSQ57DYALyWAvM7OOHAfrWlKtxVNadx75L-qdCE9RMavIPm9V3I9p5ojrI1yNPfqJ_RIVW28ohFlxDnL58dz3TzKAXnijuRPMzLNdfYPDH4bAHHebg&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmoney18.on.cc%2F&ds=l&xdt=1&iif=1&cor=123522637713810340&adk=3690638928&idt=330&cac=0&dtd=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 05:42:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32180
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:42:53 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 74D3 41 KB
14 KB 4ms
3ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:04:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455660
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Feb 2025 08:04:53 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODUyNjM1MzAxMjk3MgogIHNlcnZlcl9pcDogNTg5MjM1NjMKICBwcm9jZXNzX2lkOiAyMTE0MzM5ODQzCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDk4OTMwNjUK...
ad.doubleclick.net/ddm/activity/ Frame 74D3 0
22 B 148ms
147ms Image
image/png 142.250.66.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODUyNjM1MzAxMjk3MgogIHNlcnZlcl9pcDogNTg5MjM1NjMKICBwcm9jZXNzX2lkOiAyMTE0MzM5ODQzCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDk4OTMwNjUKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL2Nyb3duc3lkbmV5LmNvbS5hdSIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNzQ0NjQ5NTkxNTQzMzA4MTk0OQpkZWJ1Z19rZXk6IDM5MTQ3ODQyODIzMzUwNzU5NgppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjQtMDItMjEiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA5ODkzMDY1CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzg2NjU4MTU4CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1MTg2MjEwMjAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMjA5NjE4NTg3MDgKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1NDkwNzQ1NTcKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vY3Jvd25zeWRuZXkuY29tLmF1IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vc2V2ZW5yb29tcy5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4xLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.66.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2e1818206d52353f0000000000000000","13":"0xc812868c993fa52c0000000000000000","14":"0xdb88d7f905e6b1d30000000000000000","15":"0x2abc94322b6e06f50000000000000000"},"debug_key":"391478428233507596","debug_reporting":true,"destination":"https://crownsydney.com.au","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["9893065"]},"priority":"0","source_event_id":"17446495915433081949"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 74D3 59 KB
23 KB 6ms
2ms Script
text/javascript 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 15:40:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82728
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Feb 2025 15:40:25 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 1B86 38 KB
13 KB 3ms
2ms Document
text/html 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 82727
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Feb 2024 15:40:26 GMT
expires: Wed, 19 Feb 2025 15:40:26 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 B31307780.386243046;dc_ver=99.292;sz=300x250;u_sd=1;gdpr=0;dc_adk=3690638940;ord=s5263k;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCypqcDgvWZdnQKfPIz7sP_LOI4AK4xMrB... Show response
ad.doubleclick.net/ddm/adi/N1255798.4078729MATTERKINDAU/ Frame AA2D 67 KB
31 KB 142ms
141ms Document
text/html 142.250.66.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1255798.4078729MATTERKINDAU/B31307780.386243046;dc_ver=99.292;sz=300x250;u_sd=1;gdpr=0;dc_adk=3690638940;ord=s5263k;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCypqcDgvWZdnQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QSiUfWp5ySNui4vbI-N_s44B8wRrXN98HbEYUgBE2G_7_xFiRHkIvlhu9GNJPSyFl2gfCIiHS2syXO8zryLQej5D_p0eYdXQuCmtQ80q2dM9V1ABydg0OB48PerGsFDwQjQJzOca1o9hyjO9R85lSDscOWWnRInBIzxEDFLHbE_CfbmpLnouLoIWnOii8zAhJvo2m6ujlp3UCQbVHvm8NrOUZ1BERyN3Nbs0rpOqGltH9MtTErbXANJPc2YHeKXfSWsgoYKBjy7sItTby-Ue1cW4ZsvYRSsZ4vz4m4h4h938tafV9ax_KCiswpUuoy_UqZL8Wgvwlu2xsiofL8WdkV4nyZFiqvsR9X4x4_zOTVtYMx7ecgcvABK_lh5TKBOAEA4gFlKmyi06QBgGgBk2AB_uBjNcBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAtgHANIIJAiAYRABGB0yAooCOgmAQIDAgICAgAhIvf3BOljwseDR1LyEA4AKA5gLAcgLAYAMAaoNAkFV4g0TCK-K4dHUvIQDFXPkcwEd_BkCLLAT4pO6FtATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB%26sig%3DAOD64_2WNcTRPFN-rHC0Imjy3bxcueXQdw%26client%3Dca-pub-1862194061110379%26dbm_c%3DAKAmf-C9AEg7rNhFa8rC1iJ0xX50g0aJwBp8aVU4B6TC6QHjhEEhoNA5EJmFrQGv-bYFUGPcoweTMjilb5Cz6GFmNF2kOrAR-BU2ctJ6nProccPKVlDqoyTAMLS6mVOnlj8nMa-MaNNdFgZ-F4fVM-wDkTSrb-Mz-AH_PpY3m4UtnmDKU8tB6ajApWUxmL57XlN6RWVM_-EC3leTnGwphhCLbIuZRAFvsg%26cry%3D1%26dbm_d%3DAKAmf-Be8GgrqBOa1P3eHWrpf8VTzxZ7V2OwrpQn7P-4JeT7HaTbCKi4XxErLay-RBTq5CaVoxLZ7JNkeH4auEe1rg-1da4soBn-C6fMMQK3_GP09JWMEVFxsD8LnJP4icr10Iel_ifW1md0PpiSE-VDEGCS78_luSai5lE3jirKZtm-5t2J29eIGgOfY9Np5PkXaLEfvts7iYtqMMqzKz87i9zVhTyX698qTe52EGfb3ssrQYgJFJl_m0lGpdLJFLSZD96xqmrVLr7XNRxa4CfhFnqgfOZK1t7N2Y2M3ZbQV_A6CIuwWh4fh5cGmiBXNkkDma8yzfusMoWzx0Dq9DxzTPIaEczh6eR6QEABGWD0i4af9XpbT7rjU4NZcUi-09TudwSyECd86NbjqYGcxb8__sZbaBUBZBw4_9px394oP0jG22KqZjVaQFQECaoUS3kL67BbqiXtQqCcPF5s5xJRk5XqoVL6y1JzMYgdHEiem4PCzFK4eQupf5VUoBNGelLXCwlRFaksC68M2fAP7FcSj27cgGUpO_XcCoMrZaolbVzqChr72SSpTJ5rFQyafU5VYsq63tvmjsTsV08fen09MgfvdI1TRZ8_RQuLcKOUmTHwz7RJpdg%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmoney18.on.cc%2F$0;xdt=1;dc_omid_p=Google2;dc_sdk_apis=7;crlt=T_qYeOH)mT;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=16;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.66.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c42d9924b2c7a768298578318b6b653a9f6a023b1bb5e370a89c6ae1b7dd812

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 32222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FF56 1 KB
682 B 2ms
2ms Document
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 30054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 06:18:19 GMT
etag: 48472445140208031
expires: Thu, 22 Feb 2024 06:18:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 74D3 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75b060a3c3c39140e3df23beccbf6a1a9292c7e96804b659fd99fb6abbd0c0cb

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 1B86 51 KB
19 KB 5ms
4ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O0fxLlxGdVrwDA1P0v8IbiijzEhqz-qxiFTNg42x2Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b47f12e5c46755af00c0d4fd2ff086e28a3cc486acfeab18854cd838db1d8ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 07:54:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 456264
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19867
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 07:54:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF56
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=1&acc=crimtan_au&google_gid=CAESECTnHdq5Z2itgDIn3gCMID4&google_cver=1&google_push=AXcoOmSCRoMXzMIF41nL0k8crBwSfXn7u97sWiXBsuc-29tcGZo3XzwAQMxzHWts1QGKz0Bgch0kT26...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSCRoMXzMIF41nL0k8crBwSfXn7u97sWiXBsuc-29tcGZo3XzwAQMxzHWts1QGKz0Bgch0kT26wti3SR1ySEoS2N5srId6SB0p-kXcSrLGV8VIQ999tBLNcao1_...

170 B
188 B

102ms
101ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSCRoMXzMIF41nL0k8crBwSfXn7u97sWiXBsuc-29tcGZo3XzwAQMxzHWts1QGKz0Bgch0kT26wti3SR1ySEoS2N5srId6SB0p-kXcSrLGV8VIQ999tBLNcao1_Z2yQ2FDmECwQUKzPft1pR01Fog&google_hm=rDAm7qSnQhiWbjTPjBThy6E

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:12 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSCRoMXzMIF41nL0k8crBwSfXn7u97sWiXBsuc-29tcGZo3XzwAQMxzHWts1QGKz0Bgch0kT26wti3SR1ySEoS2N5srId6SB0p-kXcSrLGV8VIQ999tBLNcao1_Z2yQ2FDmECwQUKzPft1pR01Fog&google_hm=rDAm7qSnQhiWbjTPjBThy6E
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF56
Redirect Chain

https://sync.fout.jp/sync?xid=googleadex&g_pixel=&google_gid=CAESEAxeKzCUXLfkdOtH54WtYA8&google_cver=1&google_push=AXcoOmQ3sJ69MWvN2IFUp0BNJuHe5MOFn7gB1579MquQmYq_864MnP9fJmGA72Pfx445Gamjiln_4jJN-y...
https://cm.g.doubleclick.net/pixel?google_nid=freakout&google_push=AXcoOmQ3sJ69MWvN2IFUp0BNJuHe5MOFn7gB1579MquQmYq_864MnP9fJmGA72Pfx445Gamjiln_4jJN-y4Ex4H405rGIwBUZlkNeRLURT3qq4Sul_5ABHzCgR0G06hd7y...

170 B
188 B

103ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=freakout&google_push=AXcoOmQ3sJ69MWvN2IFUp0BNJuHe5MOFn7gB1579MquQmYq_864MnP9fJmGA72Pfx445Gamjiln_4jJN-y4Ex4H405rGIwBUZlkNeRLURT3qq4Sul_5ABHzCgR0G06hd7yghlcZ82FQF0Z4S_FK2pXkcjZY&google_hm=aHVNVzNXcHc1ZkpaZEFZNHZZcXJ0YVNDT0E4&from_google=pc1

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 21 Feb 2024 14:39:14 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Transfer-Encoding: chunked
P3P: CP="ADM NOI OUR"
Location: https://cm.g.doubleclick.net/pixel?google_nid=freakout&google_push=AXcoOmQ3sJ69MWvN2IFUp0BNJuHe5MOFn7gB1579MquQmYq_864MnP9fJmGA72Pfx445Gamjiln_4jJN-y4Ex4H405rGIwBUZlkNeRLURT3qq4Sul_5ABHzCgR0G06hd7yghlcZ82FQF0Z4S_FK2pXkcjZY&google_hm=aHVNVzNXcHc1ZkpaZEFZNHZZcXJ0YVNDT0E4&from_google=pc1
Cache-Control: private, no-cache, no-cache="Set-Cookie", proxy-revalidate
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF56
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sVVSgjFQSJeUwxjxbrIQrA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

102ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sVVSgjFQSJeUwxjxbrIQrA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmQcAAzHWZ6HkwHaxWClA7p_2S77ZQfcn9QGOYC5W4smZHW7xTthhHG36ldbysv3B0FsSSajsrLODzzkBoFzJtc9qGv883pJcYKK4lqaYSbuZE0iBnQV_fa059PfdHqSn7Nv8P8jWLxnGCcLXN7xJg

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sVVSgjFQSJeUwxjxbrIQrA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmQcAAzHWZ6HkwHaxWClA7p_2S77ZQfcn9QGOYC5W4smZHW7xTthhHG36ldbysv3B0FsSSajsrLODzzkBoFzJtc9qGv883pJcYKK4lqaYSbuZE0iBnQV_fa059PfdHqSn7Nv8P8jWLxnGCcLXN7xJg
date: Wed, 21 Feb 2024 14:39:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found doubleclick
app.cauly.co.kr/idsync_ssp/ Frame FF56 0
161 B 434ms
141ms Image
application/xml 133.186.161.88
NHN-AS-KR NHNCLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://app.cauly.co.kr/idsync_ssp/doubleclick?google_gid=CAESEMkvjhYLMRJxcxUH8pFLxLU&google_cver=1&google_push=AXcoOmSWLjT5NVYO9OgitX4s5oGiKCZvEhCV3efoADJIuc8OGEVCuU07WyJnirZ7fBo0Vm9ahyYogodIpM-0hZpdNraQE04n8swFV0YdzCP2d_q3dPXSAI5Na8NgdlvgLSJsr6H9-dM5xmTQx43QqjRccCg
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 133.186.161.88 , Japan, ASN45974 (NHN-AS-KR NHNCLOUD, KR),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 21 Feb 2024 14:39:13 GMT
Server: nginx
Connection: close
Content-Length: 0
Content-Type: Application/xml;charset=UTF-8

GET
H2

200

cm
cm.creativecdn.com/adx/ Frame FF56
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1&google_push=AXcoOmS2LZ9r1xMPaEBT_Uiu2Mjvx0TowiozhABk-oi_-q_Cl79gDbhFt-iDG-SHKAsedN94PfB2h4dLFxTG6bC31...
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=nIpDRHVgeAr2rw0SeImtaVK-IzU1MDR2VkyiNRuWCs8&pi=adx&pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1...
https://cm.creativecdn.com/adx/cm?v=2&pi=adx&pi=adxab&google_error=5

42 B
261 B

191ms
93ms

Image
image/gif

103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.creativecdn.com/adx/cm?v=2&pi=adx&pi=adxab&google_error=5
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT, Wed, 21 Feb 2024 14:39:13 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 42
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.creativecdn.com/adx/cm?v=2&pi=adx&pi=adxab&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 277
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame FF56 43 B
235 B 311ms
102ms Image
image/gif 35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEE03PAmBdjpTEozFdOQEyog&google_cver=1&google_push=AXcoOmQfbA0fWQeu3fcOYEnzWutxdEmkGnOG-hU0YQzyE-sARgFaGaxbdeRG_t4FtmJPOrbFoN874GABQ82b0f-kI5VfqI0-0NZIbqwwQbvlAfso5GbK_AL4WsIzYCIVc1at7_CYfS4LuuaUPzHgQGHmjYsH
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 21 Feb 2024 14:39:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF56
Redirect Chain

https://tracking.prismpartner.smt.docomo.ne.jp/sync/adx?google_gid=CAESEPFaak9t3RfGqxpZZo7BA_I&google_cver=1&google_push=AXcoOmTrTvDqae0VwFukLnrUNWBwMi0ytYKtv3llVmfa2WpJgB0SbUjbVXECex25hrutM1FPUVLU...
https://cm.g.doubleclick.net/pixel?google_nid=prism_partnerinc&google_hm=oqqgwL-RTIivJ8YPjBIcdQ&google_push=AXcoOmTrTvDqae0VwFukLnrUNWBwMi0ytYKtv3llVmfa2WpJgB0SbUjbVXECex25hrutM1FPUVLUK5IwT0zymHt96...

170 B
188 B

101ms
101ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=prism_partnerinc&google_hm=oqqgwL-RTIivJ8YPjBIcdQ&google_push=AXcoOmTrTvDqae0VwFukLnrUNWBwMi0ytYKtv3llVmfa2WpJgB0SbUjbVXECex25hrutM1FPUVLUK5IwT0zymHt96sVNCT7HvNwMnl2tvZHalYD4a_ZQRq-17D9L51ptkhQQKGYsWRPL99cENIOE0dzUPmI

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=prism_partnerinc&google_hm=oqqgwL-RTIivJ8YPjBIcdQ&google_push=AXcoOmTrTvDqae0VwFukLnrUNWBwMi0ytYKtv3llVmfa2WpJgB0SbUjbVXECex25hrutM1FPUVLUK5IwT0zymHt96sVNCT7HvNwMnl2tvZHalYD4a_ZQRq-17D9L51ptkhQQKGYsWRPL99cENIOE0dzUPmI
date: Wed, 21 Feb 2024 14:39:13 GMT
content-length: 0
content-type: text/html

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FF56 0
12 B 98ms
96ms Image
text/html 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ie40Fr1o57Lr2Zhn0gb4sfqUfLgl2gKlaw68W7kzJuvSJ3p5pUfk15wcCSdKfyOb7kNLuDltk

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/ Frame 95BF 30 KB
11 KB 3ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DXwqvdr5uL1RclxTqYAtYgjJUun2W7QtDrSgW_gIQHtYHwjP9ufI3_vsrdzVHgb8-e-cXHV5sRHf69jMmfp-HHZ_C0J09HoJaYiwAgsTLJQlZ3Mka1TNDqRWpuG_jWZVhZQMkLpnwGtQz-NYjGqsXOfNxhCSG9tuzk0DMVwOTjW3d-Zj5cpgucC3XQVS85fuA0Cxrg04uOuoqfLOFD_UJN1qvEXQ&dbm_d=AKAmf-CxwgK6XIpD4blcB9H6K13ypY1VmcDMGSrRL4E6VAy-oaecKRzE4mj7UEgN0ooVadxFYcfTyLBfZmS5ntVwNERiw4tAWmGtfqgdwK00cPmPmOMsMBXfNFRraOzwQo3ulr9phFlf3XDs0o72r3T4rus0ce6H_SEVGQ0Elsf9uvpDJemslMIGmAcW9D3tUqGNj5WwYX5fMWI4uSuPE2oOzbnKZ4pu_ucs_3OtRoK7rv77Ez3VPDu9FhMNJx4Zbf1xdcBmq4Ma71tfL6Xbm-8UDJ4YEYljbxebtSf_pz_bNKChL2vNlKCf0FWVIk1pL0Pq57jqnAEFNtjfy35w89kQUWPrO7IpxcPUOJqcWzn5IiPwSDLMrv8RvneDh2CteY0I5u51pcyFdYX5U6rnvjXqnYEk8SZ_3TceDLFJs32hRVcDOA_IYqu4txlyDKym3p09vXCi96eLXzuJaPf4oxMc3vskUNrVriJE7L0vqBSEhRtx_4-o1BkUdtgYYHkvHkp-660wdIeMs1EPE_UL8J9K1rwKfZ_t9DBcJoUd9EPyus20Nbj6d3AVghhlVBgIB-RRYN4bynBwwqSVaV9fk1LOal9LNoSk4rCdwtCNoseaXqcC79NaUfjnQk8oqP-_-j8uDpodIAPXxJ-l3s33xT6XwK7KArp575KGWGPCa9QRULosYjLfLfGXbfXo0mv7_uvRHVAKyx7-pEla69yAGydN8AbFxinFBX_mZonflmDrOk4Y8zH4wlNZ6_SZVbIopQDKdOMUEltgpXlzbmQpmPa_-4nKPXDRYaKjvHVw6PPV8X2SC6fVuUKnhHKYxSJZvOVFMDtDLEZiuU7jkjGh493XfBzDp26ThayirWM9RhVAfqD9pplgJ-FykvdIHUY-ljtLYnR83zS_9CCyiZgabFFnD_zeTaiNpwiOsk8etk0vWW-QkQrOKdv8kGX5SH9YxtudAv-V57aG87MEhGqOl9rfTjL7dxfxJXCgaDGdQyAvLNsl7PJhO-FE2E87rrqvAJ0bqd4fhqRxpjo1EWwEwyUpNSTaXB3coVwO5Ea2ZbJ26I4Ab0zAEkofi4KZ0mrBwmhW21-bpx9ASFeVactmTDOdUn3_PmClhbI-FeenyEok4GDbOU2PQmzNI2G1QtZEQlfpY_GOyybHvaQG8QoNdaFSxrCHkFHHi1comz75cUUTZNbjCrzTmsQVVdOrqt3sQHML5GPAgMWZHbN6cqWpczk9xsz-sRhn_PxgSJjRh90rpFbNHPul_FUZUkZkIck5Tz18dexhRYBtnRNK0QLisMVmdmuaCGLNVmBim2EPb7IckvV4aLRHhJTCqBNyIDaBhvVHAPJ6vwQxm3aIDZkn6zwlDW2KoTl49BTHLzmZXLgvdFT6vV96C9uMdd_YPnYNPRishyU-QJFvNbOT8SvHe6QkfMuK4INSbgMEos4OICtxzj3B9q4rIFFcYSd31YzbUMFbFBUZXvaE60p0opRKuEH5_8Tv-f0ZETK7Z6oAhH7MSNol0gUp7iokhkQ2zBhF7jjtfWbZzwfAoFzULAm2glwKONNH-TDyxKF4PGEro4js6gnHbJMOupdOG4T2CDueSqANSdFLC_Xe5y65MKmJHT_RlsYAQg8QL4a8t-i2M20LpolZYPc38PMANbg9Me9G0MT6eXfAgqhrsomgSbep5pwtaenUSIdevlVeuH-D9_jYGMO3UDAskfAb-JxCEV3j2UM_cP-P5oM64kAUP1GZ8weIKYyrfYzwnlI0UEXjxm87UUILskxnGyd-4WPhoBDEF4G728rSEX43qaVGP6WLNRA3RO-LO3bD4liXqykiyfqdDu3rPgkloZH7TxxzRfXq1uibCCS9sduhq8sgDvlATtHdALWBfbVnJqzoxiH8YL45H0uf9EiRD3wlEAsIg3WI33DEs8qJRqAvzbihMudfD1ZKnJ5pTut8gQr2S3n415kItI3gBWct2NC0ewkjkrrVOwwNfh_jIioV4WzA4wmdrIN9x3wrAS6oGASIUrGWlXPHKeR2Xdxu4z8BO7T47tU1SKt5wOcu34cxCgQ_UhNyoWB92DzVmHl0I3Mx51mO_CnTrCWwWH2X1k05w05QkUinK69iyC8kDOWMFZCiUV4GI3d04QK5txLKrZEOuaUO4ochjxOo1WUdN4JNUVGX22keF49xtkYg5H-adI-XijUJliUQ3ZXtSwusD4RKH7SySFK78qr4z-n5FiXjs3z0eCOJ-laK_lFeEv36oQv1rSIa9A_uxF92Jvj4It3pmxyV0Lg7D9_JsDojsIl3ECmeMaiKvuKreX4I4Fh_izHnDdxNZMZkTXeYAybq5o6fWc0goC8fGzc5K31jFi933-KZ470pJQm91R5X5MYjGukcvlLMaAfYVC4rEpM8YhhG3O7i-gyTaQsRDpWnBnyMRNXh2PSOqBoSJ6KTlKbjjG-cs_1yd8qesxbVeTXXxSd5Jz7uiqNenScMNxjdqbhsNfGQVt2FmKnirwp0vLdJllW7Es1ECqm6BDV7BGqIQzQU42A5qWHtz0RechphaUBJdhrFd3IQ67lOWhRQ3VEP6SkBK-klibU50xl6dhrVCD1offVUUtIhTvIXjp677Ae5cERdoeHno5IC8ih4--nMig__vpmxlXkdpEVWVzAbQMjPizONNu1w0wRXT-RQlno_QG3IuD_ppjTJ7JD0z3BavIV7fpg7Xg-R-HsxsviLF01fDFjLTi5dcsrnOtsXf32k94c47vKYcX4VcVEMujJ7EtTwxPNbqjcc1VrN9RHo6CDOPtdIudYO7kI1H5c8Da7McjKU0GcE0zAsldfiBDYuJFM-Cwu_XvU0ErBKNXBoyt69h3cZTI7kFYNg_NX8yzQehFLRhUB-5LWtnoDxydRNSM9jelkfEyiwZ5fMupFduYqWMFDH8L223HezmFLR8DbJC8WFixDcNjexsP0I8n91Qu9g3iNADjuZhGsktOOQcioLfzNQhJ1RDdh__MFTG36EX73ZFoxexIwXYvegyIhToFPtYo4NcnIIt1vX7cWtfRE1qEyI9WAjIKEMuzZmqSkRYns89-Q2lUhmA8_fh6lLRQJuhpgV8cEhIruWcTtG8YbSTk9IUIbVO8dZbY7VCx46PQKvKGfUNxinaNMDfKaRC8gcTrGzpzVGQsp3Z6G67b_ZoSoyHpM8Xq-ZH1o7xELvCREosnDeBXaLP4EhPrTLPyMc2P4usoMLsEJWiAifNc-nR6g0yykLMND0KQUrWDFurWhsYHkk6I3XYTPeO5AM_MI4DU28AQUW9ZlvVgFNUG5hSreFP7R5JadVTAklYHsTX2JqFIAyCOG8kP1tXtnhNX5bmkamesX-f3FW_hakKBvvCAVeugX_nZ1J3Zw2U3_ZBojx2OFQJrVkJ-6r_7c-GZTT6hDt40iSmALHC0F4HWbB5w-rQrXxbroeCnH8SnXqLWXbnvxX72Xw-0FNz7Suai3VfRCyMZImQaC2ozp7ZsYzbig3-h2wDlWoE-OhGvJg87-Ty-8oFTz53JfYJiqSG6oTmbNXZ6hN27ajRLQRC13Q_aR09evhDDSTP4d8qbLEJjMKrbKY6f0KnxaQjztKRz8MWVmeVVHgXZ8C_-fOYVC23BB-tW6E5UxZyAfPYJPGQUBPsLbL022SBh6SISUN4namoSMY1b7fzORvQ54L97PbkERZPvBdl_cCEs9oLC0&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmoney18.on.cc%2F&ds=l&xdt=1&iif=1&cor=17993345040343450000&adk=943508964&idt=174&cac=0&dtd=30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 05:42:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32180
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:42:53 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame 95BF 12 KB
4 KB 3ms
3ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:57:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:57:01 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 95BF 0
0 254ms
150ms Fetch
image/gif 142.250.67.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuMsKEqljwFuorCbkBfuywENU3-sfVWiqKG05-hiVXL2R4bcHTj5WyI8HzOMnMpHEORlRYskN44hV7IT-vqb6Wk8ArLlk1yEu9nqg9wbhqfU6vCfp8eu5HFgYn0xu9Fxir64FTICPWgwNOoeFMDv89Jtmv7vAR70COYNo6fNH_HNweDrta3Mxq93GwR8etDS1KOAZWYZTx-qT6SMMRWB1qCtLbAg7HAt2lJDBWZWZTKeeYy-pit7lTJTDGoTvloNzP6pSEFEFj-jYZ7_KRvMfgJEL5vvIyMpT5wXEVZL3QzWlEYgfLmuvbIi8HE47juftofIah6gf3fiemdkgPHhfqJ9fs-c6Cb1fnd5JkipWsSitX8AGd5AdNjySQ_PQrU5i--MeimkvxOKlEGx96-DSVeQ4H5q-s725Q7xMnnWUXZBzD9YSta3m5hUTD4HYqKsDYD2xayWRdApKnhEKU2fKIv6e5Do-kfjKcqtlwDQ4Nbbj-h7iNcjbTf7GsEgN0ZwAZx9fPBVUpCxut7JPY26A_-BARKk-Xv9VPLBhUOOESwTf9OYqoNZZVIdc9D2kgFfz7z1pzYDFlImuwqvWyeChepqgmBWic1BrE4saJVQQFQh61cMgbjp85uh1vZCKxM0G82c9ExeyuKBG-DcyB8J7opwe5hoAOz-g9TH0x3jGUFQSaeQIq4x2GfzVpqJ90OIT9N8Xf0BabP7U-4KeDOh-l2Ib1tWTjvDOPUTkrLvrxLabIDVXg7sT8kGcdnI_Sjtw4phnFRlehAWo5UQW5Zyvgecf6e5r-jvq99xEemyTeWcGZhOGh3Er1VBb3UOlzijKCEcQmhaqGBuxMoyluwp2hbU2Tmpro6OTxm5JtNXwDAcgKIyU-HhYwiFmN0YFvadFanHoZnCBNj2f61kW3n4Tq_9xAL-DmFQijPq4SoqzLkAlYIHwf0sRlaTjTlurzphCGF2YM3eSIObcVOwQlScNmrntC2TN2H7EB2PwglC8dMXEvtJ4erEkHec-OfK9jmsjey7MyBhZQOmG-p5lr6P6bS3iAHJpV-U-U9e3TTAwmd2E9ssHdkQ90EtIW0Krz4F7VSU9p5DXCIV-PjFXJoXj305OIZ7VMf8fQKCE7hTJp6w3pnsITXlbzd4_DFHvZvPsNs1CSAtGYFSLvFh1sXh2vNtzCclgKXhLGGDJPPX7gPI0YrPyG7AfqCFTy05hz-msLQvbS5ate1hqeHl0aepDjFlEu84hRwLa-JRH7hanJkq2RXfIfI0_M1hni331eAiPORFiAyhjKq3N-4nl_xYDEvk3I7KhFvmBdjfiP8Ts2byzdbsP3dir_VGW9vgep7u3S0WaJxW1GG3XaAfW2ljzpCMeMaUz-y_LjXHgo0vrdZjs0AFnprNnuHq_2FbjGXt0V4KlIknjB8b_XK1KBGxVbW-zOVQNJPbAKoovR2eZEU44UXtwnOhUA4JrBakDc&sai=AMfl-YScmaQ2ocF3FtjrJKm0_TwNmAr5TYYi-pOA5U8n_qzJX36Y2tVVi_Qm2kNFSiDTX1Fy40cYirk8IRXzG74c-uJIhletPGOZquIthNGmmBhQmzTU21Hjhcz3qx-98DzY_HpB0e7izMt5iTnwaYKBgNposHtqnrnmFZXAT4yid3O4QJBhF65GF-f1QqPC3rOCqQaM3EShU0K9-04srgWVIYaBiKnARAoCmYMd4jsOgOLamWcjiguylELDDcBDczYP-YLjCWoE602S6FEyzGiuU-DTqLqrWxE&sig=Cg0ArKJSzAPwG6Pxp5WbEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240215.14494&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:13 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 95BF 41 KB
14 KB 3ms
2ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:04:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455660
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Feb 2025 08:04:53 GMT

GET
H2 200 4038093378546665116
s0.2mdn.net/simgad/ Frame 95BF 30 KB
31 KB 399ms
2ms Image
image/jpeg 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4038093378546665116?sqp=uqWu0g0HCFoQ2AVAZA&rs=AOga4qmEdQlRU5UgKQzrESDEAKSC2BnEZw

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

746a235a89007c3573cc3804bde73783526c98bdbe5a4b67b2e930f1d77a04e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 01:12:50 GMT
x-content-type-options: nosniff
age: 48383
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31073
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 02:30:26 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Feb 2025 01:12:50 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 08E4 1 KB
677 B 2ms
2ms Document
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 30054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 06:18:19 GMT
etag: 48472445140208031
expires: Thu, 22 Feb 2024 06:18:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 95BF 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e9181243ce2aacecf567ebbade3e61966ec9b6a80418c5d1400a1f38c4fa665

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 21AC 38 KB
13 KB 2ms
2ms Document
text/html 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 82727
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Feb 2024 15:40:26 GMT
expires: Wed, 19 Feb 2025 15:40:26 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 08E4
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEF2cgaPNRv_3ZN1e_TNdsOM&google_cver=1&google_push=AXcoOmSGCqFU_IR430tA_-bZbXtkFHwfOEsPBKDCujVYXHKJrafk2-5...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=7424b22628752164&is_secure=true&networkId=14000&version=1&google_gid=CAESEF2cgaPNRv_3ZN1e_TNdsOM&google_cver=1&google_push=AXcoOmSGCqFU...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAL_7PlakZy0gNeZp-pAAAAAAA&expiration=1708612754&google_cver=1&is_secure=true&google_gid=CAESEF2cgaPNRv_3ZN1e_TNds...

170 B
188 B

100ms
100ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAL_7PlakZy0gNeZp-pAAAAAAA&expiration=1708612754&google_cver=1&is_secure=true&google_gid=CAESEF2cgaPNRv_3ZN1e_TNdsOM&google_push=AXcoOmSGCqFU_IR430tA_-bZbXtkFHwfOEsPBKDCujVYXHKJrafk2-5RZ3mDRNnYIU0v961o5nkq6IGyODJKqtnVNAIcIQOvqiuM2U6a6D__IhIBwc9O0d5eEqdHg6pq6Yn31zgvqCjYi0_Sw7iJp1xLUro

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAL_7PlakZy0gNeZp-pAAAAAAA&expiration=1708612754&google_cver=1&is_secure=true&google_gid=CAESEF2cgaPNRv_3ZN1e_TNdsOM&google_push=AXcoOmSGCqFU_IR430tA_-bZbXtkFHwfOEsPBKDCujVYXHKJrafk2-5RZ3mDRNnYIU0v961o5nkq6IGyODJKqtnVNAIcIQOvqiuM2U6a6D__IhIBwc9O0d5eEqdHg6pq6Yn31zgvqCjYi0_Sw7iJp1xLUro
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 08E4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEEgYfVvBqohr1KqlLfzC2-w&google_push=AXcoOmSYWSd_liM34VpU0EgJL_sbEU8nzy20jtyur2_tIFLDRXbRD1WytA...

170 B
188 B

104ms
103ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEEgYfVvBqohr1KqlLfzC2-w&google_push=AXcoOmSYWSd_liM34VpU0EgJL_sbEU8nzy20jtyur2_tIFLDRXbRD1WytAPPp8ZsKNo3Lrp4d4P6ZElhhsB-GGcaZ0oEkrGhJ6vzn2LbuPRgcstMVH8OZ-cz25O3ZqHy_CqhOgPqqHtdxqdw5f7gYfIcRNg

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-bfi-krnt7300020-BFI
pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1708526354.664125,VS0,VE120
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEEgYfVvBqohr1KqlLfzC2-w&google_push=AXcoOmSYWSd_liM34VpU0EgJL_sbEU8nzy20jtyur2_tIFLDRXbRD1WytAPPp8ZsKNo3Lrp4d4P6ZElhhsB-GGcaZ0oEkrGhJ6vzn2LbuPRgcstMVH8OZ-cz25O3ZqHy_CqhOgPqqHtdxqdw5f7gYfIcRNg
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 08E4
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1&google_push=AXcoOmT-R9W2SZOEYZEPSQT7DC1YR0CHbUAe32vuYGgVdyoI_Xa6W_fEedsgi7-1Pkz8q0A83g4ZJBubI0mRUkT5W...
https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=nIpDRHVgeAr2rw0SeImtaVK-IzU1MDR2VkyiNRuWCs8&pi=adx&pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1...

170 B
188 B

103ms
103ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=nIpDRHVgeAr2rw0SeImtaVK-IzU1MDR2VkyiNRuWCs8&pi=adx&pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1&google_push=AXcoOmT-R9W2SZOEYZEPSQT7DC1YR0CHbUAe32vuYGgVdyoI_Xa6W_fEedsgi7-1Pkz8q0A83g4ZJBubI0mRUkT5W4cg2YTYC98honMDfu2ldtq58BHx7psaUPfOrq_FLWkz9SciJSxans83BKmTAaBir8s

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=rtb_house&google_ula=5153224&google_hm=nIpDRHVgeAr2rw0SeImtaVK-IzU1MDR2VkyiNRuWCs8&pi=adx&pi=adxab&google_gid=CAESECTa8u_vHqmca7nwD7jC9h8&google_cver=1&google_push=AXcoOmT-R9W2SZOEYZEPSQT7DC1YR0CHbUAe32vuYGgVdyoI_Xa6W_fEedsgi7-1Pkz8q0A83g4ZJBubI0mRUkT5W4cg2YTYC98honMDfu2ldtq58BHx7psaUPfOrq_FLWkz9SciJSxans83BKmTAaBir8s
pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT, Wed, 21 Feb 2024 14:39:13 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
vary: Accept-Encoding
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 08E4
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESELBy0C1sbVOUx3HWB5eJsAc&google_cver=1&google_push=AXcoOmTdwLXQqeibxPaM5R5lEVfc7SGNXK6JwwDPjeEMizo1fOE0W9rVoEfSlrZSx_Ci6CP9-Bo4Cgfkzr80gXRIkEm73Kl...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdwLXQqeibxPaM5R5lEVfc7SGNXK6JwwDPjeEMizo1fOE0W9rVoEfSlrZSx_Ci6CP9-Bo4Cgfkzr80gXRIkEm73KlbAOgm_FV7f0C9bjo3HyoKT7m8pScd58LEO1hTW...

170 B
188 B

102ms
102ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdwLXQqeibxPaM5R5lEVfc7SGNXK6JwwDPjeEMizo1fOE0W9rVoEfSlrZSx_Ci6CP9-Bo4Cgfkzr80gXRIkEm73KlbAOgm_FV7f0C9bjo3HyoKT7m8pScd58LEO1hTWuYGOHvShvWrb8kvXExNn8g&google_hm=eS0zWnRiamZwRTJwRlpLZ0pfczFhNE9Vb3FMM0N2S0dSbn5B

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Feb 2024 14:39:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdwLXQqeibxPaM5R5lEVfc7SGNXK6JwwDPjeEMizo1fOE0W9rVoEfSlrZSx_Ci6CP9-Bo4Cgfkzr80gXRIkEm73KlbAOgm_FV7f0C9bjo3HyoKT7m8pScd58LEO1hTWuYGOHvShvWrb8kvXExNn8g&google_hm=eS0zWnRiamZwRTJwRlpLZ0pfczFhNE9Vb3FMM0N2S0dSbn5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 08E4
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEERnVXqQ-JuGU8DfeiFPMmM&google_cver=1&google_push=AXcoOmSfs8f5EYE9qdFTSyKOVp2MT5oWcPL2j8Cq-fEAGTbO22LHUovFE3JS3wBc_qD5L86qEpIM-K3iIzaBQaF-pfyLudp8RI...
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=0&gdpr_consent=&us_privacy=&sync=1&google_push=AXcoOmSfs8f5EYE9qdFTSyKOVp2MT5oWcPL2j8Cq-fEAGTbO22LHUovFE3JS3wBc_qD5L86qEpIM-K3iIzaBQaF-pfyLudp8RIO...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYyNTUwNzk5OTE4MDUzODk4MzYzMQ%3D%3D&google_push=AXcoOmSfs8f5EYE9qdFTSyKOVp2MT5oWcPL2j8Cq-fEAGTbO22LHUovF...

170 B
188 B

102ms
101ms

Image
image/png

172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYyNTUwNzk5OTE4MDUzODk4MzYzMQ%3D%3D&google_push=AXcoOmSfs8f5EYE9qdFTSyKOVp2MT5oWcPL2j8Cq-fEAGTbO22LHUovFE3JS3wBc_qD5L86qEpIM-K3iIzaBQaF-pfyLudp8RIOshnn6MFCWW0-hMjOZMItdrO_DxU_F-b9aWCGwYlkveODdn-pbZ8gPCtY

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYyNTUwNzk5OTE4MDUzODk4MzYzMQ%3D%3D&google_push=AXcoOmSfs8f5EYE9qdFTSyKOVp2MT5oWcPL2j8Cq-fEAGTbO22LHUovFE3JS3wBc_qD5L86qEpIM-K3iIzaBQaF-pfyLudp8RIOshnn6MFCWW0-hMjOZMItdrO_DxU_F-b9aWCGwYlkveODdn-pbZ8gPCtY
date: Wed, 21 Feb 2024 14:39:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
onetag-sys.com/match/ Frame 08E4
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEGv7GAG-b0VTunLOAUDxE-4&google_cver=1&google_push=AXcoOmSNHjLYUtFKLSX2QVpsc6LgkVj6239KKa4SiR_52G_nl12tEAuDkEzZ0qCT8biJI6q9l34uSLINDM3...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSNHjLYUtFKLSX2QVpsc6LgkVj6239KKa4SiR_52G_nl12tEAuDkEzZ0qCT8biJI6q9l34uSLINDM3h1BRBZtgw8IJfSPT9AdV_LOVrkcs_nAxtm4-m...
https://onetag-sys.com/match/?int_id=19&google_error=5

0
200 B

210ms
210ms

Image
text/plain

51.79.154.9
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.79.154.9 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ip9.ip-51-79-154.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame 08E4 43 B
235 B 308ms
103ms Image
image/gif 35.213.12.39
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEE03PAmBdjpTEozFdOQEyog&google_cver=1&google_push=AXcoOmTtOGm-zKNR0qIsfskBzeSj_Ss0VIfKyOu7gKqhwX8sr2ZGJVnUwV04yrZMQNA5o2q0By5MU0ye6A3i64xlsCxU1AmfLfkqQMwJiHn1SKHblN-irgcf6P8DTH9DTZe7w9AVB9UUtpZ1KldY__p3iQpa
Requested by: Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 39.12.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 21 Feb 2024 14:39:13 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 08E4 0
12 B 98ms
96ms Image
text/html 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IihSytN9qUdXY3eu6xaNNOsZdh2Vq3QZnMW9MXtKUQP6orMBKn3bs2wyD5nBeKfM-aPKMKTCo

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 21AC 39 KB
15 KB 2ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:09:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455367
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 08:09:46 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/ Frame AA2D 12 KB
4 KB 2ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240215/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1255798.4078729MATTERKINDAU/B31307780.386243046;dc_ver=99.292;sz=300x250;u_sd=1;gdpr=0;dc_adk=3690638940;ord=s5263k;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCypqcDgvWZdnQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QSiUfWp5ySNui4vbI-N_s44B8wRrXN98HbEYUgBE2G_7_xFiRHkIvlhu9GNJPSyFl2gfCIiHS2syXO8zryLQej5D_p0eYdXQuCmtQ80q2dM9V1ABydg0OB48PerGsFDwQjQJzOca1o9hyjO9R85lSDscOWWnRInBIzxEDFLHbE_CfbmpLnouLoIWnOii8zAhJvo2m6ujlp3UCQbVHvm8NrOUZ1BERyN3Nbs0rpOqGltH9MtTErbXANJPc2YHeKXfSWsgoYKBjy7sItTby-Ue1cW4ZsvYRSsZ4vz4m4h4h938tafV9ax_KCiswpUuoy_UqZL8Wgvwlu2xsiofL8WdkV4nyZFiqvsR9X4x4_zOTVtYMx7ecgcvABK_lh5TKBOAEA4gFlKmyi06QBgGgBk2AB_uBjNcBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAtgHANIIJAiAYRABGB0yAooCOgmAQIDAgICAgAhIvf3BOljwseDR1LyEA4AKA5gLAcgLAYAMAaoNAkFV4g0TCK-K4dHUvIQDFXPkcwEd_BkCLLAT4pO6FtATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB%26sig%3DAOD64_2WNcTRPFN-rHC0Imjy3bxcueXQdw%26client%3Dca-pub-1862194061110379%26dbm_c%3DAKAmf-C9AEg7rNhFa8rC1iJ0xX50g0aJwBp8aVU4B6TC6QHjhEEhoNA5EJmFrQGv-bYFUGPcoweTMjilb5Cz6GFmNF2kOrAR-BU2ctJ6nProccPKVlDqoyTAMLS6mVOnlj8nMa-MaNNdFgZ-F4fVM-wDkTSrb-Mz-AH_PpY3m4UtnmDKU8tB6ajApWUxmL57XlN6RWVM_-EC3leTnGwphhCLbIuZRAFvsg%26cry%3D1%26dbm_d%3DAKAmf-Be8GgrqBOa1P3eHWrpf8VTzxZ7V2OwrpQn7P-4JeT7HaTbCKi4XxErLay-RBTq5CaVoxLZ7JNkeH4auEe1rg-1da4soBn-C6fMMQK3_GP09JWMEVFxsD8LnJP4icr10Iel_ifW1md0PpiSE-VDEGCS78_luSai5lE3jirKZtm-5t2J29eIGgOfY9Np5PkXaLEfvts7iYtqMMqzKz87i9zVhTyX698qTe52EGfb3ssrQYgJFJl_m0lGpdLJFLSZD96xqmrVLr7XNRxa4CfhFnqgfOZK1t7N2Y2M3ZbQV_A6CIuwWh4fh5cGmiBXNkkDma8yzfusMoWzx0Dq9DxzTPIaEczh6eR6QEABGWD0i4af9XpbT7rjU4NZcUi-09TudwSyECd86NbjqYGcxb8__sZbaBUBZBw4_9px394oP0jG22KqZjVaQFQECaoUS3kL67BbqiXtQqCcPF5s5xJRk5XqoVL6y1JzMYgdHEiem4PCzFK4eQupf5VUoBNGelLXCwlRFaksC68M2fAP7FcSj27cgGUpO_XcCoMrZaolbVzqChr72SSpTJ5rFQyafU5VYsq63tvmjsTsV08fen09MgfvdI1TRZ8_RQuLcKOUmTHwz7RJpdg%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmoney18.on.cc%2F$0;xdt=1;dc_omid_p=Google2;dc_sdk_apis=7;crlt=T_qYeOH)mT;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=16;prcl=s

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 07:57:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 07:57:01 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame AA2D 111 KB
39 KB 6ms
5ms Script
text/javascript 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Origin: https://ad.doubleclick.net
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 20:46:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64356
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 21 Feb 2024 20:46:37 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame AA2D 41 KB
14 KB 2ms
2ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:04:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455660
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Feb 2025 08:04:53 GMT

GET
H2 200 lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D0AE 86 KB
32 KB 128ms
128ms Script
text/javascript 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5e81fecd4eba0e6eb7662bff772d241600c3a8ffe62316f14e004650c8e2685

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32115
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1707914713231755"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:13 GMT

GET
H2 200 CRO_sydney_prelaunch_300x250.html Show response
s0.2mdn.net/sadbundle/11121323892759592960/ Frame B260 8 KB
3 KB 304ms
2ms Document
text/html 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eca012f23910be5ed6ea3081c3b43512e7c5942c8e4ef90ec25cfa41b893c5ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 178788
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2566
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 19 Feb 2024 12:59:25 GMT
expires: Tue, 18 Feb 2025 12:59:25 GMT
last-modified: Fri, 19 Jan 2024 06:33:58 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D0AE 0
0 141ms
140ms Fetch
image/gif 142.250.67.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstkrWNmCgHcRBqe_Fh_jPSc-_GzjjqTC87c6gDdT4CVopun-5OeOBJGmnkOB5mKYBUqY--axsL3B43ShOiHnM-ZszKZESNeHSw3AP5SYHtlw3HMdXc3eTg_swsOmnT7pQ57auVPYWFv7Bnw5BxR4Vv2zHTuxls4gdsy2g3tZ5ZX26w6H3wi2UCiOw&sai=AMfl-YTLToda-EJqgjEMtFFEBWQdxXw_kqoKQA38qiTLSr96j6FnDGmZctYpcWIubDh3gfiB0IDh4kfBRuTHHZq0n5nDhQyL6ETbm44ZpQ&sig=Cg0ArKJSzD0RW7heZmovEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=437&cbvp=1&cstd=435&cisv=r20240215.98756&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Feb 2024 14:39:13 GMT

GET
H2 200 lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AA2D 86 KB
31 KB 412ms
412ms Script
text/javascript 172.217.167.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5e81fecd4eba0e6eb7662bff772d241600c3a8ffe62316f14e004650c8e2685

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32115
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1707914713231755"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Feb 2024 14:39:13 GMT

GET
H2 200 CRO_sydney_prelaunch_300x250.html Show response
s0.2mdn.net/sadbundle/11121323892759592960/ Frame B60C 8 KB
3 KB 303ms
2ms Document
text/html 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eca012f23910be5ed6ea3081c3b43512e7c5942c8e4ef90ec25cfa41b893c5ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 178788
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2566
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 19 Feb 2024 12:59:25 GMT
expires: Tue, 18 Feb 2025 12:59:25 GMT
last-modified: Fri, 19 Jan 2024 06:33:58 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AA2D 0
0 141ms
141ms Fetch
image/gif 142.250.67.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuIiSQAgRACah97nbDAxBOa9zAl2D8INnhoJr59f2zlyKIv6Ie0ZKGxfhVvQxtITKaR2LA0l29GdMGchS7m6shKqB_V8zayRmUnkfzCMTKgnxNL9lF654B8UGus4dXUU16Lc1dje7LCSgr-6Ei_6wMnIizTO6fbJyactkfFOvUo8GkP7E5E1E61vg&sai=AMfl-YTZIESwjNKa7eLOHBgUnCHCeY5PAPvx8jRVMCi0Ar7B6X1KwV_g8iQhTMP8_RyJXmD4SvEEVPXHzVpCXIgU2MpewZNvFLtasrYTcA&sig=Cg0ArKJSzEUQQl_pA527EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=51&cbvp=1&cstd=49&cisv=r20240215.13633&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Feb 2024 14:39:13 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 1717 38 KB
13 KB 3ms
2ms Document
text/html 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 82727
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Feb 2024 15:40:26 GMT
expires: Wed, 19 Feb 2025 15:40:26 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1B86 0
56 B 140ms
140ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B7qALEQvWZaxlq7SMzA-DiJnwBwAAAAA4AeAEAg&bg=!d3SldDvNAAYBC1i-IQs7ADQBe5WfOM083iRXrND5fGR_GVFb1LmMLwopoK0p6-eP_XSSvRcHzuu8eLk6911C3O4k36iKAgAAAJtSAAAAAmgBBwoAA7PH15kDD6UJQWD-LPRZebhD6KhscnyWFjYoFCqV2nqwnPni4NJ_PaTz48_YABP5TCUEIjZOFh5Ld50Hl5kHKpuy_8T13As5E2PPFUmJLPbMJDdE_YZilHQ3IpR-ffdF1cJynEtoajZsaFFCV0zoKo-bba2piOT66-Xwt3qOzyZmjnkINpigvIRpIYK7WW5GDkED8bDAeJ6ywAkkdth8O4CO4o4bf1VNw9__786nKl77bmNmxlYaedb-WjMjEXNq33byrw8V3LUdB-yHzOa_Gw2WQcAu3tO9y2_ERA7lEnAl7kuC4yOoI0a_tY3cbu7LQmpme2Tn0vRofT1Jrocf-VMkLeoyssCjZed8Xyg57GIWi6dbYlkWxemNCaSzclPPvzkErU0Why0Fz20-b8QCTSuqz3a648ckPweWAJykBMXBjoEl_aiEKMl_vaagCe94q7CbCnELh8YG_-P8HlW_frrLVCGgIpMMdbifcjEPNgP0Omptp23rptj7Kj5bdWE0DQDrjwIlcrbrfbv6bNU5bH2aV7OJLdlh0ZyXAo2CTM43JABSSNi2PpQNcyiz42WN-fmbaIL-tDTQBjtXqYACVmxpkYZPcYLjLLvQRWuf-DC6_Ye8dRMz1Hkdg5GBkk00ixrWkMPsjXRkDNg14r4OKd1iYJV1I6Dd2DdBVKaMHG-phXduamXNrJHlr2p6M-fl1MMucWmxYFiGPa4uasC-9ndMP2XBwpzvabnzPBxUhPxuuUOVbQIt21S-jOrYk9Evl9astH3CcQxJwXoVS4gNsZJ54j_muX3t6AEImy5NX4gmOxpav7VMqLShuHOjBgkRSzFRWJesCCfgT49nn_0BZRCSpWb9oJlRkSt0GRhVIPMfhcba7SH6U2Lieuc12Z4XydU56XYWjdzw7EohZEDVGq39nj6CfQ9Aj16PmP-qQrpR6YTiBpwBFDrd_HqaAvV4kOnq3RkAsCwRDpl9aRBNFpZ4A7PwS9ZK8xKgP12OJfkusRf8PesbOrsIMUHx6U4nrQQ7-9-xVSxV3MQhSPFgueHYRRv29w

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 1717 39 KB
15 KB 2ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:09:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455367
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 08:09:46 GMT

GET
H3 200 index_all_mobile_r.js Show response
realtime-money18-cdn.on.cc/js/real/index/ 2 KB
785 B 18ms
18ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/index/index_all_mobile_r.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 472fc16c344e8e44ff207fc12526ee1fffeeaaaefec7d7a2340fd6f61e15321b

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 14:39:12 GMT
server: cloudflare
age: 0
etag: W/"65d60b10-758"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=15, s-maxage=5
cf-ray: 858fbcccfe04558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/fov/ 40 KB
14 KB 266ms
266ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/fov/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4960b391e07ee30a71861cb15b77c80d902c480e3cd790754a9c6d2b15460212

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: HIT
server: cloudflare
etag: W/"03656721597ee6970942c57e63a503c45"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker06
cf-ray: 858fbccd0f59a7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 prefer_list_data_2021.js Show response
money18.on.cc/ad/jpad/ 19 KB
4 KB 258ms
258ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/ad/jpad/prefer_list_data_2021.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50a5bad3b5f8a3a488668bd2b8e18f1aacbdac2372dc4cb5a0515cb7c7d1a4ba

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 14:20:02 GMT
server: cloudflare
etag: W/"65d60692-4b07"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=900, stale-if-error=86400, stale-while-revalidate=30
cf-ray: 858fbccd3f89a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 arrow_green_up_large.png
money18.on.cc/img/ 1 KB
2 KB 20ms
19ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/arrow_green_up_large.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a60d7cf9592a702e99e8e6f987b8c03d426d9ac087fccad45b0fac599ff5d941

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:04 GMT
server: cloudflare
age: 3235
etag: "5ecbacf0-5a2"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccd4f8ca7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1442

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 21AC 0
56 B 139ms
138ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B14mDEQvWZYdUxcuaww-lnq-oBgAAAAA4AeAEAg&bg=!T0ylTAPNAAZN4L4YbeA7ADQBe5WfOFoNjC_eOf7fHInD1ZPkZX-FK_pQHsevNXhy5BDNPD6crLCigW6hBsTL9GmpnjjhAgAAAKVSAAAAAmgBB5kDJRbl6mh4ZbHhpDUbKSfC1gdZVlDlfl7MmGWMnPeMre6JF_KVW7_MEDzCJFIZNBE9idqiVJC6RSoipbxqZFi1HkDXyf-gO2gegMf5KsaQwTg8lOVhNqO04KwJ6kZXabGUGzQMl_4CvUvgcRAMok-RBhRI-3xIUTQ_J9wrgBYCjgLvo-pDx0171PORJYuPGDfFIjJ1H-EI-sy9qM0pPPmAOcO2IaqBI54sJVLYaeEBJpNoGnumqOPma2eDH0-sIxGCArMDbAFKpjSAxW9DId5tImEzoKhYKe_DhOUZkrqPISxjzDw7pNekjcFnLpJnklo05HzEpyZEO0uUfnaVobrRJ07UrAbdpzNWNkdqAzLsbky0WQA2BWLpq1n93D6nwkeBtkBRspBsHKD69J3s6guLdRQd3BC6kFWShZRUgPd_M5tSVF-NeD886dUqsrUP6wIXez99-6CLObAdgwImyJIDxu2FHXBqDAnhwnjgXrQJyhq0riueOv0m2nG0z-RpkgT_X7d3hromYdhdBvL8c2slrXGw6aXHfbRl4JUERaT2I92P-yUj5vA-39cgfQp6zBK3gJrOZb1JbousmNBT-prG9ja0Sr62DAYLTRn-3BmWgcmlb9f41TJtpSNz41nKjpWZSPMD5Z3Xr8cH2lhNfby_5VN6Zgh2VZo4J59gktsGJM47ivmId2_Oq3ZxbRjWyZ5jJLVVWldDnpPpbOrBKDfVSbC27pSrjaE6E2nQTZQMUvZldEbMLhGnuLAfskBJkjb9sFMZ3XmMmE9T1OTVgS5PaV-gxIytn43yfyvcITnLw8qTE8a2cH7ZwBItBw4NEx7dF19kuMTcX1yTCO2p3U1AGexBUlUk4VfFCUvZJPFh6PyX4caU3BQaoxZaxXEaWVBQizHgywmNJLKRyVlbyl_3pQLTBzomqxuGFgAQxKSEJg4RvV3S_hMgjacffeqDAxY3RgmbKnYFIhviIgSbZybeJG_sgtic06Nq_1dhB2UiUrvTe7cSjWXnCeUoGpm_ShY6BMOQVDAIg7upH3tfigUVe5sH5nwEB5w7TevFXzJDBZH3agPcTPU

Requested by

Host: 7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com
URL: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1717 0
56 B 140ms
140ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BCdS_EQvWZfvmDMzXmsMP7c-WqAcAAAAAOAHgBAI&bg=!g4ClgM_NAAZN4L4YbeA7ADQBe5WfOM2gNMIYgIwgxBUx0nIeETg65xLUvPVG6h2H9TfiM0ujJm9BmHf04X2todJ1xTOJAgAAAIVSAAAAAmgBB5kDL90kOVwakjvWe6dPgEDHPlEfAPx2ycmgWb3xCNkCjSz1F9rDaoXs5KDzcOUo074nBpKlWJtBfJK8c3ewSfQs8X46shUs20fqEld6yG-L-tn4mwfwiI2BT6bY7U-Ae-6odM5pg5GYj_T1DbdRtks043AY_9CuKlzAeibW2kVRCz6WMxqwavSteAlQi1lAz0G47vsWVE3nRZhSX5Ownng62LygwP7F31e_thbmMVrD3jGNk-guELDW49DJjIj2CNF31mAcjbpOaA3sY0rKne6Am23gWg5ryIUB46PRTV93nginpHOPTgw9NeGeJbyAXLCy16XTfEPO6j58GuGaPym6of0RCTLTVXSB6eVTqxBzVgcPsfQh_bGLKeo6fCck85frBSxh6mnCpjKVsWH73QuzueYDoWbcyDC12MC3JDJUmz3SfiqaZYIrDctWmWNBO4vxkzbUS3H_qcE8OBoOcVQGnSnU7p_qko5zhfjds7sJykrrs63B45CyDV8usQEECOFHd6D3th5SDmZxsqXlcqCfAg-19bSxCmB8jsci9B8r79J562cCzQ7b1rilkBUDVCdO8lzZ7DKWEIjPsbcxiBirYZQMx-w3IVNxdKykVGnd2mmR408X3J0FV5FThoDRRqyZijSTZf5EbY6G_ZUDZWpRGFg8V61sjFb6auXZQtT1paAqWEzdZTaEsifBnVt-_Tfb2cjgrkoOf3En0SuWhEGTXrCoJ5kW43P0JGSh5m74buH20Da6jMvY_u8wevWA3fWYboh2AFBRfYjky4ivhBNOtawNKBYDinEUU6Eiww1C4x3IkQXvbFtswyQDxOK37rf2iUqJHoxMmokFJl7xDnqYoEPwMY18IIxDvPv8gnqgYVf5LtaZtIM6G3x9-4znj-Xltt9PCj2tDJIKCYpoJRAj5Gnd1eCVaip5h69wPQe7KnMDLPKgKuQrucXGmYlyshg8gcDSrKSJb6Q2rHdIHlqxU3Y22smah8QwS-gxRoRZMflQCQyyYaU5gw-OiDhhbato_3-e4GcXlIyXztdp7EdWX6-4YGBmis0l_znrKBY4OkYAlVdgqTonIrpYeDmR-ZAX

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 95BF 0
0 140ms
139ms Fetch
image/gif 142.250.67.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuMsKEqljwFuorCbkBfuywENU3-sfVWiqKG05-hiVXL2R4bcHTj5WyI8HzOMnMpHEORlRYskN44hV7IT-vqb6Wk8ArLlk1yEu9nqg9wbhqfU6vCfp8eu5HFgYn0xu9Fxir64FTICPWgwNOoeFMDv89Jtmv7vAR70COYNo6fNH_HNweDrta3Mxq93GwR8etDS1KOAZWYZTx-qT6SMMRWB1qCtLbAg7HAt2lJDBWZWZTKeeYy-pit7lTJTDGoTvloNzP6pSEFEFj-jYZ7_KRvMfgJEL5vvIyMpT5wXEVZL3QzWlEYgfLmuvbIi8HE47juftofIah6gf3fiemdkgPHhfqJ9fs-c6Cb1fnd5JkipWsSitX8AGd5AdNjySQ_PQrU5i--MeimkvxOKlEGx96-DSVeQ4H5q-s725Q7xMnnWUXZBzD9YSta3m5hUTD4HYqKsDYD2xayWRdApKnhEKU2fKIv6e5Do-kfjKcqtlwDQ4Nbbj-h7iNcjbTf7GsEgN0ZwAZx9fPBVUpCxut7JPY26A_-BARKk-Xv9VPLBhUOOESwTf9OYqoNZZVIdc9D2kgFfz7z1pzYDFlImuwqvWyeChepqgmBWic1BrE4saJVQQFQh61cMgbjp85uh1vZCKxM0G82c9ExeyuKBG-DcyB8J7opwe5hoAOz-g9TH0x3jGUFQSaeQIq4x2GfzVpqJ90OIT9N8Xf0BabP7U-4KeDOh-l2Ib1tWTjvDOPUTkrLvrxLabIDVXg7sT8kGcdnI_Sjtw4phnFRlehAWo5UQW5Zyvgecf6e5r-jvq99xEemyTeWcGZhOGh3Er1VBb3UOlzijKCEcQmhaqGBuxMoyluwp2hbU2Tmpro6OTxm5JtNXwDAcgKIyU-HhYwiFmN0YFvadFanHoZnCBNj2f61kW3n4Tq_9xAL-DmFQijPq4SoqzLkAlYIHwf0sRlaTjTlurzphCGF2YM3eSIObcVOwQlScNmrntC2TN2H7EB2PwglC8dMXEvtJ4erEkHec-OfK9jmsjey7MyBhZQOmG-p5lr6P6bS3iAHJpV-U-U9e3TTAwmd2E9ssHdkQ90EtIW0Krz4F7VSU9p5DXCIV-PjFXJoXj305OIZ7VMf8fQKCE7hTJp6w3pnsITXlbzd4_DFHvZvPsNs1CSAtGYFSLvFh1sXh2vNtzCclgKXhLGGDJPPX7gPI0YrPyG7AfqCFTy05hz-msLQvbS5ate1hqeHl0aepDjFlEu84hRwLa-JRH7hanJkq2RXfIfI0_M1hni331eAiPORFiAyhjKq3N-4nl_xYDEvk3I7KhFvmBdjfiP8Ts2byzdbsP3dir_VGW9vgep7u3S0WaJxW1GG3XaAfW2ljzpCMeMaUz-y_LjXHgo0vrdZjs0AFnprNnuHq_2FbjGXt0V4KlIknjB8b_XK1KBGxVbW-zOVQNJPbAKoovR2eZEU44UXtwnOhUA4JrBakDc&sai=AMfl-YScmaQ2ocF3FtjrJKm0_TwNmAr5TYYi-pOA5U8n_qzJX36Y2tVVi_Qm2kNFSiDTX1Fy40cYirk8IRXzG74c-uJIhletPGOZquIthNGmmBhQmzTU21Hjhcz3qx-98DzY_HpB0e7izMt5iTnwaYKBgNposHtqnrnmFZXAT4yid3O4QJBhF65GF-f1QqPC3rOCqQaM3EShU0K9-04srgWVIYaBiKnARAoCmYMd4jsOgOLamWcjiguylELDDcBDczYP-YLjCWoE602S6FEyzGiuU-DTqLqrWxE&sig=Cg0ArKJSzAPwG6Pxp5WbEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=409&vt=11&dtpt=408&dett=2&cstd=0&cisv=r20240215.14494&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Feb 2024 14:39:13 GMT

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame B260 236 KB
63 KB 341ms
15ms Script
text/javascript 104.72.70.42
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.72.70.42 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-72-70-42.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Wed, 21 Feb 2024 14:54:14 GMT

GET
H2 200 CRO_sydney_prelaunch_300x250.js Show response
s0.2mdn.net/sadbundle/11121323892759592960/ Frame B260 196 KB
26 KB 4ms
2ms Script
application/x-javascript 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7b79a257a60206baaf1957af4587ce9b3e5c50f7d07a2788598e9f608801b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 18 Feb 2025 12:59:25 GMT
date: Mon, 19 Feb 2024 12:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 178788
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26204
x-xss-protection: 0
last-modified: Fri, 19 Jan 2024 06:33:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame B60C 236 KB
63 KB 327ms
13ms Script
text/javascript 104.72.70.42
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.72.70.42 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-72-70-42.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Wed, 21 Feb 2024 14:54:14 GMT

GET
H2 200 CRO_sydney_prelaunch_300x250.js Show response
s0.2mdn.net/sadbundle/11121323892759592960/ Frame B60C 196 KB
26 KB 2ms
2ms Script
application/x-javascript 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7b79a257a60206baaf1957af4587ce9b3e5c50f7d07a2788598e9f608801b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 18 Feb 2025 12:59:25 GMT
date: Mon, 19 Feb 2024 12:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 178788
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26204
x-xss-protection: 0
last-modified: Fri, 19 Jan 2024 06:33:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 arrow_left.png
money18.on.cc/img/ 2 KB
2 KB 265ms
265ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/arrow_left.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d9c70879785ff2b5e130f247f12a588eec8bc4f138feaeeba75acdf1e239e4b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:04 GMT
server: cloudflare
etag: "5ecbacf0-8ed"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcceb88fa7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 2285

GET
H3 200 arrow_right.png
money18.on.cc/img/ 2 KB
2 KB 277ms
277ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/arrow_right.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3a72cd0ae92a9acbab18d542425beeb8fd52b9fc55af8fae1529bcf370f7171

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:04 GMT
server: cloudflare
etag: "5ecbacf0-8d9"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcceb891a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 2265

GET
H3 200 genStockJSONHKWithDelay.php Show response
money18.on.cc/securityQuote/ 17 B
273 B 274ms
274ms XHR
application/json 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/securityQuote/genStockJSONHKWithDelay.php?stockcode=
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 513fa7d762aeb7aaa266440719695b5e9805de1ce36cef43582adcf7bef8f696

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
server: cloudflare
etag: W/"d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
x-cache: EXPIRED
content-type: application/json
cache-control: public, max-age=2, s-maxage=2, stale-if-error=86400, stale-while-revalidate=30
cf-ray: 858fbccec8b5a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 dot_on.png
money18.on.cc/img/ 1 KB
1 KB 259ms
258ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/dot_on.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a6ea06f4308bc1644dbb39e08e888f878ab0489cc881c5ab609fb9532f56035

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
etag: "5ecbacf1-44c"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccec8b6a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1100

GET
H3 200 dot_off.png
money18.on.cc/img/ 1 KB
1 KB 265ms
264ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/dot_off.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d02b355d56ef25cdf63e2e2078ed490db4241b9c07ce16d12ac6bb75c61534b3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
etag: "5ecbacf1-449"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccec8b7a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1097

GET
H3 200 forex.js Show response
realtime-money18-cdn.on.cc/js/daily/forex/json/ 5 KB
1 KB 278ms
278ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/daily/forex/json/forex.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b2e2fa8ff9281473a775de87a177cadb392734830f6432921c998205aff5b2c

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 14:34:48 GMT
server: cloudflare
etag: W/"65d60a08-137c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbccedede558d-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/lit/ 58 KB
18 KB 752ms
752ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/lit/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb68ac3b6ae5ee246c631c95002e4f6fc36ecf4e62296fd5660e5d65d7f4b78

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: EXPIRED
server: cloudflare
etag: W/"0f963a9fb742696564921bd00dd45c08f"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker04
cf-ray: 858fbcced8b8a7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/mktcomm/ 55 KB
21 KB 1738ms
1737ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/mktcomm/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e3315ca98f31eee4dd31565a388818b3169dea94f67f471a70316f61f0d8c7e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: EXPIRED
server: cloudflare
etag: W/"048ecf7cc02c2b9fb919ceb51b23ded78"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker06
cf-ray: 858fbcced8baa7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/recagent/ 41 KB
14 KB 455ms
455ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/recagent/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adfa7371bc42dd9cd352c56013f2563a0e8c9d1631a83496d2e076c9c7e552c5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: EXPIRED
server: cloudflare
etag: W/"01feb08cf433294f6bb9f3b2b74f7a8c3"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker06
cf-ray: 858fbccee8bba7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/pro/ 40 KB
11 KB 323ms
323ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/pro/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31c74ca9a2e59463cd1edb1932f5ebefa24f24f661836ed7c752b0f758056d6f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: EXPIRED
server: cloudflare
etag: W/"005a762ae4d9655abb9d7378e0b97ce16"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker04
cf-ray: 858fbccee8bca7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/int/ 34 KB
11 KB 305ms
304ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/int/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73417b723e47ee53e422988a82f4df48ac41c285e0ad4ba3d3351ef6d7bcf59b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: EXPIRED
server: cloudflare
etag: W/"0a3b0e2f00bba29d3779cd0401218cf3a"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker06
cf-ray: 858fbccee8c0a7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 list_1.js Show response
money18.on.cc/articlelist/weainvest/ 61 KB
23 KB 551ms
551ms Script
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/articlelist/weainvest/list_1.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 390a356df8eb46b98e1498b76349fd8ea909a40c9d2d3ce6e0043f05a6b8ad4d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
cf-cache-status: EXPIRED
server: cloudflare
etag: W/"03f8fd3d6669616c16775e633af5d1da1"
vary: Accept-Encoding
content-type: text/html;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30, s-maxage=30, stale-if-error=86400, stale-while-revalidate=30
x-host: webappdocker04
cf-ray: 858fbccee8c2a7ff-SYD
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400
x-total-count: 20

GET
H3 200 logo_m18.png
money18.on.cc/img/ 7 KB
7 KB 18ms
18ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/logo_m18.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 344a5b3908624bd96da0012c107002d723f67878d7fad6fc725ed056fc9e0e7d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Oct 2021 04:05:41 GMT
server: cloudflare
age: 2607
etag: "615fc395-1af1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccee8c6a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 6897

GET
H3 200 ah_u.js Show response
realtime-money18-cdn.on.cc/js/daily/ah/ 41 KB
6 KB 277ms
276ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/daily/ah/ah_u.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/js/common.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e60b0f7cf452a44b0c02529c138b344b5dffce9ccd429650199a342fbf5033ba

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 10:34:32 GMT
server: cloudflare
etag: W/"65d5d1b8-a4f9"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbccef8c9a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 bkn-20240221214949229-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 64 KB
64 KB 1257ms
1255ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221214949229-0221_00842_001_01s.jpg?20240221222503
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e36aeecc475b140535892cc2bc4fd281c7e23671504ea720031952c5db45d0e0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
x-cacheable: Y10
alt-svc: h3=":443"; ma=86400
content-length: 65228
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 14:13:02 GMT
server: cloudflare
etag: "65d604ee-fecc"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 215517439
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08cda7ff-SYD

GET
H3 200 bkn-20240221191412161-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 66 KB
66 KB 290ms
288ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221191412161-0221_00842_001_01s.jpg?20240221212609
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f03aa8746e9e453a49c54582a54f9c9d5bcf9b69597a522dc82fde2d2af2043

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
alt-svc: h3=":443"; ma=86400
content-length: 67253
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 13:25:45 GMT
server: cloudflare
etag: "65d5f9d9-106b5"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 211371387
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d0a7ff-SYD

GET
H3 200 bkn-20240221211857074-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 131 KB
131 KB 26ms
23ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221211857074-0221_00842_001_01s.jpg?20240221214432
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a55c407acba39ccb7be3af7643d7148c30e93fca4f6c88c7804f65fc2646c6b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 1784
alt-svc: h3=":443"; ma=86400
content-length: 134024
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 13:44:09 GMT
server: cloudflare
etag: "65d5fe29-20b88"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 307901774
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d1a7ff-SYD

GET
H3 200 bkn-20240221210131769-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 45 KB
45 KB 19ms
16ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221210131769-0221_00842_001_01s.jpg?20240221210421
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d98381c28320b18a48c249b1dbc53cf7b0390ac46e37e5127a87e327d294549

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 5589
alt-svc: h3=":443"; ma=86400
content-length: 46040
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 13:03:49 GMT
server: cloudflare
etag: "65d5f4b5-b3d8"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 319542169
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d2a7ff-SYD

GET
H3 200 bkn-20240221201717349-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 85 KB
85 KB 23ms
21ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221201717349-0221_00842_001_01s.jpg?20240221204058
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a5433d84034caf428dc2f3133baee73bee96d339d0c596666c123a20013d9b7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 3287
alt-svc: h3=":443"; ma=86400
content-length: 86764
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 12:40:31 GMT
server: cloudflare
etag: "65d5ef3f-152ec"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 210584839
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d3a7ff-SYD

GET
H3 200 bkn-20240221141402645-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 143 KB
143 KB 20ms
17ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221141402645-0221_00842_001_01s.jpg?20240221200454
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31593db8cd7b1b1c49989f3287290a960c469f83deb143ba23883be46d75c723

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 8497
alt-svc: h3=":443"; ma=86400
content-length: 146247
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 12:04:28 GMT
server: cloudflare
etag: "65d5e6cc-23b47"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 312172091
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d4a7ff-SYD

GET
H3 200 icon_delete.png
money18.on.cc/img/ 1 KB
2 KB 33ms
31ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/icon_delete.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c4ae989a558c9d10f9174abb46cc87bb5b44807e26e344092a61c08a18af6ae

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
age: 1785
etag: "5ecbacf1-51b"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d5a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1307

GET
H3 200 icon_unlock.png
money18.on.cc/img/ 1 KB
1 KB 34ms
31ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/icon_unlock.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 013b1ec5adac497101e3c241aceff648faa71dc71a3bd39b7f5168699d392072

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
age: 1785
etag: "5ecbacf1-4d0"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d6a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1232

GET
H3 200 icon_lock.png
money18.on.cc/img/ 1 KB
2 KB 32ms
29ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/icon_lock.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 853015702386a5c106551b2b3942f394735fbcdcf62315368fbbe5c55165fd1a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
age: 1785
etag: "5ecbacf1-5b0"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d7a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1456

GET
H3 200 mailbox_banner.jpg
money18.on.cc/img/ 103 KB
103 KB 33ms
31ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/mailbox_banner.jpg
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f353341ef3490cda1e5e14f0abd16f511498580d7683787546d2ecf9e1cae12

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:13 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Mon, 28 Sep 2020 04:02:21 GMT
server: cloudflare
age: 57
etag: "5f71604d-19ab0"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d8a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 105136

GET
H3 200 money18facebook300x60.jpg
money18.on.cc/img/ 22 KB
22 KB 269ms
267ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/money18facebook300x60.jpg
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2798f31b8ce46eb2bd9fee9d0e2016445092145d118cb5d8f9d670b0a4cb586f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Mon, 25 May 2020 11:33:08 GMT
server: cloudflare
etag: "5ecbacf4-5614"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08d9a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 22036

GET
H3 200 IPO2009_300x60.jpg
money18.on.cc/img/housead/ 14 KB
14 KB 271ms
268ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/housead/IPO2009_300x60.jpg
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8aba32c2d4b6dfe6b756e6461b1a211fa1f5942c59c1def8e0e4287c988738fb

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Mon, 28 Sep 2020 04:02:37 GMT
server: cloudflare
etag: "5f71605d-3726"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08daa7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 14118

GET
H3 200 icon_inter_daily.png
money18.on.cc/img/ 2 KB
2 KB 27ms
26ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/icon_inter_daily.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e778b24437f6c4d4133af816426b6fa3b7ade8756e638fb3f77e2afa339c6830

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
age: 1785
etag: "5ecbacf1-798"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbccf08dba7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1944

GET
H3 200 eventList.js Show response
money18.on.cc/bkn/finance/eventList/ 6 KB
2 KB 271ms
271ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/bkn/finance/eventList/eventList.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5094fa7fa9c475e1b7b13f269459fa69fae170457121151e51dc7771d7eb997a

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: Y10
x-host: WLUB14
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade, no-referrer-when-downgrade
last-modified: Wed, 21 Feb 2024 14:05:40 GMT
server: cloudflare
etag: W/"65d60334-18f5"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-varnish: 212912323 211466202
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbccf490da7ff-SYD

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2205 42 B
404 B 844ms
145ms Fetch
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstQFxiWr7Q_P_yRfY-fle30ql_FG6rYIu4c9mJsGTSLhQkppJEBdcFJd1oqYR_xhS1xU-Iswr7gTGsl0G7V9W0O_R5E6nFGIoqCsLW65jqApsIAz0TLG_6fp7QXIUuTOGbaC6W9eH9OOqW6-sTlP42cF7ZKQ6_NSOo&sai=AMfl-YRQYSEK_6MR43gCDYJIuZtsLwcqZ5ulIyHRaQaoQYEyhm90HNjqyA8ysVfSgd3e6PzEhXyvJG1bSyLE21NqnqNkV04kk_Wacjgkg1ckdvwugd6WG-Z_WGiw0h6O&sig=Cg0ArKJSzA53CVn8YyS_EAE&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&id=lidar2&mcvt=1064&p=607,1000,861,1300&mtos=0,1064,1064,1064,1064&tos=0,1064,0,0,0&v=20240220&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=2125769945&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=445915200&rst=1708526351970&rpt=754&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 186 KB
67 KB 518ms
117ms Script
application/javascript 142.250.71.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PR93DJN

Requested by

Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.71.72 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s17-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

02a6df792162322274136e29e8c835530ff428633ba9e3ddb72ff77dbf02eaab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68336
x-xss-protection: 0
last-modified: Wed, 21 Feb 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 21 Feb 2024 14:39:14 GMT

GET
H3 200 matomo.js Show response
on.cc/mlog/ 64 KB
22 KB 276ms
275ms Script
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://on.cc/mlog/matomo.js
Requested by: Host: on.cc
URL: https://on.cc/adv/web/corp/source/unicorp_v4.js?
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec55b2fb5b4a3a9ca253585bb27e969dfc381181acb7db17c04b87ee25092675

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
cf-cache-status: HIT
x-cacheable: L07
accept-language: bytes
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 02 Nov 2022 02:11:12 GMT
server: cloudflare
etag: W/"6361d1c0-10133"
vary: Accept-Encoding
x-varnish: 2588702 98307
content-type: application/javascript
cache-control: max-age=5, s-maxage=5
cf-ray: 858fbcd029b3a7ff-SYD

GET
H3 200 HSI_price_d1.txt Show response
money18.on.cc/chartdata/d1/price/ 9 KB
3 KB 274ms
273ms XHR
text/plain 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/chartdata/d1/price/HSI_price_d1.txt
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d636d8aa42e4349b2f3a6e4c8ef9987ebf28da446cc722ef8249335715700f29

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 08:59:06 GMT
server: cloudflare
etag: W/"65d5bb5a-244b"
vary: Accept-Encoding
content-type: text/plain
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcd029b4a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 chart_icon.png
money18.on.cc/img/ 4 KB
5 KB 954ms
954ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/chart_icon.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca3fa11d1d7cfcd543d0a19532df7e0d0cbd6a37e06385c384f5ef3de37297a5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
etag: "5ecbacf1-1129"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd21b25a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 4393

GET
H3 200 topStock_stock.js Show response
realtime-money18-cdn.on.cc/js/real/hk/json/ 27 KB
5 KB 265ms
265ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hk/json/topStock_stock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 201dc1c53067a7023563432b2f6dfb35ee989a29310a99b6b056d1e2aeda9159

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 08:58:04 GMT
server: cloudflare
etag: W/"65d5bb1c-6c04"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd228a8558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 fin_hotstock.js Show response
realtime-money18-cdn.on.cc/js/real/hotstock/hk/ 3 KB
2 KB 992ms
992ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hotstock/hk/fin_hotstock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06cb12d4dbd009cc4b937f03f83c2a1ce3139ada49ff11a45be50c5c8ea18030

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:01:12 GMT
server: cloudflare
etag: W/"65d5adc8-d6c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd238ab558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 74D3 42 B
108 B 444ms
144ms Fetch
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstwTRl9ohhwPWo1ClDuCr4Umg5dtSbk1Lzn-f1H_7SkdHyvHXy131tkMkU1NA3CI6wVoNjkM3c7RC5AZ5lCxBfK74Sc0AtZ22V9FROozon8Is-p7HkVwCGSKXs701potzvV3UQ1SSmHMaycMQWrng_hYZ1J6TS0BoM&sai=AMfl-YQFEcpFsCx8BWKpeADOoQOlpCwAoEn8awQyz9pLhT33TYZDoSSHwYPriKEsCe-_P3RXIAp7g6g5bZUN_I_Gb-pTT81G8h54cWmuL8qMvEAPSYOvKKUxCZ7fjnz0&sig=Cg0ArKJSzGjrNgxUONSQEAE&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&id=lidar2&mcvt=1092&p=346,1000,600,1300&mtos=0,1092,1092,1092,1092&tos=0,1092,0,0,0&v=20240220&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=250760903&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=445915300&rst=1708526351962&rpt=1211&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bkn-20240221222244247-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 87 KB
87 KB 260ms
259ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221222244247-0221_00842_001_01s.jpg?20240221222312
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a37dd2b98614243ae5536e359b5f1cf3d36cc6d65f7d19cef0154f52c57b3b3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
alt-svc: h3=":443"; ma=86400
content-length: 88848
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 14:22:49 GMT
server: cloudflare
etag: "65d60739-15b10"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 213709362
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd25b6aa7ff-SYD

GET
H3 200 bkn-20240221203046553-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 75 KB
76 KB 17ms
16ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221203046553-0221_00842_001_01s.jpg?20240221203418
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92cfcdbf39da56ecef4e7b6b15057049eeb09f0a3f4a266d238cc128720eed36

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 5589
alt-svc: h3=":443"; ma=86400
content-length: 77098
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 12:33:56 GMT
server: cloudflare
etag: "65d5edb4-12d2a"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 210300364
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd25b6ba7ff-SYD

GET
H3 200 bkn-20240221181747535-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 121 KB
122 KB 96ms
96ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221181747535-0221_00842_001_01s.jpg?20240221183200
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec1af4b5b2b52eda8c3e58f194cc74cae2424d1133e424bffea9674362571538

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 14822
alt-svc: h3=":443"; ma=86400
content-length: 124401
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 10:31:39 GMT
server: cloudflare
etag: "65d5d10b-1e5f1"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 315315403
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd25b6ca7ff-SYD

GET
H3 200 bkn-20240221213615440-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 69 KB
69 KB 268ms
267ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221213615440-0221_00842_001_01s.jpg?20240221214844
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10b808bd24f59428564013e78c6e3c778a835c93981ac4df96a91317bb881988

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
alt-svc: h3=":443"; ma=86400
content-length: 70670
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 13:48:20 GMT
server: cloudflare
etag: "65d5ff24-1140e"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 213819423
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd26b6fa7ff-SYD

GET
H3 200 bkn-20240216111231847-0216_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240216/photo/ 43 KB
43 KB 17ms
17ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240216/photo/bkn-20240216111231847-0216_00842_001_01s.jpg?20240216114006
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53a1c17bc65f97bc361b2f88dd0a2fb46e6db247eb3a9dc6a85b34171875b5ad

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 14822
alt-svc: h3=":443"; ma=86400
content-length: 43584
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Fri, 16 Feb 2024 03:39:56 GMT
server: cloudflare
etag: "65ced90c-aa40"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 992537482 97180113
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd26b72a7ff-SYD

GET
H3 200 bkn-20240215144858989-0215_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240215/photo/ 64 KB
64 KB 18ms
18ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240215/photo/bkn-20240215144858989-0215_00842_001_01s.jpg?20240215150547
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 232e9e2ae6968608d266543bc6d0cc9f5aa86c83414c96de8030a4a8265e69be

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 14822
alt-svc: h3=":443"; ma=86400
content-length: 65333
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Thu, 15 Feb 2024 07:05:34 GMT
server: cloudflare
etag: "65cdb7be-ff35"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 95694202 96658404
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd26b73a7ff-SYD

GET
H3 200 bkn-20240207130239593-0207_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240207/photo/ 64 KB
64 KB 33ms
33ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240207/photo/bkn-20240207130239593-0207_00842_001_01s.jpg?20240208033759
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e36aeecc475b140535892cc2bc4fd281c7e23671504ea720031952c5db45d0e0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 14822
alt-svc: h3=":443"; ma=86400
content-length: 65228
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 07 Feb 2024 06:01:52 GMT
server: cloudflare
etag: "65c31cd0-fecc"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 103614393 98701714
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd26b75a7ff-SYD

GET
H2 200 pic_300x250.jpg
s0.2mdn.net/sadbundle/11121323892759592960/images/ Frame B60C 37 KB
37 KB 2ms
2ms Image
image/jpeg 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11121323892759592960/images/pic_300x250.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb0520206ad00a3755f81161d1572832d2a7d3b375dd4c73baad4f9b525c85ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 19 Feb 2025 14:03:26 GMT
date: Tue, 20 Feb 2024 14:03:26 GMT
x-content-type-options: nosniff
age: 88548
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38120
x-xss-protection: 0
last-modified: Fri, 19 Jan 2024 06:33:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame AA2D 0
0 141ms
141ms Fetch
image/gif 142.250.67.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuIiSQAgRACah97nbDAxBOa9zAl2D8INnhoJr59f2zlyKIv6Ie0ZKGxfhVvQxtITKaR2LA0l29GdMGchS7m6shKqB_V8zayRmUnkfzCMTKgnxNL9lF654B8UGus4dXUU16Lc1dje7LCSgr-6Ei_6wMnIizTO6fbJyactkfFOvUo8GkP7E5E1E61vg&sai=AMfl-YTZIESwjNKa7eLOHBgUnCHCeY5PAPvx8jRVMCi0Ar7B6X1KwV_g8iQhTMP8_RyJXmD4SvEEVPXHzVpCXIgU2MpewZNvFLtasrYTcA&sig=Cg0ArKJSzEUQQl_pA527EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=995&vt=11&dtpt=944&dett=3&cstd=49&cisv=r20240215.13633&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.67.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Feb 2024 14:39:14 GMT

GET
H2 200 pic_300x250.jpg
s0.2mdn.net/sadbundle/11121323892759592960/images/ Frame B260 37 KB
37 KB 2ms
2ms Image
image/jpeg 172.217.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11121323892759592960/images/pic_300x250.jpg

Requested by

Host: code.createjs.com
URL: https://code.createjs.com/1.0.0/createjs.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb0520206ad00a3755f81161d1572832d2a7d3b375dd4c73baad4f9b525c85ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11121323892759592960/CRO_sydney_prelaunch_300x250.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 19 Feb 2025 14:03:26 GMT
date: Tue, 20 Feb 2024 14:03:26 GMT
x-content-type-options: nosniff
age: 88548
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38120
x-xss-protection: 0
last-modified: Fri, 19 Jan 2024 06:33:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D0AE 0
0 141ms
141ms Fetch
image/gif 142.250.67.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstkrWNmCgHcRBqe_Fh_jPSc-_GzjjqTC87c6gDdT4CVopun-5OeOBJGmnkOB5mKYBUqY--axsL3B43ShOiHnM-ZszKZESNeHSw3AP5SYHtlw3HMdXc3eTg_swsOmnT7pQ57auVPYWFv7Bnw5BxR4Vv2zHTuxls4gdsy2g3tZ5ZX26w6H3wi2UCiOw&sai=AMfl-YTLToda-EJqgjEMtFFEBWQdxXw_kqoKQA38qiTLSr96j6FnDGmZctYpcWIubDh3gfiB0IDh4kfBRuTHHZq0n5nDhQyL6ETbm44ZpQ&sig=Cg0ArKJSzD0RW7heZmovEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1402&vt=11&dtpt=965&dett=3&cstd=435&cisv=r20240215.98756&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.67.2 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Feb 2024 14:39:14 GMT

GET
H3 200 matomo.php
on.cc/mlog/ 0
276 B 12ms
12ms Image
text/php 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://on.cc/mlog/matomo.php?action_name=Money18%20%E4%B8%BB%E9%A0%81&idsite=4&rec=1&r=873972&h=22&m=39&s=14&url=https%3A%2F%2Fmoney18.on.cc%2F&urlref=http%3A%2F%2Fmoney18.on.cc%2F&_id=14dc22b36e18b830&_idn=1&send_image=1&_refts=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=EpgZG2&pf_net=0&pf_srv=23&pf_tfr=1&pf_dm1=5590&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: L08
age: 162
x-host: WL25
alt-svc: h3=":443"; ma=86400
content-length: 0
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 02 Nov 2022 02:12:58 GMT
server: cloudflare
etag: "6361d22a-0"
vary: Accept-Encoding
content-type: text/php
x-varnish: 148826266
cache-control: public, max-age=30, s-maxage=300
accept-ranges: bytes
cf-ray: 858fbcd2aba6a7ff-SYD

GET
H3 200 bkn-20240221070005355-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 81 KB
82 KB 19ms
18ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221070005355-0221_00842_001_01s.jpg?20240221070411
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c0705107beb7c0df48c5262897b7f158ee91e5d192a72aa2c0f44f96f500ff4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 26392
alt-svc: h3=":443"; ma=86400
content-length: 83165
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 23:04:02 GMT
server: cloudflare
etag: "65d52fe2-144dd"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 285048803
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd2dbdaa7ff-SYD

GET
H3 200 bkn-20240221060057213-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 52 KB
52 KB 17ms
16ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221060057213-0221_00842_001_01s.jpg?20240221060405
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f92d43ebbbc87566ee3dbca1f458f599cf88f21008ded3bb24a986b5cfb50c3

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 28092
alt-svc: h3=":443"; ma=86400
content-length: 52889
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 22:03:57 GMT
server: cloudflare
etag: "65d521cd-ce99"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 176800457
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd2dbdba7ff-SYD

GET
H3 200 bkn-20240221050033765-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 65 KB
65 KB 22ms
21ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221050033765-0221_00842_001_01s.jpg?20240221050415
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a3daca44bc5e0f125673593744672fb7ce4e8bc35dd03a0ff32abb6b72c2604f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 1784
alt-svc: h3=":443"; ma=86400
content-length: 66084
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 21:04:04 GMT
server: cloudflare
etag: "65d513c4-10224"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 284134555
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd2dbdca7ff-SYD

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame AA2D 42 B
108 B 141ms
141ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst0tzo4Cbqy4JIPPHEWZNm839jEsntlbMvuS2DyWYmTBLylowHAqR1SE6UQxTuADR08mBI56r2REHkRvRO_TiyKNetBazQUKyaBO-uBFaSfJtOwbADbKEl9_o8D2LvDLR6jJeJikbZJw8A&sig=Cg0ArKJSzCqiOj8EyEOQEAE&id=lidar2&r=i&sloi=1&bs=0,0&ps=-12245933,-12245933&scs=1600,1200&tt=3&pt=620&bin=2&deb=1%3B1%3B1%3B2%3B0%3B0%3B0%3B0%3B0%3B0%3B0%3B0&tvt=0&iframe_loc=https%253A%252F%252Fad.doubleclick.net%252Fddm%252Fadi%252FN1255798.4078729MATTERKINDAU%252FB31307780.386243046%253Bdc_ver%253D99.292%253Bsz%253D300x250%253Bu_sd%253D1%253Bgdpr%253D0%253Bdc_adk%253D3690638940%253Bord%253Ds5263k%253Bclick%253Dhttps%25253A%25252F%25252Fgoogleads.g.doubleclick.net%25252Fdbm%25252Fclk%25253Fsa%25253DL%252526ai%25253DCypqcDgvWZdnQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QSiUfWp5ySNui4vbI-N_s44B8wRrXN98HbEYUgBE2G_7_xFiRHkIvlhu9GNJPSyFl2gfCIiHS2syXO8zryLQej5D_p0eYdXQuCmtQ80q2dM9V1ABydg0OB48PerGsFDwQjQJzOca1o9hyjO9R85lSDscOWWnRInBIzxEDFLHbE_C&is=300,250&url=https%3A%2F%2Fad.doubleclick.net%2Fddm%2Fadi%2FN1255798.4078729MATTERKINDAU%2FB31307780.386243046%3Bdc_ver%3D99.292%3Bsz%3D300x250%3Bu_sd%3D1%3Bgdpr%3D0%3Bdc_adk%3D3690638940%3Bord%3Ds5263k%3Bclick%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%253Fsa%253DL%2526ai%253DCypqcDgvWZdnQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QSiUfWp5ySNui4vbI-N_s44B8wRrXN98HbEYUgBE2G_7_xFiRHkIvlhu9GNJPSyFl2gfCIiHS2syXO8zryLQej5D_p0eYdXQuCmtQ80q2dM9V1ABydg0OB48PerGsFDwQjQJzOca1o9hyjO9R85lSDscOWWnRInBIzxEDFLHbE_C&referrer=https%3A%2F%2F7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com%2F&adk=3690638940&p=0,0,0,0&tos=0,0,0,0,0&mtos=0,0,0,0,0&mcvt=0&rs=5&mc=-1&lte=-2&bas=0&bac=0&if=0&met=mue&avms=ns&btr=0&cpmav=0&abdbg=0%3B1&vs=2&itpl=34&v=20240214

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame D0AE 42 B
108 B 140ms
139ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvwaz-s4CTiJuKIq1FhUZQlrTTs_e0LKWE_RPVR-FytQ4AjRLnByZZH_Kwb90Qunq_2JECpBPJcdhLdGUuNIRwPK1qZaN9qeo_hRSoJmTNmctoyA734ege9yMfDwumzWrBR9q6fOMGchkM&sig=Cg0ArKJSzCJvbT_YG73UEAE&id=lidar2&r=i&sloi=1&bs=0,0&ps=-12245933,-12245933&scs=1600,1200&tt=1&pt=925&bin=2&deb=1%3B1%3B1%3B2%3B0%3B0%3B0%3B0%3B0%3B0%3B0%3B0&tvt=0&iframe_loc=https%253A%252F%252Fad.doubleclick.net%252Fddm%252Fadi%252FN1255798.4078729MATTERKINDAU%252FB31307780.386243046%253Bdc_ver%253D99.292%253Bdc_eid%253D40004000%253Bsz%253D300x250%253Bu_sd%253D1%253Bgdpr%253D0%253Bdc_adk%253D1033480528%253Bord%253Dzucvbh%253Bclick%253Dhttps%25253A%25252F%25252Fgoogleads.g.doubleclick.net%25252Fdbm%25252Fclk%25253Fsa%25253DL%252526ai%25253DCkSalDgvWZdrQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QDRjcqed3eWLmuT3l5wekzR1Qls2p6CCxyjJUom7-MRyeILe1RZbcRPwJ9LUyLfISxJNTPRU-Ln2gFcblxYVtci0fAFq4oKCRDopqwKQA82-9LIGhjJy1FhUIym27aYqrXV66Rl24-kJpjuv8qWNuTvcqeFU&is=300,250&url=https%3A%2F%2Fad.doubleclick.net%2Fddm%2Fadi%2FN1255798.4078729MATTERKINDAU%2FB31307780.386243046%3Bdc_ver%3D99.292%3Bdc_eid%3D40004000%3Bsz%3D300x250%3Bu_sd%3D1%3Bgdpr%3D0%3Bdc_adk%3D1033480528%3Bord%3Dzucvbh%3Bclick%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%253Fsa%253DL%2526ai%253DCkSalDgvWZdrQKfPIz7sP_LOI4AK4xMrBdb-8o_iVEvfSor3AARABIN3BlSJgpfiRgJABoAHt_fOoAsgBCakCUbAj1uX-pT6oAwHIA5sEqgSYAk_QDRjcqed3eWLmuT3l5wekzR1Qls2p6CCxyjJUom7-MRyeILe1RZbcRPwJ9LUyLfISxJNTPRU-Ln2gFcblxYVtci0fAFq4oKCRDopqwKQA82-9LIGhjJy1FhUIym27aYqrXV66Rl24-kJpjuv8qWNuTvcqeFU&referrer=https%3A%2F%2F7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com%2F&adk=1033480528&p=0,0,0,0&tos=0,0,0,0,0&mtos=0,0,0,0,0&mcvt=0&rs=5&mc=-1&lte=-2&bas=0&bac=0&if=0&met=mue&avms=ns&btr=0&cpmav=0&abdbg=0%3B1&vs=2&itpl=34&v=20240214

Requested by

Host: money18.on.cc
URL: https://money18.on.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bknClientArticle.js Show response
hk.on.cc/hk/finance/ 483 B
527 B 275ms
274ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hk.on.cc/hk/finance/bknClientArticle.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b61cca727205a75eb1f8986931aa0610be257867b9cb9bb99ddadaf717b4bb6c

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-cacheable: Y10
alt-svc: h3=":443"; ma=86400
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Feb 2024 02:02:44 GMT
server: cloudflare
etag: W/"65d559c4-1e3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-varnish: 169490156 183823110
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcd3991b558d-SYD

GET
H3 200 bkn-20240221092046173-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 85 KB
85 KB 20ms
18ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221092046173-0221_00842_001_01s.jpg?20240221173145
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09e13d5458e29f205f35f7fa40adbaf5b0b557c7377ecdd086b47698b95c2a9e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 18073
alt-svc: h3=":443"; ma=86400
content-length: 86720
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 06:29:38 GMT
server: cloudflare
etag: "65d59852-152c0"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 314191378
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39ca8a7ff-SYD

GET
H3 200 bkn-20240221131528058-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 87 KB
87 KB 32ms
30ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221131528058-0221_00842_001_01s.jpg?20240221131849
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 828afc3ec5f3a7de6d49101746ff46c795d5d3c32e1548df73a6e3127586d506

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 1785
alt-svc: h3=":443"; ma=86400
content-length: 89230
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 05:18:36 GMT
server: cloudflare
etag: "65d587ac-15c8e"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 193942556
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39caba7ff-SYD

GET
H3 200 bkn-20240221115703132-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 54 KB
54 KB 31ms
29ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221115703132-0221_00842_001_01s.jpg?20240221173143
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f8e7e1754e061147f4790fcc89ebafb9f5990f137e7b22ec97afafee068b59d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 17706
alt-svc: h3=":443"; ma=86400
content-length: 54884
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 03:57:09 GMT
server: cloudflare
etag: "65d57495-d664"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 312784876
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39cada7ff-SYD

GET
H3 200 bkn-20240221095900491-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 56 KB
56 KB 25ms
24ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221095900491-0221_00842_001_01s.jpg?20240221100228
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64550db3a17749fa0c8499efc03f1da61249e5042146698ccd7cbcf2bc859060

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 16156
alt-svc: h3=":443"; ma=86400
content-length: 57137
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 02:02:21 GMT
server: cloudflare
etag: "65d559ad-df31"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 181035523
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39caea7ff-SYD

GET
H3 200 bkn-20240221074506901-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 70 KB
70 KB 26ms
25ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221074506901-0221_00842_001_01s.jpg?20240221084413
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecabcc10fa24ab8f16a9a2920d7acf81ef68cabb56bed8c4297ae55f61083a54

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 21059
alt-svc: h3=":443"; ma=86400
content-length: 71732
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 00:39:55 GMT
server: cloudflare
etag: "65d5465b-11834"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 182654718
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39cafa7ff-SYD

GET
H3 200 bkn-20240221040438248-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 82 KB
83 KB 23ms
22ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221040438248-0221_00842_001_01s.jpg?20240221040909
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4fb0dc1b6518a8ed49ab2830eb2302304dc5cf221319140ad0a22d384bec1fc

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 8496
alt-svc: h3=":443"; ma=86400
content-length: 84280
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 20:09:00 GMT
server: cloudflare
etag: "65d506dc-14938"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 168229499
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39cb0a7ff-SYD

GET
H3 200 bkn-20240220170047267-0220_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240220/photo/ 54 KB
54 KB 28ms
26ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240220/photo/bkn-20240220170047267-0220_00842_001_01s.jpg?20240220170122
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4857acd33d2d0aa4bc5858bb4d93284d86ff9e84f14763526c9bf51ccdcf89a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 14822
alt-svc: h3=":443"; ma=86400
content-length: 55325
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 09:00:56 GMT
server: cloudflare
etag: "65d46a48-d81d"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 254962387
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39cb1a7ff-SYD

GET
H3 200 bkn-20240220092056904-0220_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240220/photo/ 83 KB
83 KB 33ms
32ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240220/photo/bkn-20240220092056904-0220_00842_001_01s.jpg?20240221122210
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfb6e8336c70ac1a48116dbd341a9eee41a2384d50929c8e354d49b33f13e2ed

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 5590
alt-svc: h3=":443"; ma=86400
content-length: 84556
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 01:34:23 GMT
server: cloudflare
etag: "65d4019f-14a4c"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 147934127
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39cb2a7ff-SYD

GET
H3 200 bkn-20240220163111077-0220_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240220/photo/ 76 KB
76 KB 21ms
20ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240220/photo/bkn-20240220163111077-0220_00842_001_01s.jpg?20240221085815
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6043be1e9f22d6650a9e170b42b682594b6d62c089297f7dcecc3e013323aa2f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 20202
alt-svc: h3=":443"; ma=86400
content-length: 77804
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 08:43:55 GMT
server: cloudflare
etag: "65d4664b-12fec"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 289978006
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd39cb3a7ff-SYD

GET
H3 200 fin_hot_warrant_stock.js Show response
realtime-money18-cdn.on.cc/js/real/hotstock/hk/ 4 KB
1 KB 268ms
267ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hotstock/hk/fin_hot_warrant_stock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c87ba25fbe0a26958e4abb7b3f8f7b4343934905c4668f4c95b686ed8f5ae7d1

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:01:12 GMT
server: cloudflare
etag: W/"65d5adc8-103a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd4093c558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H2 200 launchpad-liveramp.js Show response
launchpad-wrapper.privacymanager.io/805cefc2-89d9-41ea-9a77-f386d0b9560c/ 2 KB
2 KB 123ms
3ms Script
text/javascript 13.224.181.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad-wrapper.privacymanager.io/805cefc2-89d9-41ea-9a77-f386d0b9560c/launchpad-liveramp.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PR93DJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.181.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-181-83.syd1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8060cfdafd9e064e7e645ad5c6067b1ce31b0e35fa1b236bd3f35845255721e4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-amz-version-id: pK4c.V3vEJudESa0VaHdy9wOSeRJ8uH_
content-encoding: gzip
via: 1.1 98c0260f137c498b550b5ea75d3bc892.cloudfront.net (CloudFront)
date: Wed, 21 Feb 2024 00:07:59 GMT
x-amz-cf-pop: SYD1-C2
age: 71569
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: attachment; filename="launchpad-liveramp.js"
last-modified: Thu, 12 Oct 2023 07:50:51 GMT
server: AmazonS3
etag: W/"a090ad797aef8fef7edfa8fefa7682e5"
vary: Accept-Encoding
content-type: text/javascript
x-amz-cf-id: GR1ZZkjierbBzSeMU-JVHky1qTy4VFq2By83vHrwvE61Gfo4OwYHRw==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 278 KB
93 KB 119ms
118ms Script
application/javascript 142.250.71.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TS7CRBVM80&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PR93DJN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.71.72 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s17-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

01b3ef548e9a7fd5a5e9af58cf4ac6281c2aa690139d0d7c50983e4965e0d133

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 94848
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 21 Feb 2024 14:39:14 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95BF 0
56 B 138ms
138ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=592937586103&version=m202401290101&ct=76&x=1&cor=17993345040343450000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 web_btn.png
hk.on.cc/adv/web/corp/img/ 6 KB
6 KB 17ms
16ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/adv/web/corp/img/web_btn.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d00ef9f9dce166845458fc99049b500dd07238787ccc25da41ea7f9ac7fe7b5d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:14 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 11310
alt-svc: h3=":443"; ma=86400
content-length: 5752
pragma: public
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 02 Aug 2018 05:34:50 GMT
server: cloudflare
etag: "5b6297fa-1678"
vary: Accept-Encoding
content-type: image/png
x-varnish: 197447074 195718369
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 858fbcd49dcfa7ff-SYD

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 95BF 42 B
108 B 147ms
147ms Fetch
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstViUehEB6-CwYzG3L-a7Np_xqNtgK3yCZXx7acYgNT3O1nH7DeLwOX2YP35VWb5YV_YydL3bAzXp9ka4_ZAk5rQzSD7K0UxnTa0SzUbYkm6BGuvkHYWlRyazPvELAf0oGHLARl740ydHy0DtV71ckXqgRBrJKxZu4&sai=AMfl-YQNRPa1dbeq-62MwD_QD1AHObu2ln2pvEt7i_g0_fTV0SRs8U0DOo4gELKiW1SJiUf026IkydPLhCUdzamIS1k4AFSAGeSGfQZSHD45TfsK66NKtmkz_KheHsEn&sig=Cg0ArKJSzIzQLA-Z3LwKEAE&cid=CAQSPAAvHhf_5IP2ZYQdsEjGQgXugApCUEnc3evl3Ou9RcWJVrkmetdvMDas6qcdg1gQR6SZ1ZiuSCZmR-wskxgB&id=lidar2&mcvt=1007&p=244,436,334,1164&mtos=1007,1007,1007,1007,1007&tos=1007,0,0,0,0&v=20240220&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=993126795&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=445915300&rst=1708526351903&rpt=1727&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 launchpad.bundle.js Show response
launchpad.privacymanager.io/latest/ 126 KB
26 KB 119ms
2ms Script
application/x-javascript 18.67.93.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Requested by: Host: launchpad-wrapper.privacymanager.io
URL: https://launchpad-wrapper.privacymanager.io/805cefc2-89d9-41ea-9a77-f386d0b9560c/launchpad-liveramp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-11.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 10ca218fc957f3b1b7f8f0a0f6bab1c8b384ed7d6edda052614bf8cc9c14eac2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-amz-version-id: OYXhO0yAI32wYHLbaFkvb4YycLXHk8gH
content-encoding: br
via: 1.1 28cc33f6d1fa8bfd0cce12161c7d5e90.cloudfront.net (CloudFront)
date: Wed, 21 Feb 2024 14:36:14 GMT
last-modified: Tue, 12 Dec 2023 13:01:22 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P1
age: 180
x-amz-server-side-encryption: AES256
etag: W/"6f5acc886b373331d622309f643f2f89"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: must-revalidate,public,max-age=3600
x-amz-cf-id: ZxNingtH-N8JTNlBFMnZ9_WGRBSOMybweBHqgzwqruObCg7j6tL3WA==

GET
H3 200 fin_hot_cbbc_stock.js Show response
realtime-money18-cdn.on.cc/js/real/hotstock/hk/ 4 KB
1 KB 261ms
261ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hotstock/hk/fin_hot_cbbc_stock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29f21d22d76a37923acf31e2a101eccc05cb67d7750cc85a43da7038b25e7393

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:01:12 GMT
server: cloudflare
etag: W/"65d5adc8-104a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd54987558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 bkn-20240221095900491-0221_00842_001.js Show response
money18.on.cc/cnt/utf8/content/20240221/article/ 6 KB
3 KB 273ms
273ms XHR
application/x-javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/cnt/utf8/content/20240221/article/bkn-20240221095900491-0221_00842_001.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b55bfd19fd9d31671e753383a466191864253730e330d33f0586b7cccc1cdb9

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 21 Feb 2024 02:02:33 GMT
server: cloudflare
etag: W/"1654-611dab84f2040"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=10, s-maxage=10
x-host: WS03
cf-ray: 858fbcd54e6da7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 indicator.php Show response
money18.on.cc/securityQuote/technicalIndicator/ 44 KB
11 KB 520ms
520ms XHR
text/html 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/securityQuote/technicalIndicator/indicator.php
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f513b5f0156cda1f9f6fdae26b2f77c071dd9720938b04a87798455b91849444

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
server: cloudflare
etag: W/"0e77609df8cd73b193339b150cfe3041"
vary: Accept-Encoding
x-cache: EXPIRED
content-type: text/html; charset=UTF-8
cache-control: public, max-age=5, s-maxage=10, stale-if-error=86400, stale-while-revalidate=30
x-host: WLUB13
cf-ray: 858fbcd5beaca7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
geo.privacymanager.io/ 31 B
624 B 149ms
148ms Fetch
application/json 99.84.238.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: launchpad.privacymanager.io
URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.238.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-238-198.sfo5.r.cloudfront.net
Software: /
Resource Hash: 9c68b2aacc269439681b9a0d2624d2473595c07e5a2500f191b9517f6a2aac24

Request headers

Accept: application/json
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 21 Feb 2024 13:52:49 GMT
via: 1.1 2484d95e1962e4fa6652ac5bdc660206.cloudfront.net (CloudFront), 1.1 dec8fa38a453902521b941c7cd70d33c.cloudfront.net (CloudFront)
x-amz-cf-pop: SFO53-P6, SFO5-C3
age: 2786
x-amzn-requestid: cc984dd2-edc1-4e26-ab84-bb425d6168df
x-amzn-trace-id: Root=1-65d60031-1427a7284d0bbd303ee3b797;Parent=2d128c03b8875641;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: TfT3wHsnjoEEm7g=
content-length: 31
x-amz-cf-id: 7Dwd1gvrJ292tQkadfhjsHDDfGV9X8dPqK8Z7aG4QF_nIXTZwPcl2g==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

OPTIONS
H2 200 /
geo.privacymanager.io/ Frame 0
0 677ms
278ms Preflight
application/json 99.84.238.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.238.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-238-198.sfo5.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://money18.on.cc
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Wed, 21 Feb 2024 14:39:15 GMT
via: 1.1 3d4a6e7eb738ddcd8d810f8af7dc83ca.cloudfront.net (CloudFront), 1.1 dec8fa38a453902521b941c7cd70d33c.cloudfront.net (CloudFront)
x-amz-apigw-id: TfarFF7-DoEEQJg=
x-amz-cf-id: i2k0yKLHZdDhbboAmO7S6lFqlJ6m5H7dwZtZ-BfsI0KuegLu3k4mSA==
x-amz-cf-pop: SFO53-P6 SFO5-C3
x-amzn-requestid: 1e444143-c21f-48b2-9982-900359eb413b
x-cache: Miss from cloudfront

POST
H2 204 collect
www.google-analytics.com/g/ 0
252 B 499ms
99ms Ping
text/plain 172.217.24.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TS7CRBVM80&gtm=45je42h0v9102707666z89116613061za200&_p=1708526353941&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&tcfd=10000&cid=2011605256.1708526349&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1708526354&sct=1&seg=0&dl=https%3A%2F%2Fmoney18.on.cc%2F&dr=http%3A%2F%2Fmoney18.on.cc%2F&dt=Money18%20%E4%B8%BB%E9%A0%81&en=page_view&_fv=1&_ss=1&tfd=8956
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TS7CRBVM80&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.24.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: hkg07s23-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:15 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://money18.on.cc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 overview_list.js Show response
realtime-money18-cdn.on.cc/marketSector/UTF8/overall/ 87 KB
17 KB 266ms
266ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/marketSector/UTF8/overall/overview_list.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 23d5c309767b7564d0d057b39d263d4964c36e54ba288aee674a0c725075327b

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:44:38 GMT
server: cloudflare
etag: W/"65d5b7f6-15d6a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd6fa00558d-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 topStock_stock.js Show response
realtime-money18-cdn.on.cc/js/real/hk/json/ 27 KB
5 KB 21ms
20ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hk/json/topStock_stock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 201dc1c53067a7023563432b2f6dfb35ee989a29310a99b6b056d1e2aeda9159

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 08:58:04 GMT
server: cloudflare
age: 1
etag: W/"65d5bb1c-6c04"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd70a05558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 bkn-20240221095900491-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 56 KB
56 KB 17ms
17ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221095900491-0221_00842_001_01s.jpg?20240221095900
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64550db3a17749fa0c8499efc03f1da61249e5042146698ccd7cbcf2bc859060

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
x-cacheable: Y10
age: 16156
alt-svc: h3=":443"; ma=86400
content-length: 57137
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Wed, 21 Feb 2024 02:02:21 GMT
server: cloudflare
etag: "65d559ad-df31"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 185998801
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd70f9ea7ff-SYD

GET
H3 200 topStock_cbbc.js Show response
realtime-money18-cdn.on.cc/js/real/hk/json/ 28 KB
3 KB 273ms
272ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hk/json/topStock_cbbc.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f07e9a117a29f3bd1a6299efea377393c70f46375c3ae51cc5510c2b404045b

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:58:04 GMT
server: cloudflare
etag: W/"65d5bb1c-7049"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd73a0c558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 arrow_green_up.png
money18.on.cc/img/ 1 KB
2 KB 17ms
17ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/arrow_green_up.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a60d7cf9592a702e99e8e6f987b8c03d426d9ac087fccad45b0fac599ff5d941

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
last-modified: Tue, 29 Dec 2020 08:13:59 GMT
server: cloudflare
age: 2601
etag: "5feae547-5a2"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd73fb0a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1442

GET
H3 200 arrow_red_down.png
money18.on.cc/img/ 1 KB
1 KB 260ms
260ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/arrow_red_down.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da3be62e1419219aa34656f4e559ab52fe98941bd3f9c9dc048e851a7720acc5

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:04 GMT
server: cloudflare
etag: "5ecbacf0-4ad"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd73fb1a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1197

GET
H3 200 topStock_warrant.js Show response
realtime-money18-cdn.on.cc/js/real/hk/json/ 28 KB
3 KB 271ms
271ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hk/json/topStock_warrant.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c9f28486fafb3b15e94ebc600a1a5c8007bbd9df8bb505a9d57933c3c400c9c

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:58:05 GMT
server: cloudflare
etag: W/"65d5bb1d-6fd2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd86a84558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 topStock_shhkConnect.js Show response
realtime-money18-cdn.on.cc/js/real/hk/json/ 27 KB
5 KB 283ms
282ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hk/json/topStock_shhkConnect.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c77a077f8a284d38729d5e20de0684e2524f97b30eb9e138615114af989d68a

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:58:05 GMT
server: cloudflare
etag: W/"65d5bb1d-6c25"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd8aa99558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74D3 0
56 B 138ms
138ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1286548217109&version=m202401290101&ct=77&x=1&cor=123522637713810340

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 topStock_szhkConnect.js Show response
realtime-money18-cdn.on.cc/js/real/hk/json/ 27 KB
5 KB 270ms
270ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime-money18-cdn.on.cc/js/real/hk/json/topStock_szhkConnect.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 93e5b06f4171662189d24887b7396ac1ca9be7b025654b057c6f9af8f7604aa2

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 08:58:05 GMT
server: cloudflare
etag: W/"65d5bb1d-6c35"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2, s-maxage=2
cf-ray: 858fbcd90ac4558d-SYD
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
alt-svc: h3=":443"; ma=86400

GET
H3 200 dividendMemo.js Show response
money18.on.cc/js/dividendMemo/ 8 KB
2 KB 267ms
267ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/dividendMemo/dividendMemo.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4d2570c72557acbff65286969ed1692c56b2d462bab240e199894ebc3ed641

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 05:49:25 GMT
server: cloudflare
etag: W/"65d58ee5-1f9e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcd9184da7ff-SYD
alt-svc: h3=":443"; ma=86400

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2205 0
56 B 138ms
138ms Ping
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1807352322951&version=m202401290101&ct=77&x=1&cor=151603926275874300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://7ebe5bd7fcb6ac46585374b75e281c99.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 btn_radar_green_up.png
money18.on.cc/img/ 2 KB
2 KB 18ms
18ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/btn_radar_green_up.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14d084ebc8e2841bff62f6fbf6098514f984ea44f85353b331e1099491edffac

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
age: 1784
etag: "5ecbacf1-6a0"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd9485fa7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1696

GET
H3 200 btn_radar_red_down.png
money18.on.cc/img/ 2 KB
2 KB 19ms
18ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/btn_radar_red_down.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fab27fe81e37d4bc16a6081b144ccdf294a3c3b4bb46e8dbf238905352cc05d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
last-modified: Mon, 25 May 2020 11:33:05 GMT
server: cloudflare
age: 1784
etag: "5ecbacf1-68a"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd94861a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1674

GET
H3 200 bkn-20240221030035550-0221_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240221/photo/ 89 KB
89 KB 18ms
17ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240221/photo/bkn-20240221030035550-0221_00842_001_01s.jpg?20240221030347
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51f777db523c573497c81dce1dd6cfb13cbc59ddb352a5bce9833c055d48bb1a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 10638
alt-svc: h3=":443"; ma=86400
content-length: 91048
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 19:03:41 GMT
server: cloudflare
etag: "65d4f78d-163a8"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 281548459 279530018
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd9c889a7ff-SYD

GET
H3 200 bkn-20240220131553379-0220_00842_001_01s.jpg
hk.on.cc/hk/bkn/cnt/finance/20240220/photo/ 81 KB
81 KB 16ms
16ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hk.on.cc/hk/bkn/cnt/finance/20240220/photo/bkn-20240220131553379-0220_00842_001_01s.jpg?20240220131858
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea795e125037522df0c4eb8c384be7d7ee3ff1d06c6bc5ed749ad14ab24be2c0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
cf-cache-status: HIT
x-cacheable: Y09
age: 1786
alt-svc: h3=":443"; ma=86400
content-length: 82840
pragma: public
referrer-policy: no-referrer-when-downgrade
cf-bgj: h2pri
last-modified: Tue, 20 Feb 2024 05:18:42 GMT
server: cloudflare
etag: "65d43632-14398"
vary: Accept-Encoding
content-type: image/jpeg
x-varnish: 339867834
cache-control: public, max-age=28800, stale-if-error=600, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcd9c88ba7ff-SYD

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 175ms
175ms XHR
application/json 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202402150101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16a45f55f9a68ce08b169270764bd895a3d4da2170b55a417282ca6be6ec918b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12292
x-xss-protection: 0

GET
H3 200 allipo.js Show response
money18.on.cc/IPO/js/json/ 45 KB
10 KB 268ms
267ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/IPO/js/json/allipo.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b58fd08bb3b5880844e4d4125a8814a620ee82ce4500449a571c68741107d73

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Tue, 16 Jan 2024 01:30:16 GMT
server: cloudflare
etag: W/"65a5dc28-b553"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcda28b5a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 worldDiaryJson_u.js Show response
money18.on.cc/js/ 561 B
460 B 264ms
264ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/worldDiaryJson_u.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d16d82a10714a2b0bd90ab5c11bdbb82692f5c1e9f8df4e318c8b2ca9d8bb0b

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 14:02:17 GMT
server: cloudflare
etag: W/"65d60269-231"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbcda78d4a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 fin_hotstock.js Show response
money18.on.cc/js/real/hotstock/hk/ 3 KB
2 KB 259ms
258ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/real/hotstock/hk/fin_hotstock.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06cb12d4dbd009cc4b937f03f83c2a1ce3139ada49ff11a45be50c5c8ea18030

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Wed, 21 Feb 2024 08:01:12 GMT
server: cloudflare
etag: W/"65d5adc8-d6c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
cf-ray: 858fbcdac8f4a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 129ms
129ms Script
text/javascript 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 21 Feb 2024 14:39:15 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 95E1 13 KB
5 KB 3ms
2ms Document
text/html 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.204.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 456177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 07:56:18 GMT
expires: Sat, 15 Feb 2025 07:56:18 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C52E 829 B
997 B 100ms
99ms Document
text/html 142.250.67.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.4 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s16-in-f4.1e100.net

Software

GSE /

Resource Hash

900628df4c7e428a8aedef8f6471f8838ec5a12c334a89ca0dc613e73834e6b4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jcdAzyD1kH-Ku04qRaiO-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://money18.on.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-jcdAzyD1kH-Ku04qRaiO-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 21 Feb 2024 14:39:15 GMT
expires: Wed, 21 Feb 2024 14:39:15 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 95E1 39 KB
15 KB 2ms
2ms Script
text/javascript 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:09:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 455369
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 08:09:46 GMT

GET
H3 200 genStockJSONHKWithDelay.php Show response
money18.on.cc/securityQuote/ 1 KB
705 B 266ms
266ms XHR
application/json 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/securityQuote/genStockJSONHKWithDelay.php?stockcode=65446,50064,21633,23176
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65041c4e45a4b4546ceb4feef2e4d99b875cfd4976f743c3b3ce8072567c1f07

Request headers

Accept: */*
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:16 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
server: cloudflare
etag: W/"70ad73a1d2e388fc953a5c3be3126622"
vary: Accept-Encoding
x-cache: EXPIRED
content-type: application/json
cache-control: public, max-age=2, s-maxage=2, stale-if-error=86400, stale-while-revalidate=30
cf-ray: 858fbcdc7989a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 ic_m18blue_arrow.gif
money18.on.cc/img/ 50 B
292 B 263ms
262ms Image
image/gif 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/ic_m18blue_arrow.gif
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbc3447deabfc1563c1b6ea6d09dae6ade79529dec26af7e83a9ad4353a209b6

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:16 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
last-modified: Sun, 04 Oct 2009 03:08:06 GMT
server: cloudflare
etag: "4ac81196-32"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcdc798aa7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 50

GET
H2 204 generate_204
tpc.googlesyndication.com/ Frame 95E1 0
40 B 2ms
1ms Image
text/plain 142.250.204.1
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Ehgr5w
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.204.1 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd09s25-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:15 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C52E 0
0 138ms
137ms Image
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202402150101&jk=2647609613333048&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd09s31-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 200 genStockJSONHKWithDelay.php Show response
money18.on.cc/securityQuote/ 6 KB
2 KB 331ms
330ms XHR
application/json 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/securityQuote/genStockJSONHKWithDelay.php?stockcode=22796,22835,22472,22768,21635,21828,21820,22095,21411,23210,21704,20528,22192,23111,21899,22507,15601,0000-,22231,0000-
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7aa16af7e6133a79777615db223126dc1ac39ad36d4c62078ff5149ee347ed7

Request headers

Accept: */*
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:16 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
server: cloudflare
etag: W/"955b7c1aa26c58cb96390f6f74c42e67"
vary: Accept-Encoding
x-cache: MISS
content-type: application/json
cache-control: public, max-age=2, s-maxage=2, stale-if-error=86400, stale-while-revalidate=30
cf-ray: 858fbcde2ad7a7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 225x240px_bg.jpg
money18.on.cc/ad/jpad2022/img/ 5 KB
5 KB 263ms
263ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad2022/img/225x240px_bg.jpg
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0051850fb6d44cdbf58f888c583699061cba87ecfa4d24cb2948e707028392c1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:16 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Thu, 08 Sep 2022 08:08:51 GMT
server: cloudflare
etag: "6319a313-126c"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=28800, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcde3b08a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 4716

GET
H3 200 cow_2.png
money18.on.cc/ad/jpad2022/img/204x204/ 10 KB
10 KB 16ms
16ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad2022/img/204x204/cow_2.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef745f67acdf81a6798b9ad618e129b86ed002f8892383475a1be35bd4f31b3f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:16 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Sep 2022 04:02:09 GMT
server: cloudflare
age: 2593
etag: "631abac1-26d2"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=28800, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcde3b0aa7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 9938

GET
H3 200 bear_2.png
money18.on.cc/ad/jpad2022/img/204x204/ 10 KB
10 KB 22ms
21ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad2022/img/204x204/bear_2.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db8b4e3a45b0e34c231354b0154a0e0f6388725eba0a1e10f1ea9b82f695c3a8

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:16 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Sep 2022 04:07:27 GMT
server: cloudflare
age: 2593
etag: "631abbff-2627"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=28800, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcde3b0ba7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 9767

GET
H3 200 call_2.png
money18.on.cc/ad/jpad2022/img/204x204/ 9 KB
10 KB 16ms
16ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad2022/img/204x204/call_2.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ccc0f33e723ad1b7183ab147a17d0b856547ea652b0ed8162f4bc91b3a1747d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:16 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Sep 2022 03:57:17 GMT
server: cloudflare
age: 3914
etag: "631ab99d-25db"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=28800, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcde3b0ca7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 9691

GET
H3 200 put_2.png
money18.on.cc/ad/jpad2022/img/204x204/ 10 KB
10 KB 17ms
16ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/ad/jpad2022/img/204x204/put_2.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8a38a1bb0a5151119c525aee708d4412364a2bb3612733ae616ea1ddad8af56

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:16 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Sep 2022 04:06:14 GMT
server: cloudflare
age: 3914
etag: "631abbb6-2633"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=28800, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbcde3b0da7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 9779

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 139ms
139ms Image
text/html 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202402150101&jk=2647609613333048&bg=!5Oel56jNAAZN4L4YbeA7ADQBe5WfOE9TJMOo402bIiVG9MhWLplddDAjfoYYnI7BGpdyZTkhyYEiTzXxpb4pEziktvlwAgAAAGNSAAAAA2gBB5kCvb7y8JPhLEBEQA6NRvd0cO-LR2yCv87JWfFe2HczefJZF864TdAJ0LqPZPj09lzEjexw_BprRYf6SRFKOVqOMcqX_8JmIKUdB7BGurm4INUUhRdVxaByj0w42k2c86zxizSATI_d9iJkzcWcy5LfHEYhCubv_PhdSszxoW7IEVDfchQgngd1VEeHoiZyDhkA-UChK6s8gxbzegJu3D1bsIZYStmT80-pWo3Qm_aalf_X5WEmUHqM3v2jkNqMURRyIKxPBLIFYjKGTylKwiNhCh34y1SzlVImz1Un990tMmyRIyKeyMjYDOCGDHaAYJHdGDnVlfXU226hf0fOWj1xzO2GoM-qLYFHz4qYRqjLlDHv0X3Z1hsrabWJYPDUZ4AAqV9jDf0ykTuA4kwjSu0rj7LZTwN8fWktJt0X2Di0bj9R3QCL0qjYJAVwshXWAfJYtipm9vxh0ESbfPaWmSYupt8EAXI3STd7NRfkfL3cOf-ACy5vXoMpqfRSmDDvMA1I9vvfHxHXD_iNQ1KSwyIv4Jllu75h7gd79ZiMbmNTDaEtUNavLwNd2sCeXMDwGuwlJuCKWnhkvubhCO_DNF4av-idBYkx7OXuj3mjoZeSerX8xvokhv0pCZVmbJHRFUKMGvlsJL_7pM492qZOhgv7EMMLEDE1rHW2-K3TObPxnDYLTnSo7Q7PTP-HteUSW1om_hf1NG-2vDFZDZcauKPi_QAC7zqfnZBCUY7uHUxHDOmWiExtbUuyG0Zdhta_TvlG7O38sM3n7QFrEC1yObAWOs4fqN6fmUzmeC45opI3MAFqBeTEE1SqwE_lZ5MLRGUILDHUyQOkZGa1ZJ58HdiGrSCqOiHV8lc0Zxuuonx8MUoDff23xtMrviDpFkE4d859FYZDcWWgynpqh0R3iKY4CAmW2ZgTrOTPTmCGXlWT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd09s31-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 200 financeJournalJSON_u.js Show response
money18.on.cc/js/ 832 B
701 B 284ms
283ms XHR
application/javascript 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://money18.on.cc/js/financeJournalJSON_u.js
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/lib/jquery/jquery-3.3.1.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 404d212f35837198cd988d27b5e3ee7971ac47e5d935c9438a992505cb1e8d8d

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://money18.on.cc/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:17 GMT
content-encoding: br
referrer-policy: no-referrer-when-downgrade
cf-cache-status: REVALIDATED
last-modified: Wed, 21 Feb 2024 13:02:58 GMT
server: cloudflare
etag: W/"65d5f482-340"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=5, s-maxage=5
cf-ray: 858fbce59f3ca7ff-SYD
alt-svc: h3=":443"; ma=86400

GET
H3 200 icon_daily.png
money18.on.cc/img/ 1 KB
2 KB 14ms
14ms Image
image/png 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/icon_daily.png
Requested by: Host: money18.on.cc
URL: https://money18.on.cc/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2927bf260db54b79b4dc564d15fced79e37b7474b603b1d2adec244a26d59cd9

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Feb 2024 14:39:17 GMT
cf-cache-status: HIT
last-modified: Mon, 08 Jun 2020 09:49:53 GMT
server: cloudflare
age: 1784
etag: "5ede09c1-54e"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=3600, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbce59f3ea7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 1358

GET
H3 200 globalfw_460x132.jpg
money18.on.cc/img/housead/ 103 KB
103 KB 101ms
100ms Image
image/jpeg 104.16.169.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://money18.on.cc/img/housead/globalfw_460x132.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.169.108 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37fc1d18f7f5ad9a2bff77a14765d8443256ef0ff5b607fdf1b5acb3857d0a7f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://money18.on.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 14:39:23 GMT
referrer-policy: no-referrer-when-downgrade
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Mon, 28 Sep 2020 04:02:37 GMT
server: cloudflare
age: 7
etag: "5f71605d-19a10"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=60, stale-if-error=86400, stale-while-revalidate=30
accept-ranges: bytes
cf-ray: 858fbd0df816a7ff-SYD
alt-svc: h3=":443"; ma=86400
content-length: 104976

GET
H2 200 dc_oe=ChMIu7P90tS8hAMVzKtmAh3tpwV1EAAYACC9huVj;dc_eps=AHas8cCnBToSWa6kHpHffhGOd3lsXVJxrq7_CPg0A4MLSMEdhTR4xldrIn_wsFsmTs14bIZhnxyqZFcAjxj3jd-y;met=1;&timestamp=1708526364330;eid1=871060;ecn1=1;etm1...
ade.googlesyndication.com/ddm/activity/ Frame AA2D 42 B
108 B 237ms
140ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIu7P90tS8hAMVzKtmAh3tpwV1EAAYACC9huVj;dc_eps=AHas8cCnBToSWa6kHpHffhGOd3lsXVJxrq7_CPg0A4MLSMEdhTR4xldrIn_wsFsmTs14bIZhnxyqZFcAjxj3jd-y;met=1;&timestamp=1708526364330;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Feb 2024 14:39:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIk8nh0tS8hAMV0qtmAh2Azg_rEAAYACC9huVj;dc_eps=AHas8cB_Obf5bTpERjdmrqvJSV1-yHUP3BZMNfNwZd5rGbeqIrelD0tNIGKGrJPD35vzJ-smMb0zUJI8meMwLW1P;met=1;&timestamp=1708526364339;eid1=871060;ecn1=1;etm1...
ade.googlesyndication.com/ddm/activity/ Frame D0AE 42 B
108 B 229ms
141ms Image
image/gif 142.251.221.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIk8nh0tS8hAMV0qtmAh2Azg_rEAAYACC9huVj;dc_eps=AHas8cB_Obf5bTpERjdmrqvJSV1-yHUP3BZMNfNwZd5rGbeqIrelD0tNIGKGrJPD35vzJ-smMb0zUJI8meMwLW1P;met=1;&timestamp=1708526364339;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.66 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS